Cold calling a CTO or CISO means calling people whose job is to defend against exactly what you’re doing: a stranger on the phone asking questions about their organization. For a chief technology officer, and even more for a chief information security officer, trust comes before the pitch. Be verifiable, ask for nothing sensitive, and talk about risk or uptime rather than features.
This guide is part of a series on the decision-makers SDRs call most. It builds on our guides to cold call openers, scripts and objections.
What are CTOs and CISOs focused on in 2026?
At a small company, the CTO or head of IT is often alone and covers everything: infrastructure, apps, support, security. At a mid-market or enterprise company, the CISO is a separate role, reporting to the CIO, the CEO, or a risk or legal function. At a startup, the CTO usually runs product engineering, and company security is often a shared responsibility.
Three themes dominate in 2026.
A threat that keeps rising. IBM’s 2026 Cost of a Data Breach report, based on 602 breaches that occurred between March 2025 and February 2026, puts the global average cost at $4.99 million, up 12%, and the US average at $11.5 million, up 11% (Baker Donelson, July 30, 2026).
The phone as an attack vector. CrowdStrike’s 2025 Global Threat Report, released February 27, 2025, recorded 442% growth in vishing operations between the first and second half of 2024 (CrowdStrike executive summary). In these campaigns, attackers often pose as IT support. That’s the context your call lands in: a CISO has taught their team to distrust strangers who call and ask questions.
Disclosure and compliance pressure. Since December 2023, SEC rules require US public companies to disclose a material cybersecurity incident on Form 8-K within four business days of determining it is material (SEC press release, July 26, 2023). Security has become a board topic, and CISOs spend more time on governance, reporting and vendor risk than a few years ago. For companies selling into Europe, NIS2 and, in financial services, DORA add their own obligations.
Their KPIs and vocabulary
A CTO will ask what your tool changes for users and for their team. A CISO will ask what it changes for their risk, and what risk it adds. That second question is the one most reps forget: every new vendor is also a new attack surface.
| KPI | Who tracks it | How your call can connect to it |
|---|---|---|
| Uptime, SLA attainment | CTO, CIO | You reduce outages or service incidents |
| IT budget, cloud spend | CTO, CIO | You consolidate tools or cut a bill |
| Roadmap and project delivery | CTO, CIO | You free up team time for a priority project |
| Mean time to detect and respond | CTO, CISO | You speed up detection or resolution |
| Patch coverage, open vulnerabilities | CISO | You reduce unaddressed exposure |
| Phishing simulation click rate | CISO | You improve employee awareness |
| Compliance (SOC 2, ISO 27001, NIST CSF, HIPAA, PCI DSS) | CISO | You provide evidence or a control auditors expect |
| Third-party risk | CISO | You are a low-risk vendor, and you can prove it |
Their vocabulary: attack surface, least privilege, SSO, MFA, zero trust, BC/DR, SOC 2 Type II, security questionnaire, vendor risk assessment, shadow IT, tech debt, FinOps. If you don’t own a term, don’t use it. CISOs often test a rep’s depth with one technical follow-up.
When to call a CTO or CISO
| Period | What’s happening | Your move |
|---|---|---|
| Year-end | Change freezes are common, holidays | Short calls, aim for a January meeting |
| Audit windows (SOC 2 fieldwork, ISO 27001 surveillance) | Team busy collecting evidence | Avoid |
| Major releases, migrations | No bandwidth | Avoid, call back after |
| Public security incident | Crisis management | Don’t call to sell |
| Budget planning (often Q3 to Q4) | Next year’s roadmap trade-offs | Good time to get into the plan |
| A new CTO or CISO | Review of the existing stack | Your best window |
During the day, early morning and late afternoon avoid standups and steering committees. Our best time to cold call B2B guide and the when to call tool help you choose your windows.
How to get through without touching the help desk
CTOs and CISOs at small and mid-market companies rarely have a dedicated assistant. The gate is the front desk, the generic inbox and their habit of ignoring unknown numbers. General techniques are in our gatekeeper script guide. Three rules specific to this function:
- Never go through the help desk. Calling IT support to get a name, a direct line or the name of a tool recreates the social engineering scenario the help desk is trained to spot. At best they hang up; at worst your call gets reported to the CISO as a suspicious attempt.
- State your purpose at the front desk. “Hi, this is Jordan Reyes from [company]. It’s a sales call for the IT leadership team. Could you tell me who I should speak with, or transfer me?” Transparency reassures, and a receptionist who knows you’re a rep routes you more readily than one who has doubts.
- Announce the call in writing. A two-line email or LinkedIn message the day before, with your name, company and topic, lets the CTO verify you before picking up. With a CISO it’s close to mandatory. Our warm calling vs cold calling guide covers this approach.
3 cold call openers for CTOs and CISOs
A good opener for this audience has three parts: a verifiable identity, a topic within their scope, and no request for sensitive information. General principles are in our cold call openers guide.
