Cybersecurity account scoring works when fit decides which accounts are eligible, timing and risk signals decide which of them come next, and engagement decides how each one is worked, with every signal weighted and decayed according to how quickly it stops being true.
A practical starting split is about 30% fit, 20% timing, 15% technology, 15% risk, 10% intent and 10% engagement, with fit acting as a gate before anything else counts. Treat those weights as hypotheses and recalibrate them against closed-won and closed-lost accounts once you have enough outcomes to learn from.
Security buyers are among the most over-contacted in B2B. A CISO or head of security engineering receives vendor outreach all week, so a list ranked by company size and job title produces the same message to the same people as every competitor. Scoring is how a cybersecurity go-to-market team decides where to spend scarce human attention first, and what to say when it arrives. This guide sets out the six signal families that matter, a worked weighting model, how public sources such as the CISA vulnerability catalogue and the NIST Cybersecurity Framework can feed the model, and the mistakes that make scoring look rigorous without making it accurate.
Why Scoring Beats Sorting
Sorting accounts by firmographics answers one question: could this company buy? Scoring answers a better one: how likely is this company wanting a conversation now, and what is the reason? The difference matters in security because budgets, urgency, and ownership move quickly. A mid-sized financial services company with a new security leader, an upcoming audit and an exposed product in its estate is a different prospect from an identical-looking company with none of those, and a model that cannot tell them apart wastes the best reps on the wrong accounts.
A good score also explains itself. If an account ranks highly, the rep should be able to see the two or three reasons, because those reasons become the opening line of the conversation. A score that returns a number with no reasons trains reps to ignore it.
The Six Signal Families
Six families cover almost everything worth measuring. The table gives example signals and a starting weight for each. Weights add up to 100, and the decay column shows how quickly the signal should fade if nothing reinforces it.
Signal family | Example signals | Starting weight | Typical decay |
Fit | Sector, size, geography, regulatory exposure, security team size, similarity to your best customers | 30 | Slow, review quarterly |
Timing | New security leader, funding or acquisition, audit or regulatory deadline, security hiring spike, contract renewal window | 20 | Fast, weeks to a few months |
Technology | Tools in use, gaps next to your product, end-of-life platforms, integrations you support | 15 | Medium, refresh as data updates |
Risk | Exposure to actively exploited vulnerabilities in products they run, sector breach activity, supply chain pressure | 15 | Fast, tied to the event |
Intent | Third-party research topics, category and review site activity, competitor comparison behaviour | 10 | Fast, days to weeks |
Engagement | Replies, website visits, event attendance, content downloads, multi-stakeholder interactions | 10 | Fast, weeks |
Starting weights are a hypothesis for a typical security vendor, not a benchmark. Your sales cycle and product will shift them.
Fit First, Then Everything Else
Fit should act as a gate and carry the largest single weight. An account that does not resemble your best customers should not reach the top of the list because it opened three emails. The quality of your ICP therefore sets the ceiling for the whole model, and our guide on building a B2B ICP that predicts pipeline rather than just describing it is the place to start.
For a security vendor, useful fit variables include regulatory exposure, the size and maturity of the security function, the presence of the roles that buy your product and the sectors where you win and keep customers.
Fit is also where negative scoring belongs. Subtract points for accounts that recently signed with a direct competitor, accounts in a procurement freeze, accounts too small to run your product and accounts where your champion has left. Negative signals stop the model rewarding accounts that look active but cannot buy.
Timing, Technology and Risk Signals
Timing signals tell you why a conversation could matter this quarter. A new CISO usually reviews the stack and the vendor list within the first months in role. Funding, acquisitions and rapid security hiring suggest budget and growth pressure. An audit or regulatory deadline creates a hard date. Our thinking on targeting cloud security accounts with the right urgency shows how urgency changes what a first message should say.
Technology signals show how your product fits the estate. Which tools sit next to yours, which platforms are ageing and which integrations you offer all change the relevance of your message. In identity, for example, understanding the account’s existing directory and access stack changes the whole opening, which is the argument in our piece on why account context matters more than pitch volume in IAM lead generation.
Risk signals connect an account to something that has happened. The CISA Known Exploited Vulnerabilities catalogue is a public list of vulnerabilities for which CISA has evidence of active exploitation. It was created alongside Binding Operational Directive 22-01 in November 2021, and CISA strongly recommends that private organisations prioritise remediation of listed vulnerabilities as well as federal agencies.
