Cold calling: what it is and how to call effectively in B2B sales

How to call without sounding like a telemarketer and open conversations that build interest

Cold calling has a bad reputation. But not because the phone stopped working. It has a bad reputation because for years it was used in the worst possible way: a random database, a generic script, too fast a jump to the offer, and a conversation conducted as if there were no living person on the other end, just a number in a table.

In B2B sales this is particularly visible. If your client is a business owner or a C-level manager, they are certainly not sitting and waiting for a call from yet another vendor. They have people, clients, current problems, decisions, deadlines and dozens of matters demanding attention. If someone calls with the message “I would like to present our offer”, in most cases they lose within the first few seconds. Not because their offer is bad, but because the conversation started from the wrong end.

Good cold calling is not about offering or selling anything. Cold calling is about opening communication, building interest and agreeing the next step. It is best done on the basis of the problems the person we are talking to faces. The point is to check whether on the other end there is a problem important enough to make it worth continuing the conversation, and later the contact.

To illustrate this better, I will show it on the example of a company implementing password management and cybersecurity solutions for small and medium-sized companies. The recipient of the call will not be an IT administrator or a security specialist, but the decision-maker on the business side: the owner and/or CEO. This matters, because such a client usually does not buy a “password manager”. They buy more control, less risk, peace of mind, tidy access rights and fewer situations in which the company’s security depends on employees’ random habits.

A cold call is not a presentation of the offer

The biggest mistake in cold calling is that the salesperson treats the call as a miniature sales presentation. They call and say: “Good morning, I represent a company that implements password management and cybersecurity solutions for small and medium-sized enterprises. I would like to present our offer”.

The problem is that the recipient does not yet see any reason why they should listen to this. They do not know whether the problem concerns them. They do not know whether the conversation will be specific. They do not know whether it will be an attempt to sell them a tool they do not need, they do not know how much time they will lose, and above all they do not yet feel any tension.

That is why a good cold call should start not with the offer but with a problem hypothesis. In practice it may sound like this:

“Good morning, I am calling because we work with companies in which access to passwords, accounts and systems was handed out rather spontaneously over the years. The company grew, people, tools, accounts and applications were added, but nobody really has full control over who has access to what. Because if so, it creates quite a few threats to the company. I wanted to check whether at [Company_name] it looks similar, or whether you have it perfectly in order and it is known exactly who has access to what?”

This is still a cold call, but it sounds different. It does not start with “we have a product”. It starts with a situation the recipient can recognize. The call is then not an attempt to push an offer, but a test of whether the problem is on target. The more accurately we have defined our clients’ problems, the more the communication will resonate.

The client does not think in terms of the tool

This is particularly visible in selling cybersecurity services. The vendor often thinks technically: we implement a password manager, set up MFA, tidy up permissions, create access policies, train employees, secure company accounts. These are elements of the service and they have their weight, but the potential client usually does not think that way.

They more often ask themselves other questions. Does someone from the team still have access to systems after leaving the company? Does the salesperson keep passwords in a private notebook? Is the company protected if someone clicks the wrong link? Does one person in the office know all the passwords, and what happens when that person is gone? Do we have control over access, or do we only think we do?

A cold call should speak the language of these problems, not the language of implementation. If you sell password management and cybersecurity, do not start with the tool. Start with the risk the client does not want in their company but often has no time to sort out.

A good conversation starts before the call is made

In many companies cold calling looks like this: we take a database, choose an industry, call, measure activity. That is too shallow. The most important part of cold calling happens before the conversation, because the effectiveness of the activity depends on a well-qualified database. If it is random and badly segmented, the best narrative will not hit the mark.

A company implementing password management should not call “all SMEs”. That is too broad a field, in which it is hard to build a specific reason for contact. A better starting point is, for example, manufacturing companies employing a few dozen people, trading companies with a large sales team working on a CRM, companies working in a hybrid model, with employee turnover, without an extensive IT department, or those that work on particularly sensitive client data.

Each of these companies has a different pain point. For a marketing agency the problem may be access to clients’ ad accounts. For an accounting office, access to financial data. For a manufacturing company, email, ERP and technical documentation. For a consulting firm, confidential client files. For a web design company, access to clients’ website hosting. If you use one script for all of them, you will sound generic. If you understand the specifics of the segment, the conversation will make sense. The client will recognize themselves in the context raised and will feel that this is not a random call.

The problem hypothesis matters more than the pitch

Cold calling in consultative selling should be based on a problem hypothesis, not on a ready product pitch. You do not ask: “Would you be interested in implementing password management?”. Most recipients will then answer: “I don’t know”, “not now” or “we have that handled somehow”. That is natural, because the question makes the client immediately assess the need to buy something they may not yet see as a problem.

