The CISO inbox problem
The average DACH CISO gets 60–80 unsolicited vendor pitches a week. LinkedIn DMs, cold calls, email sequences, conference badge-scan follow-ups. The noise floor has risen 4x since 2020 — the volume is up and the signal per message is down. The pitches that break through in 2026 are narrower, sharper, and more about timing than messaging.
We pulled 24,000 first-touch outreach attempts across fourteen DACH cyber campaigns in 2024 to see what actually connects.
The four hooks that break through
Meeting-book rate by message hook
Of all first-touch outreach across DACH CISO personas, which hooks convert to a scheduled meeting.
Source: Teleroids cyber-vertical aggregates, 2024, n=14 campaigns, 24,000+ outreach attempts.
Peer case study wins by a wide margin. "Here's what [CISO at peer bank] did with us" or "Here's how [peer SaaS] handled their NIS-2 assessment" converts at 8.4% to scheduled meeting. The magic is social proof with a near-exact peer — not a vague "enterprise customers" line. Named peer, named outcome, named role.
Compliance deadline is second-best. NIS-2 audit cycles, DORA readiness reviews, BSIG Kritis Schwelle — these are calendar-driven. A message that lands two months before the deadline with a specific assessment offer ("30-minute NIS-2 gap review") converts at 6.1%. Same message six months out converts at 1.5% — timing is everything.
Incident reference converts 5.7%. A recent public breach in a peer industry is a legitimate conversation-opener: "Given the [named incident], have you done a [specific assessment]?" Don't fear-monger — reference it, offer a specific view, be brief.
Budget cycle is the weakest of the four but still outperforms generic messaging: "We know you close your 2026 security budget in Oct — here's something to consider before." 3.2%.
Generic feature pitches — "We do XDR" — convert at 1.1%, which means one in a hundred. This is not a strategy; it's a lottery.
When CISOs actually pick up
Connect rate by hour of day (DACH CISO cohort)
Local time. Shaded peaks show book windows.
Source: Teleroids cyber-vertical 2024 dial logs, n=14 campaigns.
DACH CISOs have a bimodal dial pattern: 07:30–08:30 (before the 9am stand-up) and 16:30–18:00 (after calendar blocks clear). The rest of the day is calendar-locked.
What almost nothing converts: 10:00–14:00. The CISO is in meetings or at lunch. Dialing that window is mostly voicemail.
The practical implication: if your SDR pod is running 9-to-5 shifts, you're missing 60% of the book-window. DACH cyber campaigns should run 07:00–09:30 and 16:30–18:30 local time. Fewer dials, higher connects.
What happens after the meeting
A meeting booked is not a meeting won. The honest distribution of CISO meeting outcomes 90 days later:
Outcome of booked CISO meetings
Distribution 90 days after meeting held.
Source: Teleroids cyber campaigns 2024, 312 CISO meetings tracked to 90-day outcome.
Nearly a third of meetings advance to POC. A quarter get referred internally — often to a deputy CISO, procurement, or an operations VP. About 29% get parked, typically on budget reasons that weren't visible on the first call. 16% turn out not to be a fit at all.
The 55% combined "advanced" (POC + referred) rate is actually better than most DACH SaaS verticals — cyber buyers make decisions faster because the risk calculus is clearer. But that's only true if you qualified correctly on the first call.
A DACH CISO playbook in five lines
- Lead with a peer case study from the exact same regulatory context.
- Anchor to a compliance deadline if one exists within 90 days.
- Dial 07:30–08:30 or 16:30–18:00 local. Nothing in between.
- Qualify hard on the first call — budget status, decision timeline, evaluation criteria. If parked, that's fine; plan the 90-day follow-up.
- Expect 55% of booked meetings to advance. If your advance rate is below 35%, your qualifier isn't qualifying.
The DSGVO note
DACH CISOs are hyper-aware of the DSGVO angle on outbound. Two tactical practices that matter: (1) in the voicemail and first email, reference berechtigtes Interesse specifically and (2) include an opt-out in the first message. Not because the law requires it on B2B (it doesn't) but because CISOs read that signal and it establishes you as a compliant vendor rather than a random one. Ten seconds of compliance hygiene disproportionately increases book rate.
