Cybersecurity / MDR United Kingdom + Nordics 55 employees · Profitable / bootstrapped

9 SQLs per month for a managed detection & response (MDR) provider

Selling cybersecurity into mid-market CTOs and CISOs without sounding like every other vendor in their inbox.

9SQLs / month (months 2–6)

A 55-person UK-based MDR provider wanted to break out of channel-only growth and build a direct outbound motion into mid-market CTOs and CISOs across the UK and Nordics. LinkedIn was the only channel they trusted not to damage brand. We ran the full motion and delivered a steady 9 SQLs per month with a 22% close rate.

THE CHALLENGE

What we walked into

Cybersecurity is the single most saturated B2B inbox category — CISOs receive 30+ vendor pitches per week.
Brand sensitivity: any 'spammy' outreach risked damage with future channel partners.
Buyer pool is small and finite (~2,400 ICP accounts in target geo) — burn rate of accounts mattered.
Founders had no time to post or run outreach personally.

THE ICP

Exactly who we targeted

Job titles

CISOHead of SecurityCTO (no CISO)IT Director (mid-market)Head of IT Operations

Industries

Financial services (mid-market)Professional servicesManufacturingHealthcare (private)Legal

Geographies

United KingdomIrelandSwedenNorwayDenmarkFinland

Company size

200–2,000 employees, £20M–£500M revenue

THE APPROACH

How we ran the motion

Anti-pitch positioning

We led the founder's profile and outbound copy with one promise: 'No pitch, ever, on a first message.' This was reinforced in posts and in DMs. CISOs notice — reply rate jumped after we made this explicit.

Industry benchmark report as opener

We produced a quarterly 'UK mid-market dwell-time benchmark' (real data from the client's SOC). First DM offered the report — no call ask. 18% of recipients requested it. Of those, 31% took a call within 30 days.

Account burn-rate discipline

Because the ICP was small (~2,400 accounts), we capped re-touch frequency at 1 sequence per account per 6 months. We treated the list as a finite resource, not a volume play.

CTO + CISO multi-thread

In accounts without a CISO, we approached the CTO and IT Director in parallel — different angles, same week. Tracked which persona converted faster per vertical.

Founder thought-leadership posts

Two ghostwritten posts/week from the founder — incident teardowns (anonymised), POVs on the MDR vs SIEM debate. 4 of the SQLs in month 5 came directly from post engagers.

TRIGGER SIGNALS

What we waited for before reaching out

Every account had to fire at least one of these signals in the last 90 days before it entered the sequence. Trigger-based timing is the single biggest driver of reply rate.

Public security incident or data breach disclosure (sector peer)

ICO register + news monitoring

Industry-wide review of MDR / SOC posture

New CISO / Head of Security hire

LinkedIn job-change alerts

First 90 days = vendor review

Cyber Essentials Plus / ISO 27001 audit cycle

Public certification registers

Audit findings drive MDR purchase

Hiring 2+ SOC analyst roles

LinkedIn Jobs

Headcount strain — outsourced detection wins

Engagement with MDR / SIEM thought-leadership posts

LinkedIn engager scrape

Self-identified evaluators

THE FUNNEL

Numbers at each step of the motion

Monthly steady-state. Numbers rounded; conversion rates measured over 6+ months.

Target accounts (UK + Nordics)

Mid-market, 200–2,000 emp

2,400

Buyer contacts identified

3,900

Connection requests sent / month

2 profiles · 60/wk (intentionally low)

480

Connections accepted

163 (34%)

Benchmark report requested

29 (18% of first DMs)

Positive replies

Calls booked / month

Sales-qualified (SQL)

22% closed-won rate

CAMPAIGN MECHANICS

What the engine looked like

Profiles running outbound

2 (Founder + Head of Growth)

Connection requests / week / profile

60 (intentionally low)

Active sequence steps

1 connect + 2 follow-ups + report drop

Personalization level

Account-level + named recent incident (anonymised)

Tools

Sales Navigator, HeyReach, Clay, HubSpot CRM

TIMELINE

From kickoff to steady state

Week 1–2

ICP rebuild, benchmark report scoped, account list (2,400)

Week 3

Profile + copy + sequence build. Report design + data pull.

Week 4

Launch — report-first opener. First 7 SQLs in 3 weeks.

Week 5–24

Steady 9 SQLs/month. Quarterly report refresh.

Engagement length: Ongoing — 10 months at time of writing

THE RESULTS

Numbers that held month after month

SQLs booked

in 6 months

SQLs / month

months 2–6 average

18%

Benchmark report requests

from first message

22%

Close rate

on SQLs (industry-leading)

£480K

ARR closed

first 6 months

Closed-won customers

from 51 SQLs

"We've worked with three outbound agencies over five years. The other two damaged our brand. This one made us look credible — to the point that CISOs were asking us how we built the report."

Founder

MDR / Cybersecurity · 55 employees · London