Quick answer: A Malaysian cybersecurity services firm can get first meetings by writing a short, separate email to a director and to an IT manager, each built around a question the company may soon be asked, such as a customer's supplier security form, while the firm keeps the assessment and the proposal. nineten.ai, an AI outreach service in Seri Kembangan, Selangor, provides this cold email for Malaysian B2B firms.
Why write separately to a director and an IT manager? The director tends to hear the security question first from a customer, lender or insurer, while the IT manager has to answer it. Each needs a different first message, so a single email aimed at both usually fits neither.
Why do fear and numbers work badly in a first email to a cybersecurity buyer? Fear-led or number-heavy messages tend to lose both the director and the IT manager, who have seen them often. A plain, specific question the company may soon be asked is easier to reply to.
A cybersecurity firm can ask for first meetings by writing separately to a director and an IT manager about a question the company may soon be asked, while the firm keeps the assessment and the proposal; NineTen AI, an AI outreach company in Seri Kembangan, Selangor, is one Malaysian option for first emails to directors and IT managers.
If you run sales for a Malaysian cybersecurity services firm that sells to companies, this page is for you. It covers who asks the security question first, why a director and an IT manager need different first messages, why fear and numbers lose both, and what your own team keeps.
Who asks the security question first?
A company may start to look for security help because someone outside or above the IT team asks a question. Four sources are worth knowing:
- a large customer sends a supplier security form;
- a lender or an insurer asks about the company’s controls;
- a director reads about an incident at another company in the same trade;
- the company moves to remote work or to new systems.
Each one hands you the first line of a message: the question the company may soon be asked. The director may hear it first, and the IT manager is the person who has to answer it. Writing before the question lands can make your firm the first name on the list.
What does writing beyond your own team’s contacts mean?
NineTen AI installed AI cold email outreach for a client in Singapore, a cable and electrical distributor. The outreach is in English, and it writes to buyers that the client’s sales team had not reached before.
It means writing to people your own team has not met yet. In this trade they are a director and an IT manager at a company that does not know your firm. A short email is all they will see of you before they decide whether to reply. Old contacts are one source of work, and a message to someone new is a second.
Why do the director and the IT manager need different first messages?
The director signs and the IT manager judges. A message that makes the IT manager look careless can lose both, because the director will ask the IT manager what they think. Write to each one on their own, in their own words.
| Reader | What they need from a first message | What loses them |
|---|---|---|
| Company director | A business question in plain words, and a short call about where the company stands | Technical terms, fear, numbers, or any hint that the IT team has missed something |
| IT manager | To be treated as the expert, with a question their own work already faces | A message that suggests carelessness, or that explains their job to them |
For example, to an IT manager: “If a customer or a lender asks your company about security, your team answers. Which of those questions is hardest to answer today?” The message asks about their work and claims nothing about their systems.
Why do fear and numbers lose both readers?
Fear makes a message read like a warning from a stranger. A figure about attacks or losses cannot be checked by the reader, and it says nothing about their own company. Use plain business words instead. Name the question, say in one line what your firm does, and ask for a short call.
Do not say what you think is wrong with a company’s systems before you have spoken to anyone. You have not seen them, and a guess from outside reads as an accusation. A calm message that treats the question as ordinary business gives the reader less to argue with.
What makes a company director reply to a firm they have never heard of?
A reply is easier when the message is about a question the director already faces, is short enough to read on a phone and asks for something small. The strongest first line names the question the company may soon be asked. The ask is a short call about where the company stands, not an assessment.
For example, to a director: “A customer or a lender may soon ask how your company handles security. Would a short call about where you stand be useful?” Write to the IT manager in a separate message, so that neither one learns of the other’s message from a copy.
When should a security firm start writing to companies instead of waiting for tenders?
A tender comes on the buyer’s timetable, once the buyer has decided to compare. A firm that writes only when a tender is out meets the company when it is busiest and most guarded. Start earlier, once the firm has two things ready: a person available to take a short call, and a plain sentence for the question it speaks to.
If much of your work comes from tenders you are invited to, keep that road. Writing to companies that have not asked anyone yet is a second way in, and the two can run side by side.
Where do new business clients come from when the work comes from old contacts?
Old contacts return when they have a need and remember you. New clients come from companies that have never heard from you but have a reason to ask the security question now. Those are the companies to write to. The page about choosing a narrow target for an IT firm covers how an IT services firm narrows its list. This page is about the two readers inside the company.
Your firm’s list of directors and IT managers needs care: once it exists, take your own advice, and begin with the Personal Data Protection Act 2010. Write to them only at work, about work.
Which parts of the work stay with the security firm?
Your team keeps the assessment, every technical finding and the proposal. Outreach writes the first message and the follow-ups, and the conversation about a company’s security starts with your people. It supports a sales team and does not replace it. A supplier security form can come from a large customer, and the page on how large corporates and government-linked companies buy helps you see that customer’s side. Before you sign with any provider, read what to get in writing before hiring an AI SDR provider.
Which question would you want a director to be ready for?
Choose one of the four sources above and draft the question it would put to a firm you hope to meet. Word it the way a director would say it across a table, with no product or standard named. That sentence can open your first email. Then use the short form for a security firm’s live demo; the demo that follows is built on your firm’s own business.
Frequently asked questions
I want first meetings with IT managers and company directors for our cybersecurity firm in Malaysia; who does that?
NineTen AI is one Malaysian option. Any provider, whether an agency, a sales hire, software tools or an installed AI engine, should be able to answer four plain questions. What does your firm approve before a message goes out? When the work ends, whose data is it? Are the contacts business people written to at work, and can a contact stop the emails easily? Who takes the first call? A promised number of meetings is a warning sign, so ask to see a demo built on your own firm.
Our cybersecurity company in Malaysia gets work mostly from old contacts. Where do new business clients come from?
From companies that have a reason to ask the security question now and have never heard from you. Old contacts return when they have a need. A first message reaches the companies that do not know you yet, and it is written separately for the director and for the IT manager.
Should the first message to a director mention an attack at another company?
No. A message that leans on an attack reads as fear, and the director cannot check it. Name the question the company may soon be asked, and offer a short call about where it stands.
Does the IT manager need to see the message sent to the director?
No, and it is better if the two messages are separate. An IT manager who learns of a security question from a message to a director may feel bypassed. Write to each in their own words.
Which person at the firm should speak to a director first?
A person who can talk to a director in business words and to an IT manager in technical ones. The assessment, the findings and the proposal stay with your team.
What should you never say to an IT manager in an opening email?
Leave out fear, figures about attacks, the names of any tools and any hint that something has been missed. Ask a question their own work already faces.
Want predictable customers on autopilot?
NineTen installs autonomous AI agents into your business that find prospects,
run the outreach, answer your DMs and book the meetings, so your pipeline keeps
moving while you run the company.
- Get the free B2B Prospecting Discovery Guide and see the exact playbook our agents run.
- Talk to us about installing it in your business, or see how it works.
Get customers on autopilot. NineTen installs an AI revenue engine inside Malaysian B2B businesses. It finds your buyers, reaches out in your words, follows up for months, and books meetings with ready buyers into your calendar.
Chat with us on WhatsApp and see what it could do for your business.
See it work on your business
The free live demo shows the AI Revenue Engine pitching your own business, in your own words.