The presales bottleneck in cybersecurity sales

Your rep has known these customers for years. They know when the contract renews, who actually signs, and that at the twenty-person manufacturer down the road the whole business runs on one server nobody wants to touch. Then the owner asks whether the ransomware stories on the news apply to a company that size, and your rep says what they always say: let me get an engineer to call you back. The deal stops being theirs right there.

That's not laziness, and it isn't a training gap either. On security your rep is holding nothing specific about that customer: no fact, no date, nothing to say once the second question arrives. So they hand it off, and the hand-off goes into a queue.

You already have the products, and the trust

When security sales stall, two explanations show up first, and both are usually wrong. One says the catalogue is missing the right service. The other says SMEs won't take you seriously on security because you're the connectivity company.

Check your own price list before you believe either. Endpoint, backup, mail protection, assessments, awareness training: most of it is already there, often bundled with a vendor who pays you margin. The trust is there too, because when the network dies at nine in the morning the owner calls you, not somebody they found online. What's missing sits between those two things, and it has a distinctly unglamorous name: presales.

Every deal waits on the same calendar

Count the people in your organisation who can look at an SME's domain and say, within ten minutes, what's exposed, how much it matters, and which service closes it. Usually that's one person. Two if you're lucky, and one of the two is stuck on a delivery project that slipped again.

That person is the bottleneck, and not because they're slow. Their calendar is the only multiplier you've got. The rep sends the request on Tuesday, it gets looked at the following Monday, the proposal goes out midway through the week after that. By then the customer has talked to their IT supplier, the one who set up the laptops and drops by every few weeks, and bought the security there. Not because it was cheaper. Because it arrived first with an answer.

The number nobody puts on the sales dashboard

Sales meetings track pipeline, win rate, average contract value. For security the number that decides everything is a different one, and almost nobody measures it: how many conversations you can prepare in a week.

Prepared doesn't mean the rep skimmed a datasheet. It means they walk into the call holding:

• a checkable, dated fact about that specific customer, say a remote administration service reachable from the open internet, or two staff mailboxes sitting in a data breach dump;
• the questions that establish whether the fact actually matters, and to whom;
• the objection they'll hear ("our IT guy handles that") with an answer built on that customer's own data instead of a generic slide;
• the service from your catalogue that closes the gap, at your price, inside a document carrying your brand that stays on the customer's desk.

If each of those costs two hours of your one expert, then your security sales capacity equals that expert's calendar divided by two hours. You can hire more sales engineers, and eventually you will. Meanwhile the market moves faster than your recruiting pipeline, and NIS2 isn't waiting for you to finish the interviews.

Getting preparation out of one person's diary

A security tool and a co-worker part ways right here. The tool hands back a technical report: gold for an engineer, unreadable for a rep and for the SME owner across the table. The co-worker prepares the conversation instead.

The lead generation co-worker keeps an up-to-date risk picture on every SME in your base. It reads the signals (exposed assets, credentials surfacing in a breach, completed questionnaires, posture, compliance coverage) and tells your team who to call and why, with a date attached to the reason. The sales co-worker takes that fact and turns it into a four-phase brief (Prepare, Discovery, Objections, Close): what to know going in, what to ask, how to answer pushback using that customer's own numbers, what to put on the table at the end.

Two things it won't do, and they're worth stating. It doesn't invent: where there's no data, it says so, so nobody walks into a meeting with a figure that collapses under the first follow-up question. And it doesn't sell instead of your rep. The relationship stays with the person who already owns it; the co-worker just removes the part that currently blocks it.

How it lands in the business matters too

The way this reaches your sales floor affects the result as much as the content does. The platform sits on top of the systems you already run, with nothing to integrate, and it speaks in your name: your rep sees your logo, the customer gets a report with your logo, the services proposed come from your catalogue at your prices. Going from agreement to a live portfolio is a short path, and most of that time depends on how quickly you decide which services to put in the window and which customer group to start with.

The rest is the boring necessary work: pick the first batch of SMEs worth touching, give the reps a concrete reason to ring each one, then watch how many of those calls turn into a second meeting.

So if security revenue in your SME base is flat, before you rebuild the price list or launch another campaign, measure one thing: how many conversations your sales force can genuinely prepare, and how many people that number depends on. The bottleneck is sitting right there, and it was never the product.