A better entry is through a description of the situation:

“In many companies with a few dozen people, passwords, access rights and accounts are somewhat scattered. Some are in browsers, some in Excel files, some in employees’ heads, some in private password managers. As long as nothing happens, it looks like a minor mess. The problem starts when someone leaves the company, an account gets taken over, or it becomes necessary to quickly establish who has access to what. Based only on your subjective feeling, on a scale of 1 to 10, how well organized would you say this area is at your company?”

The potential client does not need to know the whole cybersecurity market. They do not need to understand the tools or immediately declare interest in buying. They only have to say whether the problem described is familiar. That is a much easier way into the conversation, because it does not force a decision. It only requires connecting the problem with reality.

The first 15 seconds decide everything

A cold call is usually lost not after five minutes but in the first fifteen seconds. If the beginning sounds like standard telemarketing, the recipient mentally ends the conversation before you get to the point.

A weak opening sounds correct, but does not work in sales: “Good morning, my name is Anna Kowalska and I represent SecurePass. We specialize in implementing modern cybersecurity solutions, in particular password managers, access control and protection of company accounts. May I take a moment?”. The client then hears: vendor, offer, technology, sales.

A better opening will be more specific and rooted in the recipient’s world:

“Good morning, this is Anna Kowalska from SecurePass. I took the liberty of calling because we work with manufacturing companies that have grown to a few dozen people and at some point realize that passwords, accounts and access rights are more in the hands of employees than under the company’s real control. I wanted to check how this looks at your company and whether it is a topic worth exchanging a few sentences about?”.

This opening speaks to a specific type of company, describes a situation instead of a product, does not assume in advance that the client has a problem, and gives them an easy way to say “yes”, “no” or “probably”. A cold call is not meant to convince right away. It is meant to open a conversation.

Do not ask whether the client has a moment

The question “do you have a moment?” looks polite, but often does harm. The potential client usually does not have a moment. Even if they do, they do not yet know whether they want to spend it talking to someone they do not know.

A better construction is: “I will tell you in 20 seconds why I am calling, and if it is off target, I will wish you a good day and hang up?”. Or: “I have one check question. If the topic is not relevant, I will not take up your time”. That is more specific, because you are not asking for an undefined moment but for consent to a short relevance test.

Do not sell cybersecurity. Sell the cost of disorder

Clients rarely wake up in the morning thinking: “I must implement better password management”. More often they react only when something happens: an employee leaves and nobody knows what they had access to, someone shares a password outside the company, an email account is taken over, a client asks about security standards, the company loses access to an important account, or an audit reveals chaos.

The problem is that a good salesperson should not wait for something bad to happen to the client. They should be able to name the cost of the status quo earlier. Calmly, without scaremongering:

“We often meet companies that say: we have it handled somehow. Only when an employee leaves or an incident occurs does it turn out that nobody has a full list of access rights, passwords and accounts. That is exactly the area we help put in order before it becomes a real problem”.

This is stronger than the sentence “we implement a password management system”, because it shows the consequence of not acting. The recipient is then not buying features. They start to understand the cost of disorder.

Diagnostic questions instead of random needs discovery

Many salespeople hear that they have to “discover needs”, so they start asking general questions: what challenges do you have, what role does IT security play in your company, what solutions are already in place in your organization? These are not bad questions, but a cold call is not the right place for them. A cold call is not the place for needs discovery, but for opening communication, building interest and arranging the proper conversation. It is much better to move extended open questions to the needs discovery.

stage. Better are diagnostic questions that follow from the problem hypothesis. For example: do you have one central place where the company controls access to its systems, or does each team manage in its own way? What happens to access rights when an employee leaves? Does management have real visibility of who has access to email, the CRM, bank accounts, advertising tools and client systems? Are passwords managed at company level, or does each employee rather use their own methods?

Such questions do not sound like sales. They sound like a diagnosis. And that is why they can work.

Show the business problem, not the technical one

Cybersecurity can easily turn into a technical conversation. MFA, SSO, password manager, password policies, permissions, audit, phishing, endpoints and logs may matter, but not necessarily in the first conversation with a decision-maker.

The client wants to know whether the company is exposed, whether it can be put in order without paralyzing the organization, whether it will be expensive, whether people will be able to use it, whether there will be less chaos after implementation and whether management will have more control. That is why a cold call should explain cybersecurity through the language of control, risk and responsibility.

“It is not only about employees having stronger passwords. It is about the company knowing who has access to its systems, being able to quickly revoke access when an employee leaves, and security not depending on whether someone saves passwords in a browser, Excel or a private notebook”.

That is the client’s language. Not technology for technology’s sake, but order in the company.

