Script library: by industry
For security vendors and consultancies calling CISOs, heads of IT and risk leaders, with no scare tactics. Every line is ready to use: replace each {{placeholder}}, read it aloud a few times, then make it sound like you.
Quick answer
Security leaders receive more cold outreach than almost any other buyer, and most of it leads with breach headlines. That approach trains them to hang up. The script below sounds like a peer who understands the job: budgets are fixed, the board wants assurance, and the team is small.
Research matters more here than anywhere. Know the organisation's sector, roughly how big the IT team is, whether they publish anything about frameworks or certifications, and whether security is owned by a CISO or folded into the IT manager's role. Pick the line that fits; don't read both.
Six parts, in the order buyers expect them. The note under each part explains why it is written that way.
Hi {{first_name}}, it's {{your_name}} from {{your_company}}. I'll be straight with you, this is a cold call about {{security_area}}.
I know you get a lot of these, so I'll keep it to 30 seconds and you can tell me if it's relevant. Fair?
Why it works: Acknowledging the volume of calls they get is honest and earns a hearing. Name the specific area, not 'cybersecurity'.
We work with security teams in {{industry}} who are working towards {{framework}} with a small team, and the part that usually hurts is {{common_problem}}.
I noticed {{trigger}}, which is why I called you rather than someone else.
Why it works: Framework plus team size plus one pain. Security leaders recognise their own situation quickly when it's described accurately.
How are you tracking against {{framework}} at the moment, roughly?
Where does {{security_area}} sit on the list for the next six months?
Is that something your team handles internally, or do you use a partner?
When you do bring someone in, who else is involved in choosing them?
Why it works: Never ask them to disclose specific weaknesses on a cold call. Ask about priorities and process. It keeps the conversation safe for them.
That's where we usually help. For a {{similar_company}}, the main outcome was {{result}}, without adding headcount.
We're not the answer to everything, and I'd rather tell you that now.
Why it works: Security buyers distrust vendors who claim to solve everything. Naming your limits makes the one result credible.
Would a 30-minute call with one of our {{expert_role}}s be useful? It's a technical conversation, not a pitch, and you'd come away with a view on {{security_area}} either way.
Does {{day_time_1}} or {{day_time_2}} work better?
Why it works: Offer an expert, not a salesperson. Security leaders accept meetings with practitioners far more readily.
Great. I'll send an invite for {{agreed_time}} from {{email}}. Would you like anyone from your team on it?
Is there anything you'd want us to avoid, or anything you'd need under NDA before you'd share detail?
Why it works: Asking about NDA up front shows you understand how they work and removes a reason for a last-minute cancellation.
Swap one of these in for the opener above when the situation fits.
Hi {{first_name}}, {{your_name}} from {{your_company}}. I'm calling security leads in {{industry}} who report against {{framework}}. Most tell us {{common_problem}} is the hardest part with a lean team. Is that true for you, or are you well ahead on it?
When to use it: Use when the organisation publicly references a framework, certification or regulator.
Hi {{first_name}}, it's {{your_name}} at {{your_company}}. Congratulations on the new role at {{prospect_company}}. People coming into security roles usually spend the first 90 days working out what they've inherited. I'm calling to see if an outside view on {{security_area}} would help with that.
When to use it: Use within the first three months of a new security or IT leader starting.
For when reception or an assistant answers. Be honest about who you are and ask for help.
More gatekeeper scriptsHi, it's {{your_name}} from {{your_company}}. I'm trying to reach whoever is responsible for information security. Is that {{first_name}}, or does it sit with the IT manager?
Acknowledge, ask one question, then offer a smaller step or let them go.
All objection responsesMost organisations your size do. We're often the second opinion rather than a replacement. When did you last get an outside view on {{security_area}}?
Why: Positioning as a second opinion avoids asking them to fire anyone, which security leaders are rarely keen to do mid-year.
Happy to send one, but honestly most of what's out there is marketing. Would a one-page summary of what we see in {{industry}} be more useful? If it's relevant, we could talk it through for 20 minutes.
Why: Admitting most content is marketing is credible to this buyer and gives you a narrower, more useful follow-up.
That's normal in security. Planning for next year is usually where we start anyway. When do you start building the next budget, and would it help to have a view on {{security_area}} before then?
Why: Security budgets are planned well ahead. Getting into the planning window is a real outcome for a cold call.
Fair question. It's listed as your business number on {{source}}. If you'd prefer I didn't call it, I'll take it off our list straight away.
Why: Answer honestly and offer removal immediately. It is the respectful response and it reflects the requirement to honour removal requests.
That's great to hear. Out of interest, is the team stretched across operations and project work, or do you have dedicated people on {{security_area}}?
Why: Internal teams are often capable but thin. Asking about capacity rather than capability keeps it respectful.
Under 30 seconds. Skip voicemail on the first attempt and pair it with an email the same day.
12 more voicemail scriptsHi {{first_name}}, it's {{your_name}} from {{your_company}}. I'm calling about {{security_area}} for {{industry}} security teams working towards {{framework}}. No pitch on a voicemail. I'll email you a short note and try again on {{day_time_1}}. My number is {{phone}}.
Send it the same day as the call or voicemail. It identifies you and includes a working unsubscribe.
Subject: {{framework}} and {{security_area}}
Nousu has not published a cybersecurity benchmark row. Use the all-dials averages as a reference point.
Australian cold calling statistics| Measure | Published figure or what to track |
|---|---|
| Dials that reach a live person | 14% |
| Dials that become a conversation with a decision maker | 6% |
| Decision-maker conversations that book a meeting | 22% |
| Meetings per 100 dials | 1.3 meetings per 100 dials, against 0.3 for offshore teams |
These are Nousu's all-dials averages from 218,000+ dials into Australian businesses, November 2024 to April 2026. Nousu has not published a separate figure for this segment, so treat them as a reference point, not a target.
To see how many dials your own meeting target needs, use the meetings per dial calculator.
General information only, not legal advice.
Australian cold calling lawsThis script is a starting point. The free cold call script generator builds a version around your offer, buyer and market, with your own objection responses, voicemails and follow-up emails. It runs in your browser and nothing you type is stored or sent.
FAQ
Practical answers from the team that makes the calls.
Book a 30-minute call. We'll map your market and buyers and show you what a phone-first campaign would book.
Starting at $7,000 a month. Exact fee quoted after a 30-minute call.
