This November will mark the 10th anniversary of the cyberattack against Sony Pictures. A watershed moment for the cybersecurity industry, it put a spotlight on the risk posed by nation-state attacks and the negative fallout impacting the company’s finances, brand reputation and employees. In 2024, the cybersecurity stakes are higher than ever. With RSA Conference just a few weeks away, Big Valley team members Andy Shane, Media + Influencers Lead, David Nieland, Head of Client Experience, and Karen Burke, Cybersecurity Story + Content Lead, got together to discuss the fast-changing cybersecurity media landscape, the key elements for good storytelling and the potential impact of AI.

Karen: How has the cybersecurity media landscape changed?

Dave: The cybersecurity media landscape has become very fractured. With the advent of new blogging platforms and the continued collapse of traditional advertising, the number of cybersecurity pubs continues to shrink, while, at the same time, cybersecurity influencers are hanging their own shingle and starting their own blogs. Today, more than ever, vendors need to  build relationships with key influencers, beyond media, and become a trusted source for them.=

Andy: In three short years, reporters who once did earned media interviews are now only doing paid interviews at RSAC. In fact, the number of outlets that are doing earned media interviews only are fewer for this year’s show. We are finding a lot of success setting up both earned and paid interviews with the same media outlets.

Karen: Right, great point. Every day there are breaking cybersecurity news stories where an executive could provide a point of view. The spokesperson should also have domain expertise that advances the story for the reporters.

Karen: What are the 3-5 key elements that make a good cybersecurity story?

Dave: A good story involves human characters where there’s an arc in the story that builds up tension followed by a resolution and a lesson learned. I think applying that arc to cybersecurity storytelling is a proven practice in terms of setting up the hero and the villain. Other important elements include unique data and research that can speak to larger industry trends. You also need a compelling and provocative point of view and access to real people that can tell real stories, not marketing speak. Customer success stories, too, that share demonstrable results and lessons learned are excellent as well.

Andy: A good story is a good story, whether it’s a cybersecurity story or a healthcare story. At Big Valley, we take an outside-in approach to thought leadership. Many organizations are caught in the weeds and end up telling inside-out stories that are not particularly compelling to reporters or prospects.

Karen: The storyteller is so important. I’ve worked with companies who have great stories to tell, but the storytellers are ill-prepared or don’t have the domain expertise. Today, you need to be authentic in your storytelling. Individuals who have real-world experience solving difficult cybersecurity problems make good storytellers.

Karen: What types of cybersecurity stories are our reporters looking for today?

Andy: AI, anything to do with AI. The media is enthralled with AI and all aspects of it. They also always want to learn more about the latest breach or hack: How has it occurred? Did the adversary use a new technique? Who is it impacting? How is it impacting them? What can be done to prevent a similar hack from happening again? Media is also very interested in the increased role the government is taking in cybersecurity and potential lines crossed from a privacy standpoint. Ten years ago cybersecurity reporters were not as sophisticated as they are today. Today cybersecurity reporters really know their stuff and don’t want to be pitched “fluff.” They just want the facts.

Dave:  Since this is an election year, there’s going to be an increasing amount of focus on cybersecurity stories that relate to nation-state attacks, election interference, and attacks against US critical infrastructure. These stories will provide executives an opportunity to share their perspective, although some CISOs and other practitioners are hesitant to provide commentary because of concern that their companies – or themselves – may become a target.

Andy: That’s a great point, Dave. We’ve seen that a couple of times where a client has turned down interviews with CNBC, the Wall Street Journal or other outlets to discuss specific nation state attacks for the very reason you cited.

Karen: Some vendors are starting up their own news outlets. Do you think we’ll see more of that trend?

Andy: Yes – as the number of news outlets shrinks, we are seeing reporters go to work for cybersecurity companies. One way security vendors can move the needle, from a thought leadership standpoint, will be to create a newsroom asset that publishes not only blogs, but also a variety of content. For example, look at The Record and Decipher – you would not know their publishers are cybersecurity companies.

Dave: Yeah, I think we can safely call out those sites as two great examples of the next evolution – not just transforming your blog to offer more “outside-in” perspectives on the market and the issues of the day, but actually standing up an independent site with a separate editorial team that basically acts like an industry news portal.

Karen: Is there still value in threat research reports from a news perspective?

 Andy: The short answer is yes, but I don’t think a report should try to be all things for all people. Instead, the security vendor should focus on their particular area of cybersecurity. A great report will garner immediate attention and have compelling data that can be referenced a month, two  months, six months down the road. The brass ring is when reporters are highly anticipating a vendor’s annual report and they reach out to us to gain early access to the data, speak with the researchers and discover the potential impact on users, organizations and the industry at large.

Karen: How do we think the media landscape will evolve in the next 10 years? Do you see continued contraction?

Dave: I do think there’s going to be continued contraction in the media landscape, more fragmentation, more individual bloggers, fewer big pubs, more paid, more pay-for-play and more AI-generated content. In the future, there could be entire publications that are all AI-generated without any human assistance. Who knows? In the meantime, I think we’ll see more AI-generated blogs and portals that are just using AI tools to synthesize and pump out news.

Andy: I agree with Dave. The media will continue to evolve as the wants and needs of its target audience evolve. I also believe we’ll see more commentaries and investigative, in-depth reporting, something AI may not be able to reliably deliver.

****

Headed to RSA Conference 2024 and want to meet with our team? Reach out to us! Email: hireus@bigvalley.co.