Wrong.
Unless you're working in an enterprise role at a large company and you know a ton of CISOs, or you're a re broker, you're going to be doing a lot of cold calling
Unless you're working in an enterprise role at a large company and you know a ton of CISOs, or you're a re broker, you're going to be doing a lot of cold calling