Cold Call Teardown: 68 Seconds With a SOC Lead Who Was Already Annoyed

The recording

A rep sent me a call he thought went okay. Sixty-eight seconds, ended with "send me something," and he logged it in the CRM as a positive outcome. It was not a positive outcome. It was a call that died in the first minute and then took another thirty-eight seconds to stop moving.

I want to walk through it the way I'd walk through it on a coaching call, with timestamps, because the interesting part is not that he lost the call. It's exactly when he lost it. There is a specific second where the buyer stopped being a person who might listen and became a person managing his way off the phone. Once you can hear that moment, you can hear it on your own calls, and that is worth more than any script I could hand you.

The buyer is a security operations lead at a mid-size company. Names changed, obviously. He gets pitched constantly — every security vendor on earth wants the SOC, and they all want it this quarter. He was not hostile when he picked up. He was tired. There's a difference, and reps who can't tell them apart burn a lot of good prospects.

The call

0:00 — Rep: "Marcus? Hi. It's Dan. I'll be straight with you, this is a cold call. You can hang up on me or give me thirty seconds."

0:07 — Buyer: "...Go."

This is a good opener. Genuinely good. He named it as a cold call before the buyer had to figure it out, he gave the buyer an out, and he asked for a specific, small amount of time. The "..." before "Go" matters — that pause is the buyer deciding. He decided in the rep's favor. Dan had earned about thirty seconds of real attention, which on an outbound call into a security leader is a small miracle.

He then spent it like this.

0:09 — Rep: "Appreciate it. So, we help security operations teams get end-to-end visibility across their hybrid environment and reduce alert fatigue with AI-driven correlation, so your analysts can spend their time on real threats instead of noise."

Fifteen seconds. One sentence. Let me pull it apart.

"End-to-end visibility." "Hybrid environment." "AI-driven correlation." "Alert fatigue." Four phrases, and every single one of them appears in the marketing copy of every competitor Dan has. If you played that sentence to Marcus with the vendor name bleeped out, he could not tell you who called. That is the whole problem in one line. The sentence contains no information. It is a sound that vendors make.

There's a second problem, and it's subtler. The sentence is trying to do four jobs at once — visibility, environment, correlation, analyst time. When you cram four value props into one breath, the listener doesn't pick the best one. They discard all of them, because none of them was concrete enough to catch on anything.

0:24 — Buyer: "Okay."

Flat "okay." Not "okay, tell me more." Not "okay, we've looked at that." A flat okay is a scoreboard. It means: you have said nothing, I am waiting to see if you will say something.

Dan heard it as encouragement.

0:26 — Rep: "So — how are you handling alert triage today?"

And there it is. The call is now over. Marcus just doesn't know it for another five seconds.

0:31 — Buyer: [sigh] "How am I handling alert triage today."

What the sigh actually meant

When I play this recording for reps, most of them read the sigh as impatience. It isn't. Impatience sounds sharper and comes with a faster tempo. This sigh is slow, and he repeats the question back flat, which is a tell.

The sigh means: I have answered this exact question for four other vendors this month and none of those conversations went anywhere.

Think about what Dan asked him to do. "How are you handling alert triage today" is a request for the buyer to spend two or three minutes of unpaid labor explaining his own operation to a stranger who has, so far, demonstrated no knowledge of it. The buyer has to do the work of describing his tooling, his shift structure, his escalation path — and then the reward for that work is a pitch. He's done it before. He knows how it ends.

A discovery question is a withdrawal. You can only make it if you have made a deposit first. Dan's deposit was a sentence made of buzzwords, which is to say he deposited nothing and then tried to withdraw three minutes. The account was empty at 0:26.

This is the part that generalizes past security, so pay attention if you sell something else. Early-call discovery questions are not free. Every one of them costs the buyer effort and costs you credibility if you haven't earned it. Save the real diagnostic work for the meeting, where the buyer has agreed to do it — that's what the 25-minute discovery structure is for. On a cold call, you are not diagnosing. You are demonstrating that you already know something.

The rest of the wreck

0:34 — Buyer: "Look, what is it you actually do that's different? Because I had this exact call on Tuesday."

Here's the thing people miss: this is not a rejection. This is a rope. Marcus has told Dan precisely what he needs — a differentiator, said plainly — and has even told him the competitive context. If Dan says one specific, unflattering, true thing here, the call continues.

0:40 — Rep: "Sure, sure — so what makes us different is we're not just another SIEM, we sit on top of your existing stack—"

"We're not just another SIEM" is a sentence that only another SIEM says. "We sit on top of your existing stack" describes a category, not a difference. Marcus asked a direct question and got positioning language back. The rope goes slack.

0:48 — Buyer: "Send me something."

0:50 — Rep: "Absolutely, and would you have twenty minutes next week to—"

0:54 — Buyer: "Send me the deck. Dan, I've got a bridge open."

0:58 — Rep: "No problem, I'll send it over — what's the best email?"

1:05 — Buyer: "It's on the website." Click.

"Send me something" is not interest. It is the politest available exit. And "it's on the website" instead of an email address is the buyer telling you, as clearly as manners allow, that he does not want to receive the thing he just asked you to send. Dan logged this as a positive outcome because a request for information feels like progress. It isn't. If a buyer wants your material, he gives you an email address, usually before you ask.

