The best phone system for cybersecurity vendors and resellers

A narrow, heavily solicited target: get more attempts in without degrading the conversation.

Get started now Book a demo
No commitment · Number live in 2 minutes
Countries included in the base plan · +160 countries on request

Hundreds of companies use to make every call pay off

The situation

What holds you back today

01

CISOs are over-solicited and rarely reachable

02

Long decision cycles with several stakeholders

03

A technical pitch that is hard to standardise

The answer

What Skipcall changes

4 parallel lines on a narrow target

The parallel dialer →

AI transcription to sharpen the technical pitch

Recording and transcription →

Coordinated call, email and SMS sequences

Sequences →

Specific to your industry

The three reflexes of a CISO on the phone, and what to do with them

A security lead is trained to distrust a call they did not ask for: that is the job. The objections you hear are therefore not ordinary sales objections, and treating them as such costs you the call.

“How did you get my number?”

The question is not rhetorical. An unknown caller asking questions about the information estate looks like reconnaissance, and NCSC guidance tells staff to verify unexpected callers rather than answer them. Say precisely where the data came from, straight away, offer to be called back on the number published on your own website and to send a message from your own domain. On a first call, ask nothing about architecture, versions, headcount or suppliers: those are exactly an attacker's questions.

“We already have a supplier”

Usually true, and attacking the incumbent closes the door. Move the conversation to what is not covered: a recently acquired site, operational technology on the industrial side, a cloud environment that arrived after the contract was signed. Above all ask when the current contract comes up for renewal and write the date down, because that is what drives the next useful call.

“Send me some information”

Nine times out of ten this is a polite exit. Ask what question the document is supposed to settle, send only enough to answer it, and fix the date of the follow-up call before you hang up. Material sent without a dated next step produces nothing and leaves you with no legitimate reason to come back.

“It is not my decision”

Often accurate: the CISO specifies, but the budget may sit with the IT director, with finance or with risk and compliance. Do not read it as a brush-off. Ask who signed off the last security spend, then who would carry it this time. You will get a name, which is worth more than an agreement in principle.

“Call me after the audit”

This is the one objection worth a firm appointment. A Cyber Essentials renewal, an ISO 27001 surveillance audit, a PCI DSS assessment or a penetration test all fix a date, a scope and a list of findings to close, and therefore a budget. Ask when the report is due, set the follow-up for that exact moment, and come back with the question the report will have raised.

On a target this narrow, the record of each attempt matters as much as the attempt: calling the same person twice in one week is enough to burn the account.

The script

The script for a first call to a CISO

You are calling a security lead or an IT director on their direct line, unannounced. The replies below answer the five reflexes described above one by one. The aim of a first call is not to qualify the estate, it is to get a date.

The opening

“Hello [name], [first name last name] from [company]. Your number came from [precise source]. I am not going to ask you anything about your estate, your tools or your suppliers. I just want to know whether [precise subject, coverage of your operational technology for instance] is an open subject for you this year, or not at all.”

Announcing that you will ask no technical questions defuses the suspicion before it fires, and leaves a question that can be answered yes or no.

If they ask where the number came from

“From [exact source]. If you would rather check, hang up and call me back on the number published on [domain], I am on extension [x]. I will also send you a message from my address at [domain] while we are talking.”

Offering the verification yourself is what separates your call from a social engineering attempt, and it costs one sentence.

If they already have a supplier

“Good, and I am not going to tell you they do a bad job. My question is elsewhere: does the scope of that contract cover [the industrial site, the acquired subsidiary, the cloud environment that arrived since]? And when does the contract come up for renewal?”

The renewal date is the only piece of information that drives the next useful call: write it down the moment it is said.

If they ask for documentation

“I will send you something, but a brochure will be no use to you. Tell me the question it needs to answer and I will send only that. And I will call you Thursday at nine to find out whether the answer holds, does that work?”

If they say it is not their decision

“I assumed so, the spend rarely comes out of your line. Last time you bought something in security, who signed it off? And this time, would it be the same person?”

