the first hour after a demo request

A demo request is the rarest event in a security funnel. Thousands of people read, a few hundred download, a handful ask to talk. Then, in many companies, the request sits in a shared inbox until someone has time. The buyer who was ready on Tuesday morning is in a meeting with your competitor by Thursday.

what the response-time research shows

The study most people quote is from 2011. James Oldroyd, Kristina McElheran and David Elkington, writing in Harvard Business Review, submitted test inquiries to 2,241 US companies and timed the replies. 37% answered within an hour. 16% took between one and 24 hours. 24% took longer than a day. 23% never answered at all.

How fast 2,241 US companies answered a web inquiry

Within an hour37%

One to 24 hours16%

More than 24 hours24%

Never answered23%

They also analysed records of about 1.25 million leads. Firms that contacted a lead within an hour were nearly seven times more likely to have a meaningful conversation with a decision maker than firms that waited one more hour. Compared with firms that waited 24 hours or longer, the factor was over 60.

and what it does not show

Three limits are worth knowing before you put the number in a slide.

1. It measured qualification, not revenue. The outcome was a conversation with a decision maker. A faster reply that qualifies more leads plausibly produces more deals, but the study does not measure that.
2. It is old and American. 2011, US companies, mostly web inquiries across industries. European security buying in 2026 is a different setting.
3. There is no baseline. “Seven times more likely” without the base rate cannot be turned into pipeline. Seven times a small number can still be small.

You will also see a “21 times” figure attributed to this research. It comes from a separate, earlier industry study and is often quoted further than it goes. Leave it out.

So treat the research as the shape of the problem: interest fades in hours, not weeks. Your own CRM can tell you the rest.

why security requests go cold faster than they should

Inbound requests for security products have a few traits that make delay more expensive.

• They often come from a deadline. An audit finding, a questionnaire from a large customer, a NIS2 or DORA obligation landing on someone’s desk. The buyer needs a credible answer this week.
• The requester is often not the decider. An engineer is asked to “look at options”. If your reply comes after they have written the summary, you are not in it.
• A partner may already be involved. In the channel-heavy markets of Central and Eastern Europe, the same customer may be talking to an integrator who carries your product, or a competitor’s.

a routing setup that works across Europe

Speed comes mostly from routing. Write these rules down once and the hour becomes routine.

1. One owner per request, assigned automatically. By country or language first, then by account. A shared inbox with no owner is a queue that nobody watches.
2. A clear working-hours promise. “Within the hour” during the owner’s working day, next morning for anything after hours. Across European time zones, route by the requester’s country, not by where your team sits.
3. Answer in the buyer’s language when you can. A German or Polish requester who gets a reply in their own language from someone local is more likely to take the call. If you cannot, say so plainly and offer a time.
4. Check the account before the first reply. Is there an open opportunity, a registered partner deal, an existing customer contract? Thirty seconds in the CRM avoids a channel conflict that costs a partner relationship. The guide on deal registration explains why this matters.
5. Make the first reply useful on its own. Two or three proposed times, one question about what triggered the request, and a short note on what the first call covers. No PDF attachments, no generic sequence.
6. Keep the form short. Name, work email, company, country and one optional free-text field. Every extra required field loses requests you will never see.

the next request

Look at the newest unanswered demo request in your system right now. If it is more than an hour old and nobody owns it, the setup above is the fix. Start with rule one.