1. The verifiable opener (CISO). “Hi Sarah, this is Jordan Reyes from [company], you can find my profile on [your company’s site]. I messaged you on LinkedIn yesterday. I’m calling about [topic in their scope]. Is now OK for 30 seconds, or should I suggest a time?”
2. The roadmap opener (CTO). “Hi Kevin, Jordan Reyes from [company]. We help engineering leaders at mid-market SaaS companies [measurable result on one of their KPIs]. I don’t know your situation, which is why I’m calling: is that on your roadmap for next year?”
3. The compliance opener, handle with care. “Hi Sarah, Jordan Reyes from [company]. Many of the CISOs I talk to are spending more time on vendor risk reviews than they’d like. We help with [specific, verifiable point]. Is that an open workstream for you?” Use it only if your offer genuinely helps with that work, and never hint at imminent penalties. Playing on fear is the surest way to lose a CISO.
5 common CTO and CISO objections and how to answer them
“How did you get my number?” Answer immediately and precisely: “It comes from [exact source]. If you’d rather not be called, I’ll note that right now.” CISOs often ask this to test vendors, and a vague answer ends the relationship. For contacts in Europe, GDPR also requires telling people where their data came from.
“Send me your security documentation.” “Of course. We have [available documents: security overview, SOC 2 report, completed questionnaire]. I’ll send them today. So you read them with the right context, can we set 20 minutes after you’ve reviewed them?” Have these documents ready before calling CISOs. If they don’t exist, you’re not ready for this audience.
“Go through vendor onboarding.” “I will. Could you tell me who runs it, and whether the topic looks relevant to you? I’d rather start onboarding with your go-ahead.”
“We don’t take vendor calls.” “Understood, and I won’t call again. Can I send you a five-line email you can read whenever you want?” Respect the no. This audience remembers reps who push.
“We already have a tool, or a partner, for that.” “Makes sense, and I won’t ask which one. What usually makes our customers switch is [specific reason]. If that’s not a problem for you, I’ll leave you alone.” Don’t ask for the name of the incumbent tool: that’s exactly the information a CISO doesn’t share with a stranger.
Rehearse these out loud with our objection handling practice tool.
A short CISO cold call script
You: Hi Sarah, it’s Jordan Reyes from [company]. I messaged you on LinkedIn yesterday about [topic]. This is a sales call. Do you have a minute, or should I suggest another time?
CISO: One minute. How did you get my number?
You: It comes from [exact source]. If you’d rather not be called, I’ll note it. Otherwise, here’s why I’m calling: we help CISOs at mid-market companies [measurable result]. I’m not going to ask you anything about your environment today. My only question: is this something you plan to move on in the next twelve months?
CISO: Maybe. Send me some documentation.
You: I’ll send our [security document] and a one-pager today. I’d suggest 20 minutes after you’ve read them, say Thursday next week at 9, with someone from our technical team. If the documents don’t convince you, just tell me and I won’t push.
The script follows our cold call script template, with two adjustments for this audience: the data source is given straight away, and no question is asked about the technical environment. Qualification questions come in the second meeting, using our discovery questions.
Mistakes to avoid with CTOs and CISOs
Asking reconnaissance questions. Current tools, versions, team structure, providers: none of it on the first call.
Selling fear. “You could be next” or “the fines will be massive”: CISOs hear this every day and file it under scare marketing.
Being vague about who you are. “I’m calling on behalf of a partner” or a first name only sets off every alarm. Full name, company, reason for calling.
Promising total security. “With us, you’re protected” is false for any product, and a CISO knows it.
Not having your own security documentation. A vendor that can’t say where its data is hosted, who can access it and how it’s protected won’t pass review, however good the product.
Calling on a loop. A CTO who said no once and gets five more calls can block your number, and sometimes report your domain.
When you work a list of CTOs or CISOs, a power dialer, which dials one number at a time, gives you a moment to reread the record and yesterday’s message before each call. Recording and transcription keep you from asking for information you already got, which a CISO always notices. Check the consent rules first: our guide to call recording laws covers one-party and two-party consent states.
Other decision-makers in this series
- How to cold call CFOs: a buyer who turns every pitch into total cost and payback period.
- How to cold call CMOs: a buyer measured on pipeline who recognizes every prospecting technique.
- How to cold call VPs of Sales: someone who does your job and will grade your call.
- How to cold call HR directors: a buyer caught between hiring, employment law and budget.
- How to cold call founders: the person who decides everything and has time for nothing.
What to remember
- To a CTO, and especially a CISO, an unknown call looks like an attack first: trust comes before the pitch.
- Be verifiable, announce the call in writing, and ask nothing about the technical environment on first contact.
- Talk uptime, roadmap and cost with the CTO; risk, compliance and proof with the CISO.
- Avoid year-end freezes, audits and releases, and never call to sell during a public incident.
- Have your own security documentation ready: it often decides whether you get the second meeting.
