Qualify the job before the account
A promising cybersecurity software lead needs more than a company in the right sector. Confirm the job: alerts lack enough context to decide which investigation deserves attention. Identify analysts triaging authorized security telemetry as the possible user group, then find who can authorize a pilot; the working buyer hypothesis is a security operations lead evaluating a defined coverage gap.
Ask about the current workaround, manual lookup across existing security tools, and what would make changing it worthwhile. Do not assign a budget or procurement timeline from company size, funding, or job title alone.
Use a category-specific qualification rubric
Use the calculator below to organize your judgment after reading the source. Unknown evidence should remain unknown. Its weights are a transparent prioritization convention, not a prediction of purchase probability.
| Dimension | Evidence to seek | Reason to pause |
|---|---|---|
| Problem | Which authorized telemetry fields are needed to make the next triage decision? | The person cannot describe a recent instance of the problem. |
| Product fit | Can you evaluate a small, sanitized alert set in an explicitly authorized environment? | prospects requiring unauthorized scanning, unsupported certifications, or access outside the agreed evaluation |
| Timing | the team adds a new environment without a corresponding triage workflow | The proposed change has no confirmed date or relevance. |
| Implementation | What evaluation environment and approval process are available? | security claims require scoped validation; a demo does not establish protection or compliance |
| Value | an analyst can reproduce one triage decision from source evidence and documented enrichment | The buyer and user disagree on what success looks like. |
Work through an illustrative assessment
Suppose the source says: “Analysts spend more time joining alert context than investigating it. We need to test whether enrichment helps on our own sample alerts.” That supports investigating the problem, but it does not yet settle purchasing authority or technical compatibility. A reviewer should ask the two discovery questions above and preserve the answers beside the source.
Compare that with: A public breach headline treated as permission to probe the affected organization. This weaker example should not receive the same pain or timing score. A relevant public topic is not evidence of a current evaluation.
Even a strong problem signal should be rejected when the need belongs to prospects requiring unauthorized scanning, unsupported certifications, or access outside the agreed evaluation. Qualifying out prevents a misleading promise and preserves time for a prospect the product can help.
Create a reviewable handoff
A qualified opportunity should contain the original evidence, a summary of the job, confirmed and unknown constraints, the buyer/user distinction, and an agreed next step. Keep a score attached to those facts so another teammate can challenge the conclusion.
Propose a pilot only when the critical gap is addressed: security claims require scoped validation; a demo does not establish protection or compliance. Evaluate the pilot through a real observation that an analyst can reproduce one triage decision from source evidence and documented enrichment, and keep that observation separate from the initial qualification score.
About these playbooks and examples
Prepared by DemandBolt with AI assistance as practical planning resources for people building and selling software. The category scenarios and message examples are illustrative, not quotations from real prospects or claims of customer results. Adapt the hypotheses to your product, verify original sources, and review capabilities before making an offer.
The workflow follows our first-customer guide and buying-signal review method. Our PyInvesting and Rae records distinguish actual internal work from targets. Published .