Contrasts explain value faster

In cold calling there is no time for long lectures, which is why contrasts work well. It is not about yet another IT tool, but about control over access in the company. It is not about making people’s work harder, but about the company not depending on employees’ random habits. The problem is usually not a lack of passwords, but a lack of knowledge of who has them and how they are used.

Sentences of this kind help the recipient quickly understand that the conversation is not only about a technical implementation, but about organizational maturity. As long as a company has eight people, many things can be handled informally. At forty or a hundred and twenty, the same way of working starts to become a risk.

A model of a cold calling conversation

Let us assume that SecurePass implements password management, tidies up access rights and helps small and medium-sized companies reduce the risk related to employee accounts. It calls a decision-maker at a medium-sized manufacturing company employing about 70 people.

Opening

“Good morning, this is Anna Kowalska from SecurePass. I am calling because we work with companies that have grown to a few dozen people and at some point see that passwords, accounts and access rights are more scattered than they should be. I wanted to check whether at your company this is any kind of topic, or whether you rather feel that access to company data and applications is perfectly controlled?”.

When the client says: “we have it more or less handled”

It is not worth contradicting or proving that they are surely wrong. Better to clarify:

“Sure. And when you say you have it handled, do you mean more that you have a specific tool and a procedure for revoking access in place, or rather that the IT team keeps an eye on it on an ongoing basis?”

This question does not challenge the answer. It organizes it. It shows the difference between a situation in which the company has a system and one in which someone responsible watches over the matter manually.

When the client says: “we have an IT person”

This is a common and logical answer, not an objection to overcome. You can say:

“That is good. We often see, however, that with one IT person the topic is partly under control, but management does not always have full visibility: who has access to what, what happens after an employee leaves, and whether passwords do not live outside the company system. Is this described as a process at your company, or does it rather work operationally thanks to that person?”

This shifts the conversation from the person to the system. And that is the right direction, because in a medium-sized company the problem is often not the lack of a competent technical person, but the lack of an architecture that does not depend on one person.

When the client says: “I would have to ask our IT guy”

This is a very important moment. The salesperson does not have to move straight to a presentation. They can say:

“I understand. And that is often the first signal that the topic is handled technically somehow, but on the business side it is not fully visible. I am not saying it is a problem at your company, but perhaps it would be worth checking whether access is under the company’s control, not just one person’s”.

Positioning and the next step

“We help put this in order: from an access audit, through selecting and implementing a password manager, to procedures for employees and management. Not as a heavy cybersecurity project, but as a practical tidying up of access to systems. Would it make sense to have a short diagnostic call, in which we check whether this topic is actually taken care of at your company, or whether there are places where the company may be bearing unnecessary risk?”

This is a good ending, because there is no pressure in it. Nor is there an attempt to sell an implementation over the phone. There is an invitation to a diagnosis.

How to respond to the most common objections

“Please send the offer by email”

This is the most common response, and it often simply means: I want to end this conversation. It is not worth replying automatically “of course, I will send it”, because that produces a generic message that will probably get lost. A better response:

“Sure, I will send a short message. So as not to send something random, let me just ask: would the more relevant topic for you be tidying up passwords, revoking access after employees leave, or general control over company accounts?”

Thanks to this, the email can be specific. Even better if it refers to the exact thread from the conversation: “May I refer in the email to the fact that you are not sure whether access is managed according to procedures or rather relies on the competence of your IT person?”. Then the message may not be a redundant information leaflet, but a continuation of a specific topic, and there will be something to pick up in the next follow-up call.

“We have an IT person”

You should not reply: “but an IT person may not be enough”, because that sounds like an attack on the company’s current way of working. Better:

“That is good. We usually do not replace the IT person; we help put in order an area that often sits between IT, management and employees. The question is: does the company have a clear access management process, or does the IT person rather solve the matter by hand when something happens?”

“We have not had any incidents”

A bad answer would be: “that does not mean you won’t”. There is truth in it, but it sounds like scaremongering. A better answer is calmer:

“And that is very good. Many companies put this area in order not because something has already happened, but because with a larger team it becomes harder and harder to rely on informal rules. It is often less about reacting to an incident and more about control and predictability”.

“We have no budget right now”

It is worth distinguishing a lack of budget from a lack of priority:

“I understand. At this stage I am not assuming a project right away. Sometimes the first step is only to check whether the risk is real and where it may occur. If it turns out the topic is in order, there is no point implementing anything”.

“We are not interested”

It is not always worth fighting. Sometimes you simply have to close the conversation. But before you do, you can clarify:

“Sure. Let me just ask, to close the topic properly: are you not interested because you already have a specific password and access management system in place, or because this topic is not a priority right now?”

