The Cybersecurity MQL Follow-Up Playbook

An MQL has a half-life, and it is short. The moment someone raises a hand, downloads the asset, requests the demo, hits the scoring threshold, is the moment their interest is at its peak. From there it decays, quickly at first. The first seventy-two hours decide whether that hand-raise becomes a conversation or a cold record in your database.

The argument:

• Speed is the highest-leverage variable you control. Study after study across B2B has found that response time is one of the strongest predictors of whether a lead converts, and the drop-off in the first hour alone is steep. The exact figures vary by source, so treat any specific multiplier as something to verify, but the principle is not in dispute.
• Speed without relevance is just fast noise. Reaching a cybersecurity buyer within the hour with a generic pitch wastes the speed advantage. Fast and relevant is the combination that works.
• Persistence matters as much as speed. Most leads are not reached or converted on the first attempt. A structured sequence of touches over the first days beats a single fast email followed by silence.

If your MQLs are handed off and then sit for a day or two before anyone acts, this is the leak, and it is one of the most expensive and most fixable ones you have.

Two things are happening in the mind of someone who just became an MQL. Their attention is on your topic right now, in a way it will not be tomorrow, and they are almost certainly looking at more than one option. In a considered market like cybersecurity, the buyer who reaches out is often quietly evaluating several vendors at once. The one who responds first, and responds well, shapes the conversation and frames the comparison.

Delay costs you twice. It loses the attention, because the buyer has moved on to the next task in a busy day, and it cedes the framing, because a competitor who called back within the hour is now the reference point. Neither loss shows up cleanly in a report. Both show up in the conversion rate.

Note the caption on that chart deliberately. The shape of the decay is well established across B2B research; the precise values are yours to measure. Do not publish a curve that implies specific numbers you have not verified.

The structure below is a default rhythm, not a rigid script. Adjust the timing to your team and the lead type, but keep the principle: multiple, escalating, useful touches across the first three days, each one adding something rather than just repeating "checking in".

The first hour: the fast, relevant touch. As close to immediate as your process allows. The first touch references what the person actually did, the specific asset, the demo request, the topic, and offers a clear, easy next step. For a high-intent action like a demo request, a phone call within the hour is the strongest possible response, because it is fast, human and hard to ignore. For a softer signal, a prompt, specific message is the right weight. The rule is that the first touch proves a human noticed and understood, not that a sequence fired.

Within 24 hours: the second touch, a different angle. If the first touch did not land, the second comes from a slightly different direction. A call after an email, or an email after a call. Different time of day. It adds a new piece of value, a relevant resource, a specific question about their situation, rather than simply asking again. Reaching a busy cybersecurity professional often takes more than one attempt through more than one channel, so this is expected, not a sign of failure.

Within 48 hours: qualify, do not just chase. By now the job shifts from reaching to qualifying. The touch here tests whether there is a real, live problem behind the original signal. A short, well-prepared conversation that asks about the buyer's actual situation will separate the genuinely in-market from the casually curious far better than continued pitching. Some MQLs are ready for sales now, some need nurturing, some were never really a fit. This is where you find out which.

Within 72 hours: route honestly. By the end of the window, each lead should be routed based on what you have learned. The live opportunities go to sales with the context attached. The interested-but-not-ready go into nurture and stay warm through The Brief and useful content until timing changes. The poor fits are set aside cleanly. The failure mode is leaving everything in an undifferentiated "followed up, no reply" state and quietly giving up.

There is a lazy version of speed-to-lead that fires an instant automated email and calls it fast follow-up. It is fast, and it is usually ignored, because it is obviously automated and says nothing specific. The buyer can tell the difference between a human who noticed and a sequence that triggered.

The resolution is not to slow down. It is to prepare in advance so that fast can also be relevant. If your team knows what the common MQL types are, what each one likely cares about, and what a good first touch for each looks like, they can respond quickly and specifically at the same time. The preparation is what lets speed and relevance coexist. Without it you are choosing between fast-and-generic and slow-and-considered, and both lose.

Fast, persistent, relevant follow-up on every MQL is demanding, and it collides with the reality of a sales team that is also working live deals. When lead volume spikes, from a campaign, an event, a content push, follow-up quality is usually the first thing that quietly slips, precisely when there are the most leads to lose.

This is worth naming honestly rather than assuming heroics will cover it. Consistent seventy-two-hour follow-up at volume is a capacity question, not a motivation question. The realistic answers are to protect dedicated follow-up time so MQLs are not competing with live deals for a rep's attention, to prioritise ruthlessly by intent so the strongest signals always get the fast human touch, or to add dedicated follow-up capacity so speed does not depend on whoever happens to be free. Pretending the capacity is always there is how the leak reopens every busy month.

• Median time to first touch, tracked honestly. Averages hide the slow tail. Watch the median and the worst cases, not the flattering mean.
• First-touch reach rate: the share of MQLs that get a genuine first human touch inside the target window. If this is low, nothing downstream can compensate.
• Attempts per lead: whether your team is actually running a multi-touch sequence or quietly stopping after one. Single-attempt follow-up leaves most of the value on the table.
• MQL-to-qualified-conversation rate, and the honest reasons leads fall out, so marketing learns what a good MQL looks like and the definition improves over time.

Handing off and hoping. An MQL that sits for a day is a colder, cheaper lead than the one you had at hour one.

Confusing an automated email with follow-up. The buyer can tell. Speed only helps if a human is visibly behind it.

Stopping after one attempt. Most leads take several touches across channels. One-and-done throws away the persistence advantage.

Chasing without qualifying. By 48 hours the job is to find the live problem, not to send a fourth "just following up".

Ignoring capacity until the busy month. If follow-up quality collapses every time volume spikes, the fix is capacity, not exhortation.

MQL follow-up is a CONVERT play, and it is often the fastest pipeline win available, because the leads already exist and are simply being underworked. Dedicated, fast, human follow-up across the first seventy-two hours, applied consistently even when volume spikes, is exactly what turns an underworked MQL list into conversations. If your leads are handed off and then wait, closing that gap usually pays back faster than generating more leads on top of a leaky follow-up process.