For a vendor selling vulnerability management, attack surface management, patch automation or a replacement for an affected product category, a new entry gives accounts that run the affected product a concrete reason to talk. The signal is only usable where you know, from lawful and legitimate technology data, that an account runs the product. Do not scan or probe prospects to find out, and do not imply you know more about their environment than your data supports.
Intent and Engagement Signals
Intent data shows that someone at the account is researching a topic, and it should be weighted modestly because it is noisy. A research spike from an account that fails the fit gate is a distraction, and a spike from a perfect-fit account that also has a timing trigger is exactly where a call belongs. Treat intent as a tie-breaker and a confirmation, not as the primary driver.
Engagement is first-party evidence, which makes it the most reliable signal and also the most delayed. Replies, repeat visits to pricing or integration pages and several people from one account engaging within a short window all deserve extra weight. Anonymous traffic is more useful once you can connect it to accounts, and our guide to website visitor identification explains how to turn that interest into follow-up that is relevant and compliant.
Using NIST CSF to Structure Relevance
The NIST Cybersecurity Framework is a useful way to map your product to what a buyer is trying to achieve. Version 2.0, released in February 2024, organises cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern was added in 2.0 and puts oversight, risk strategy and accountability at the centre of the framework.
For scoring, tag each product capability with the function it serves, and look for evidence that an account is investing in that function. A detection and response vendor should score higher where an account has lost a security operations analyst or been through an incident. A governance and risk platform should score higher where a new board-level risk reporting requirement has appeared. The framework keeps your messaging in the language security leaders already use, which improves relevance before a rep says a word.
From Score to Action
A score only matters if it changes behaviour. Define tiers and attach different treatments to each. The top tier receives fast, human-led, multi-threaded outreach to several roles with a message that names the triggering reason. A middle tier receives sequenced outreach and monitoring for new signals. A lower tier is nurtured or left alone, and its score is reviewed as signals change.
Decay is what keeps the list honest. A funding announcement from nine months ago is not a timing signal any more, and an intent spike from last week may already be gone. Apply decay rates by signal family, refresh the scores on a regular schedule and retire reasons that are no longer true. Then review outcomes: which tier produced meetings, which meetings became opportunities, and which signals showed up most often in accounts that closed. Adjust weights from that evidence.
Mistakes That Undermine Scoring
The most common mistake is false precision. A score of 87 feels objective, but if the weights were guessed and never tested, it is an opinion with a decimal point. The second is treating intent as proof, when it is a hint. The third is letting the model drift: signals change, products change and markets change, so weights set once and never reviewed go stale.
The fourth is compliance blindness. Scoring that relies on personal data, tracking or inferred behaviour needs a lawful basis and a clear purpose and calling and email in the UK to carry their own rules. Keep the model account-level where you can, document what data feeds it, and make sure outreach respects the relevant regulations.
FAQ
How should cybersecurity accounts be scored?
Score accounts across six families: fit, timing, technology, risk, intent and engagement. Use fit as a gate, weight the families according to your sales cycle and product, apply decay to fast-moving signals, and add negative scoring for accounts that cannot buy. Recalibrate the weights against closed-won and closed-lost outcomes.
Which signals should increase an account’s priority?
The strongest combinations pair a good-fit account with a timing trigger, such as a new security leader, an audit deadline or an acquisition, and a relevant risk or technology signal. Intent and engagement then confirm that the moment is live. A single signal on its own is rarely enough to justify top priority.
How should fit and intent be weighted in cybersecurity outbound?
Give fit the larger weight and treat it as a gate. Intent data is noisy and short-lived, so it works best as a confirmation or tie-breaker among accounts that already fit. A common starting point is roughly three times as much weight on fit as on intent, adjusted once you see which signals appear in your closed deals.
Can CISA’s Known Exploited Vulnerabilities catalogue be used for account scoring?
Yes, as a risk signal, provided you can legitimately identify which accounts run the affected products. It is most useful for vendors whose product addresses exposure, patching or replacement. Use only lawful technology data, avoid scanning prospects and keep messaging factual rather than alarmist.
How often should account scores be refreshed?
Refresh fast-moving signals such as intent, engagement and risk events weekly or more often, and review fit and technology data quarterly. Apply decay so older signals lose weight automatically, and review the whole model against outcomes at least every two quarters.
Turn account signals into conversations
Tell us about your product, your ICP and the signals you already trust. We will show you how a diagnosis-led programme would score, prioritise and work your cybersecurity accounts.