This question helps distinguish a real lack of need from the problem being put off. And in B2B sales that makes a big difference.

A cold call should lead to a micro-diagnosis, not a presentation

In selling consulting, implementation and technology services, the natural next step after a cold call should not be a long presentation. A better step is a short diagnostic conversation.

For a company implementing password management, this can be a 30-minute call in which the current ways of storing passwords, access to systems, the procedure for revoking access after an employee leaves, private tools used by employees, the central password policy and management’s visibility of critical accounts are checked.

Only after such a diagnosis does a conversation about implementation make sense. Otherwise the salesperson tries to offer a solution before the client understands the problem.

Why the client may not see the problem

In cybersecurity, the absence of a problem often means only the absence of a visible event. A company can operate for years with passwords in browsers, private notebooks, spreadsheets and emails. It may not have a full list of access rights. It may not revoke access systematically when an employee leaves. It may not have a clear policy for client accounts. And everything may still work. Until it does not.

That is why in cold calling you have to be careful not to sound catastrophic, because scaremongering usually lowers trust. Better is a conversation about the costs of disorder:

“This is usually not a problem you see every day. Rather one that reveals itself at a bad moment: when someone leaves, when access needs to be recovered, when a client asks about procedures or when an incident occurs. We help check whether the company has this area under control before it becomes urgent”.

The best cold calling script is not a script but a structure of thinking

It is not worth building cold calling on rigid formulas. Clients quickly sense that someone is reading from a sheet. Besides, what comes naturally out of my mouth will not necessarily come out of yours, and vice versa. Everyone may have a slightly different style of narration. That is why, instead of a cold calling script, it is better to build a framework and let everyone fill it with content that suits them. This lets you sound natural and avoids framing the conversation in client-salesperson terms. Here is what the structure of a cold calling conversation can look like:

1. A short introduction : the client knows who is calling, but the conversation does not turn into a self-presentation.

2. Context and reason for contact : you show that you know whom you are calling and why.

3. Problem hypothesis : the conversation starts with the client’s situation, not with the product.

4. One check question : the recipient gets the chance to quickly confirm or reject the topic.

5. Clarification : the salesperson distinguishes a real problem from an apparent need.

6. Short positioning : only now does information appear about what the company actually does.

7. Call to interest : instead of aggressive closing, an invitation to a diagnosis appears.

In practice such a model can sound simple: “Good morning, this is Anna Kowalska from SecurePass. I am calling because we work with companies that employ a few dozen people and have more and more accounts, tools and access rights. Often at such a point passwords are handled somehow, but the company does not always have full control over who has access to what. I wanted to check whether at your company access management is already a described process, or whether it rather works operationally, through the IT person?”.

This one question can open the whole conversation, because it touches the difference between day-to-day handling and a system.

What not to do in cold calling

Do not start with the full name of the service. “We implement password management and cybersecurity systems” is less effective than a description of the problem that service solves. Do not ask about interest right away, because the client often does not yet know whether they should be interested. Do not treat the IT person as a competitor, because when the client says “we have an IT person”, it is not an objection to overcome but information about the current way of handling the problem.

Do not scare. Cybersecurity is easy to sell through fear, but that more often builds resistance than trust. Better is a calm conversation about control, risk and organizational maturity. Do not send a generic offer after the conversation, because if you have already talked to the client, the follow-up should refer to its context.

Cold calling as an element of a B2B sales system

Remember that the phone itself is only one of the communication channels in prospecting and should be treated as such. It is not the holy grail of sales or a universal recipe for filling the funnel. However, in today’s B2B sales of expensive specialist services I find it the most effective channel in terms of effort and time relative to the result. It has to be treated, though, as an element of a larger sales system, understanding whom we are to talk to, for what purpose, and what goal we want to achieve.

What is needed are problem hypotheses matched to different industries, a short email plus phone sequence, a diagnostic conversation, a simple audit of the current way of managing passwords, and only then a recommendation for implementation.

In such a setup the cold call is not a desperate attempt to sell. It is the first test: does the problem exist, does the client recognize it, and is it worth moving on to a diagnosis. That is the healthy role of the phone in B2B sales.

The most important conclusion

Cold calling in B2B sales works when it stops being telemarketing. The point is not to call and tell someone they should buy our solution. The point is to help them see a problem that is often hidden or downplayed in the company’s daily operations.

A good cold call does not persuade and does not push a solution. A good cold call says: in companies similar to yours a specific problem often appears. I do not know whether it concerns you too, but perhaps it is worth checking before it becomes urgent.

And that is why the best cold calls do not sound like sales.

If you are thinking about building similarly resonant communication for your company, book a no-obligation consultation and we will check whether it would make sense for you.