SME security objections: answer with their own data

Ask anyone who works your SME base how often they hear "we're too small, nobody's coming after us." They won't need a second to answer: most weeks, usually inside the first two minutes, before the proposal has even reached the table. Then the call drifts toward "send me something by email", and nobody ever opens that email.

The line isn't a no, though. It's a badly worded request for proof, and a rep who answers it with a market slide has already lost.

Stock slides lose to what the customer has actually seen

Industry statistics have one flaw. They're about somebody else. You say small companies get hit, the owner pictures the workshop across the yard that's been trading for twenty years without ever seeing a ransom note, and your percentage turns into background noise. They aren't arguing that the risk is fake, they're arguing that it isn't theirs.

Turning that around is simple to describe and hard to do unaided: stop talking about the market and talk about their domain. One fact about them, with a date attached, changes the register of the call in a single sentence. That's what the lead generation co-worker is for, keeping the signal picture current on every SME in the base so the rep opens with something true rather than something believed.

Objections don't show up at random, either. They land at a fairly predictable moment, which is why the sales co-worker's brief treats them as a phase of their own: Prepare for what's true about the account, Discovery for the questions that qualify, Objections with answers already tied to that customer's data, Close with the right service out of your catalogue.

"We're too small" and "nothing has ever happened to us"

One objection in two outfits, one about size and one about history. Both assume an attack is a decision, that somebody sits down and picks that particular company. Most of what reaches SMEs picks nobody at all; it looks for open doors and walks through the ones it finds.

Suppose the scan on that customer's domain turns up a management panel reachable from the public internet, flagged on a specific day. You don't need to explain the vulnerability. You need to say that the door is visible to anyone looking from outside, that nobody opened it deliberately, and then ask who's keeping an eye on it. "Nothing has ever happened to us" stops being a verdict on the past and becomes a question about next quarter, which is a conversation you can actually have.

"We've got antivirus" and "our IT guy handles it"

The classic mistake is to argue with the answer. Tell the owner antivirus isn't enough and you've told them they wasted money; cast doubt on their technician and you've cast doubt on somebody they trust a great deal more than they trust you. Both routes shut the door at roughly the same speed.

What works is showing the part neither of them covers, which is usually uncovered not through negligence but because nobody ever looks at the company from the outside:

• an SPF record that's missing or written far too loosely, meaning anyone can send mail in the domain's name, and the antivirus on the laptop has nothing to do with it
• credentials from a company mailbox surfacing in a public data breach, quite possibly from a service the business stopped using years ago
• a forgotten subdomain still serving software two major versions behind
• remote access to mail or to the management system behind one password and nothing else, no second factor, which is exactly what those leaked credentials are waiting for
• a security questionnaire nobody ever filled in, which isn't a technical risk at all but tells you how ready that company is the day one of its own customers sends one over

The IT supplier deserves an extra thought. Often that supplier isn't a technical obstacle, they're your competitor: the SME buys connectivity from you and security from them, and the advisor seat goes to whoever turns up holding evidence. You don't have to go around anyone to take it back. You have to get there first with something real.

"How much is it" means the value hasn't landed

When price comes up three minutes in, that's not a budget objection. It's the customer telling you they haven't understood what the spend fixes, and looking for the quickest exit from the call. Answering with a discount makes it worse, because it confirms you were selling a commodity.

The answer is to tie every finding to the service in your own price list that closes it, and to say plainly what changes once it's closed. On part of the base there's regulatory pressure you don't have to manufacture: NIS2 has applied in Italy since 16 October 2024 under legislative decree 138/2024, with ACN as the competent authority, and plenty of companies outside the scope still feel it arrive through a customer who is inside it and who forwards the questionnaire down the supply chain. That pressure is already there. No need to inflate it.

Where there's no data, the co-worker says so

This is the part that surprises people the first time they see the product. If a signal is missing on an account, or stale, the brief doesn't paper over the gap with an estimate. It says there's no data here, and turns the gap into a discovery question. The sales framework governs how the co-worker speaks, never what's true, and this is exactly where that line sits.

It reads like a limitation and it's actually the condition for putting a non-technical rep on the call. An invented figure survives right up until the customer forwards the question to their IT supplier; after that you haven't just lost the deal, you've lost the credibility of every call that rep makes for the next six months. A line reading "no number here, go and ask" beats a percentage dropped in to make a slide look full.

An objection, once you're holding a fact about that specific customer, stops being the moment the call dies and becomes the moment it gets specific. You're not there to convince anybody. You're there to show them one thing that's about them, with a date on it, and ask who's watching it.