If you're running a managed detection and response (MDR) firm, you already know the problem: your sales cycle is long, your buyer is hard to reach, and most of your pipeline comes from relationships you built years ago. Cold email feels like it shouldn't work for something as technical and trust-dependent as threat detection and incident response. But it does work - if you do it right.
The mistake most MDR firms make is treating cold email like a product company would. You're not selling software licenses. You're selling expertise and peace of mind to security directors and CISOs who are buried in alerts, understaffed, and terrified of the next breach. That changes everything about how you approach the email itself.
Who You're Actually Targeting (And Why Most Lists Get This Wrong)
This is the first place MDR firms go wrong. They build lists of "security directors" and "CISOs" across their target industry, but they miss the person who actually cares about your service right now.
Your real prospect is someone in one of these situations:
- They just had a security incident (even a small one) and realized their current setup isn't catching things.
- They're managing threat detection with on-prem SIEM tools that require constant tuning and are eating their budget.
- They're a mid-market company that's grown too fast to monitor their own environment properly.
- They have one or two security people trying to manage alerts across multiple cloud environments.
The way you find these people: don't just look for job titles. Look for companies that fit these patterns - companies between $50M-$500M in revenue (usually where MDR starts making sense), companies that recently hired security staff, companies in regulated industries (finance, healthcare, manufacturing), or companies that had a news-reported breach in the last 18 months.
Your list quality matters more than your email quality here. If you're sending emails to companies that don't actually need what you sell, no amount of clever copy will fix it.
The Email Structure That Works
MDR is a consultative sale. You're not pitching - you're starting a conversation about their current environment and whether they're actually covered.
Here's the structure that gets responses:
Subject line: Reference something specific about their environment or a recent industry event. This isn't about being clever - it's about showing you actually looked them up.
Quick question on your alert tuning across [their cloud platform]
or
Saw the [their industry] compliance changes last month - curious how you're handling detection
Opening: Start with what you know about their situation. Not flattery. Actual context about their environment or their industry.
Hey [Name] - I noticed [Company] is managing infrastructure across AWS and on-prem. We work with a lot of [their industry] companies dealing with similar setups, and the detection gap usually surprises people.
Body: Ask a specific question. Not "are you interested in MDR?" But something that makes them think about a real problem.
How much of your security team's time goes into tuning false positives on your current SIEM right now? We usually see it's somewhere between 40-60% for teams your size.
Close: One sentence. Offer a conversation, not a demo. Not "schedule a call" - offer something that has actual value.
Happy to walk through how we'd approach your environment differently - would take 15 minutes and you might find something useful regardless.
The entire email is 5-7 sentences. That's it. Anything longer and security leaders won't finish it.
The Numbers That Matter
For MDR specifically, expect different benchmarks than other B2B services:
- Response rate: 3-6% is solid for cold outreach to security leadership. (This is lower than other industries because the audience is smaller and more guarded.)
- Meeting rate from responders: 40-50% of people who reply will actually take a meeting. MDR buyers don't respond unless they're somewhat interested.
- Sales cycle: 60-90 days from first contact to signed agreement is normal. Budget approval and RFP processes slow things down.
- Volume needed: Plan to send 200-400 emails per month to book 2-3 discovery calls. You're looking for quality prospects, not scale.
If you're seeing lower than 2% response rate, your list is wrong or your subject lines aren't getting opens. Fix the list first.
What You're Actually Selling in the Email
Don't mention your platform features. Don't talk about your detection rules or your incident response playbooks. Your prospect doesn't care yet.
What you're selling is:
- The idea that their current approach might have blind spots.
- A conversation with someone who understands their specific environment (cloud, on-prem, hybrid, etc.).
- Permission to ask them questions about how they're currently handling detection.
The email works because it's honest about this. You're not overselling. You're not promising they'll "eliminate 90% of false positives" or some made-up stat. You're saying "let's talk about your actual situation."
The Sequence Matters
Send the first email. Wait 5-6 days. If no response, send a second. The second email should reference the first one directly and add new information (not just resend the same message).
Quick follow-up - I realized I didn't mention we've been working with [similar company in their industry] on consolidating their SIEM and detection stack. Might be relevant context for you. Anyway, happy to jump on a quick call if you want to compare approaches.
Send a third email 5-6 days later only if you have a genuine new angle or a specific reason to reach out again. Otherwise, you're just noise.
Most MDR firms get stuck with one-off emails and wonder why they're not booking meetings. The follow-up sequence is where the conversion actually happens.
Why Most MDR Firms Give Up Too Early
Cold email for MDR takes longer to warm up than most B2B services. Your buyer is risk-averse. They need to see you have domain expertise before they'll trust you with their security architecture. That takes 3-4 touchpoints minimum.
The other reason firms give up: they're not tracking responses properly. Reply detection can fail if you're using free email tools or if you're not checking spam folders regularly. If you're not seeing responses, you might not actually be missing them - you might just not be catching them. Set up proper forwarding and monitoring before you judge whether the approach works.
When to Bring in Help
This framework works. You can build it yourself - the list building, the email sequences, the follow-up tracking. But there's a real difference between understanding how cold email should work for MDR and actually running it at the volume where you're consistently booking 2-3 discovery calls per week without it consuming all your time.
If you've built lists, written sequences, and sent emails but you're not getting the response rates outlined here - or you're getting responses but your team is drowning in reply management and follow-ups - that's the gap cold email gets tricky. Building the infrastructure to send at scale, monitor replies accurately, and execute sequences consistently across dozens of prospects takes real setup work.