You are after a name, not an agreement in principle: a name can be called, an agreement in principle cannot.

If they point at the end of an audit

“Happy to. When is the report due? I will put [date] down and I will not call you before then. And when I do, it will be about the findings the report raised, not about my product.”

At Skipcall, every call is recorded, transcribed and summarised, so the script gets corrected against what your reps actually say rather than what we imagine they say.

Avoid this

Three mistakes this industry makes on the phone

The mistake

Qualifying technically on the first call: which EDR, how many endpoints, who runs the SOC, which provider manages the network.

Do this instead

Those are word for word the questions of a reconnaissance phase, and a security lead is trained not to answer them on the phone. Keep them for an established conversation, once your identity has been verified. On a first call, ask only whether the subject is open and when it gets decided.

The mistake

Calling with the number withheld, or from a different number on every attempt.

Do this instead

A security lead who cannot call the displayed number back files the call as suspicious, and sometimes reports it internally. Ofcom's rules require outbound calls to present a valid, dialable number that identifies the caller, so use a business number tied to your company, ideally the one on your website. A number that stays the same from one attempt to the next builds the only thing that counts here, recognition of the caller.

The mistake

Opening on the breach of the moment, along the lines of “did you see what happened to that company?”.

Do this instead

They read the report before you did, and the opener puts them in the position of justifying their own defences to a stranger: the conversation is lost by the second sentence. Open on a verifiable date instead, a contract ending, an audit under way, a certification renewal, a regulatory deadline, and let them describe what follows from it.

A calendar full of meetings starts with a call.

Get started now Book a demo

No commitment · Number live in 2 minutes

FAQ

Frequently asked questions, Cybersecurity

Say who you are, where the number came from and why you are calling them rather than someone else, in the first three sentences. Ask nothing about the information estate on a first call: describing an architecture to a stranger on the phone is precisely what a security lead has been trained not to do. Offer a callback on a public number and a message from a verifiable domain, which removes the doubt without demanding anything. The useful conversation is about dates: contract end, audit, certification renewal, a project already under way.
Yes, and it is the first obstacle in this sector. An unsolicited call that tries to establish which tools are in use, who the suppliers are or who holds which post reproduces the opening of a social engineering attack, and some security teams log and report those calls internally. The counter is transparency: full identity, the origin of the data, a verifiable callback channel, and no technical questions until the relationship exists.
Because the target is small, the point is to sustain a lot of attempts without ever losing the thread of an account. Skipcall dials four lines in parallel, drops voicemails through AI detection, then records, transcribes and summarises every call, which lets you pick a technical conversation back up two months later without reinventing it. Sequences combine call, email and SMS on the same contact. Four CRMs are integrated natively, HubSpot, Pipedrive, Salesforce and Attio, with other tools connecting by API.
Those are the two answers a security buyer actually wants. The recordings, transcripts and summaries belong to your organisation: you decide which of your people hold a licence, and therefore who can open them, and you decide how long they are kept and when they are deleted. Skipcall processes that data on your instructions, so the retention period is your call, not a default you inherit. Recording a call also requires you to tell the other person at the start of the conversation and to define a purpose for the recording. If your procurement process needs those points in writing, settle them at the contract stage rather than after the first campaign.
A sequence spread over three to four weeks, alternating call, email and a message on a professional network, holds up far better than a burst of rapid retries. Each attempt has to bring something new, otherwise it reads as pressure and puts you on a mental blocklist. The real trigger is not frequency but a date: contract renewal, the end of an audit, a new appointment. Note those dates the moment they are mentioned, they are worth more than ten follow-ups.

Other industries that prospect by phone

See all 25 industries →

Web, SEO & marketing agencies

Selling time in an agency is whatever is left over: make it ten times more productive.

Media & ad sales

Selling space is won on the phone against hard deadlines: call more people, faster.

Events & trade shows

A show fills in a matter of weeks: point all your calling power at that window.

See what it does on your own lists

A demo runs on your own contacts, not on a sample data set.

Try it → Book a demo

Personalized demonstration