Security is the one technology sector where the press is structurally suspicious of vendors. Reporters on this beat have spent years watching companies inflate threat numbers to sell products, and they filter accordingly. The upside is that the path to credibility is unusually clear: publish real research, and let it speak.
What makes cybersecurity PR different
Your best media asset is your research team, not your product team. Security journalists cover incidents, vulnerabilities, threat actors, and policy. They cover vendors mainly when a vendor's researchers found something. A company with two good researchers publishing regularly will out-cover a company with a ten-person marketing team and no findings.
Fear-based marketing actively costs you. The genre is well known and openly mocked: a survey commissioned by a vendor discovers a crisis that the vendor happens to solve. Reporters recognize the pattern instantly, and pitching it marks you as a source not worth reading.
Buyers are practitioners who can check your claims. CISOs and security engineers read the same publications as the reporters. A claim that doesn't survive technical scrutiny is worse than silence, because your buyer is also your fact-checker.
Incidents create an ethics layer other sectors don't have. When you publish research about a breach, an unpatched product, or an active campaign, real organizations and real people are exposed. Disclosure timing is not a marketing variable.
The outlets and beats that matter
Dedicated security press:
- Dark Reading is practitioner-focused and deep on threats and defense
- BleepingComputer is fast, technical, and heavily read by responders
- The Record and CyberScoop cover threat intel, nation-state activity, and policy
- SecurityWeek, Infosecurity Magazine, and Help Net Security cover industry and research news
- Krebs on Security is independent, investigative, and not pitchable in the ordinary sense
General tech and business press. Ars Technica, Wired, TechCrunch, Reuters, Bloomberg, and the Wall Street Journal cover security when there's scale, a recognizable victim, a nation-state angle, or a policy fight. Their security reporters are among the best sourced in tech.
Policy and government. Federal News Network, Politico, Nextgov, and Lawfare matter if you sell to government or work on regulation, CISA directives, or critical infrastructure.
Practitioner channels. Conference talks at Black Hat, DEF CON, RSA, and regional BSides events, plus technical writeups on your own blog, reach buyers directly and frequently become the source for press coverage. Many security stories start as a researcher's blog post, not a pitch.
Sort your list by who has covered your specific threat category recently. Ransomware, ICS/OT, identity, cloud posture, and appsec are distinct beats even within security. Building a media list from recent bylines is the only reliable method here.
Announcement types that land
- Original threat research. A new campaign, a malware family analysis, an attribution finding, a technique documented in the wild. This is the category that works.
- Vulnerability discoveries, disclosed responsibly with the vendor's patch timeline respected.
- Funding and acquisitions. Security consolidation is heavily tracked by both trade and business press. A funding announcement template keeps the round details clean.
- Data from your telemetry (attack volumes, dwell times, exploitation timelines), provided you explain the sample honestly.
- Notable hires, particularly researchers and CISOs with recognized track records.
- Free tools and open-source releases. Publishing a detection rule set, a decryptor, or an analysis tool gets covered and earns goodwill.
- Incident response participation, where the affected party consents to your involvement being named.
What doesn't land: product launches, platform consolidation announcements, Gartner placements, certifications, and vendor-commissioned survey reports declaring that most organizations feel unprepared. A launch can work if the product does something technically novel, so structure it around the technical claim with a standard product launch structure and make sure a practitioner can evaluate it. If in doubt, apply the newsworthiness test.
Credibility and disclosure traps
Coordinated disclosure. If your research involves a vulnerability in someone else's product, the vendor gets notified first and gets a reasonable window to patch. Publishing to hit a marketing date, or timing a release to a conference at the expense of a fix, will be noticed and reported. Have a written disclosure policy and follow it.
Naming victims. Do not name a breached organization that hasn't disclosed, and do not pressure one to disclose on your schedule. Beyond the ethics, there is real legal exposure, so get counsel involved before publishing anything that identifies an affected party.
Attribution. Attribution is hard, and confident attribution to a nation-state on thin evidence is the claim most likely to get your research publicly picked apart. Use calibrated language: what you observed, what it overlaps with, and what confidence you hold and why.
Telemetry statistics. "Attacks increased 300%" means nothing without the base, the detection methodology, and whether your sensor coverage changed during the period. State the sample, the window, and the limitations. Analysts will ask.
Claims about your own product's efficacy. "Blocks 100% of ransomware" is unprovable and invites independent testing that you will lose. Third-party lab results from recognized testing organizations carry weight. Internal test results do not.
Your own breach. Every security vendor should have a prepared incident response communications plan, because the sector's most credibility-destroying stories are about security companies that got compromised and handled it badly. Breach notification requirements vary by jurisdiction and by contract, so coordinate disclosure with counsel, and never speculate publicly while an investigation is open.
CVE hype. Naming and branding every bug with a logo has become a running joke. Reserve that treatment for findings that genuinely warrant it.
A cadence that compounds
Security PR rewards consistency over campaigns.
- Monthly or better: publish original research on your own blog. Even modest findings build a body of work reporters learn to check.
- Quarterly: one larger research report or telemetry analysis with a methodology section, plus one business announcement if you have one.
- Continuously: be reachable for reactive commentary. When a major vulnerability drops, reporters need technical sources within hours. The vendors who get quoted are the ones who answered fast with substance and without pitching their product in the first sentence.
- Annually: plan around the conference calendar, with research timed to talks you have actually had accepted.
The honest framing on distribution: a wire release puts your funding, acquisition, or report on the public record and makes it findable, which is useful. In security specifically, it will not by itself produce coverage, because this beat runs on relationships and verifiable findings. The release is the record, and the pitch is the story. The difference is worth understanding.
Putting security research or company news on the record? [Our pricing is public](/pricing).