The one sentence that could have bought another minute

At 0:34, when Marcus asked what's actually different, Dan needed one sentence. Not a differentiator in the marketing sense. An observation. Something like:

"Honestly? Probably nothing you'd care about on a phone call. What I do know is that most SOC leads I talk to have a tier-one queue where the alerts that get closed fastest are the ones that are easiest to close, not the ones that matter most. If that's not true for you, I'll leave you alone."

That sentence does three things at once. It refuses to make a claim the buyer would discount anyway. It says something specific and slightly uncomfortable about how the work actually gets done. And it hands the buyer a clean way to end the call, which paradoxically makes him less likely to take it.

The reason it works is that it proves knowledge instead of asserting value. Marcus doesn't need to be told that alert noise is a problem. He needs evidence that the person calling him has seen the inside of a SOC. One sharp observation about the behavior of an operation — not its tooling — does more than any capability statement.

The rewrite

Same rep, same buyer, same first seven seconds, because those were fine. Here's how I'd run the rest.

0:00 — Rep: "Marcus? Dan here. This is a cold call — thirty seconds, then you decide."

0:07 — Buyer: "Go."

0:08 — Rep: "Most of the SOC leads I talk to describe the same ugly thing, and I want to know if it's true for you. The tier-one queue gets worked by whoever has the lightest shift that day. The tickets that get closed are the ones that close easily. And the ones that look genuinely bad sit in 'in progress' for a week, because nobody wants to own the escalation and the person who opened it is off rotation by Thursday. Is that unfair to your team, or is it a little bit true?"

0:29 — Buyer: "...It's a little bit true."

0:32 — Rep: "That's the only thing I called about. I'm not going to pitch you on the phone — you've heard enough pitches this month. I want twenty-five minutes, and here's the reason for the twenty-five: I want to take three alerts from last month and walk the path they actually took. Who touched them, where they stalled, who closed them. If it turns out your process is clean, I'll tell you that and you'll never hear from me again. Thursday afternoon or Friday morning?"

Count what's in there and what isn't.

No product name in the first thirty seconds. Not one. The company doesn't come up until the meeting is booked or the buyer asks, and if he asks, that's a buying signal, not an interruption.

The observation is unflattering. "Whoever has the lightest shift" and "nobody wants to own the escalation" are not compliments. That's deliberate. Flattering observations sound like marketing. Unflattering ones sound like someone who has been in the room. And the question at the end — "is that unfair to your team, or is it a little bit true?" — gives Marcus a dignified way to disagree, which is exactly why he doesn't.

The ask has a reason attached. Not "twenty-five minutes to show you our platform." Twenty-five minutes to walk three alerts through the queue. The buyer can picture the meeting. He knows what he'll be doing in it, and he knows he'll get something out of it whether or not he buys. The odd number helps too — twenty-five instead of thirty signals that you've thought about the length rather than defaulting to a calendar block. I've written the full version of this open, with the objection branches, in the cybersecurity cold call playbook.

And there's a walk-away built in. "If your process is clean, I'll tell you that and you'll never hear from me again." Most reps are terrified of that line. It is the single highest-leverage sentence in the script, because it converts you from someone extracting a meeting into someone offering a diagnosis. It also means you have to be willing to actually walk away, which is a good discipline.

Why this isn't a security post

Every failure mode in Dan's call shows up in every industry I've sold into. Strip the vocabulary out and here's what's left.

The first is the compound value proposition — four benefits in one sentence, delivered at speed, none of them specific enough to stick. Swap "AI-driven correlation" for whatever the equivalent phrase is in your market and you'll recognise it immediately. I hear the identical structure on calls into network operations, where the words are "unified orchestration" and "carrier-grade resiliency" and the effect on the buyer is exactly the same, which is why the telecom opener is built on the same bones as the security one.

The second is the withdrawal-before-deposit discovery question. "How are you handling X today" is a fine question in a meeting the buyer agreed to. It is a demand for free labor on a call he didn't. The fix is not to ask better questions early. The fix is to say something true and specific first, and let the buyer volunteer.

The third is treating an information request as a win. "Send me something" ends more cold calls than "no thanks" does, and it feels much better, which is why reps chase it. If you take nothing else from this teardown: a content request without a volunteered email address is a hang-up wearing a coat.

The fourth is the reasonless ask. "Do you have twenty minutes next week" gives the buyer nothing to evaluate except whether he likes you, and he doesn't know you yet. Attach a reason and a deliverable and the same ask converts far better, in my experience, than any amount of tonality work on the same empty request. This holds even when you're warm — a referral gets you the pickup, not the meeting, and you still have to say why the twenty-five minutes is worth it, which is the part reps skip when they think a peer referral does the closing for them.

What I'd do next

If I were Dan, I would not go read another script. He had a good script. What he didn't have was the reflex to hear a flat "okay" at 0:24 and change course, and reflexes only come from reps. That's the specific thing we built DrillCall for — running the same opener into a buyer who sighs at you, over and over, until you stop hearing the sigh as a mood and start hearing it as feedback. Take the rewritten open above, run it twenty times against a SOC persona who's already been pitched this week, and pay attention to what you do at the moment they push back. That's the muscle.

One last thing. Go pull your own recording — the shortest call you logged as positive last week. Find the second where the buyer's tone flattened. It's almost always earlier than you think, and it's almost always right after you said something that could have come out of any vendor's mouth.