Evidence Qualified Lead: why a fact beats an MQL

Every sales team selling security has a pile of leads that looked promising on the dashboard and went nowhere on the phone. Somebody downloaded the NIS2 guide, opened two newsletters, visited the pricing page of a managed firewall. Marketing scored them, flagged them as qualified and passed them over. Your rep called, introduced the offer, and heard a polite "send me something by email". Nothing came back.

The lead was not fake. It was simply empty. It told you that a person had shown interest in a topic, and nothing about the company behind that person: what it runs, what is exposed, what would actually hurt it, and which service in your catalogue would fix it. Your rep had to invent the reason for the call on the spot, and the customer could hear it.

What a marketing qualified lead really measures

A marketing qualified lead measures attention. Clicks, opens, form fills, time on page: all signals that someone, somewhere, has read about security. That is useful for a newsletter. It is a weak start for a security sale, for three reasons.

First, attention is not need. The person who downloaded the guide may be a student, a competitor or an office manager collecting brochures for a board meeting that will never decide.

Second, attention says nothing about the company. Security is sold on the specifics of one organisation: its website, its mail domain, the remote access its suppliers use, the credentials its staff have leaked. A lead score knows none of that.

Third, attention expires. Interest that was real on Tuesday is gone by the time the rep gets to the list, because the customer has moved on or bought from the supplier who called first.

What an Evidence Qualified Lead is

An Evidence Qualified Lead starts from the other end. Before anyone calls, the company has been looked at from the outside, the way an attacker would look at it, using public data only and touching nothing. The website and the technology it runs on, the services exposed on its public IP addresses, how its DNS and email are protected, whether company credentials appear in known data breaches.

What comes out is not a score. It is a fact, with a date: remote desktop reachable on a public address, a domain with no DMARC and no SPF, several staff mailboxes in a breach dump, a website on an outdated CMS with an expired certificate. And every fact is already matched to the product in your catalogue that resolves it: a managed firewall with VPN, email security, awareness training with MFA, managed hosting.

That pairing is the whole point. The finding is not used to defend the customer; that is the job of a security tool. It is used to give your rep a verifiable reason to call and the right thing to propose once the customer agrees the problem is real.

Why the fact wins the opening line

Buyers have heard every generic security pitch. "Cyber attacks are rising" earns a sigh. "Looking at your internet presence, we saw remote access open on your public IP. Is that right?" earns a pause, and usually a question back. The rep is no longer selling a category; they are reporting something about this company, and the customer wants to know more.

The fact also protects the rep. They do not need to understand ports and protocols to say it, because the co-worker hands it over in plain language together with the questions that follow and the answers to the first objections. A junior rep with a real finding is more credible than a senior one with a brochure.

The entry points you look for are not random either. The Verizon 2025 Data Breach Investigations Report found that abused credentials (22%) and exploited vulnerabilities (20%) were the most common initial access vectors in the breaches it analysed. The checks behind an Evidence Qualified Lead go after exactly those doors: leaked credentials and exposed, outdated services.

Where it fits in the sale

An Evidence Qualified Lead is the second of four moves. The first finds the companies worth calling: your ideal customer profile turned into concrete criteria such as size, sector and area, and searched across company databases, for new prospects and for the customers you already serve. The second qualifies each of them with evidence. The third prepares the call, adding what only you know (contracts, active services, tickets) and choosing between the end product and a smaller service that opens the door. The fourth stays with your rep on the call.

Each move feeds the next one. Without the evidence, the preparation has nothing to work on and the call goes back to being a cold pitch.

What changes for your team

Swap the lead score for a fact and three things shift.

Your reps stop spending the first minutes of every call justifying why they are calling. The reason is on the screen, and it is about the customer.

Your catalogue starts selling itself in the right order. A company with leaked credentials hears about awareness and MFA, not about a managed SOC it is not ready for.

And your pipeline becomes honest. A lead either has a finding or it does not. If it does not, nobody wastes a call on it this week; the signals will be read again, and the company comes back when something changes.

None of this replaces marketing. Campaigns still build the brand and fill the top of the funnel. But when the moment comes to pick up the phone, a fact about the customer beats a click every time.