How to Choose a PR agency for Cybersecurity

By Aidan Sowa, CEO and Founder, Frontier Industries | October 2026

In 1988, a graduate student released a worm that knocked out roughly a tenth of the early internet, and security learned its founding lesson: the incident writes the headline, not the vendor. Your industry still runs on that rule. Verizon analysed more than 22,000 security incidents and 12,195 confirmed breaches for its 2025 Data Breach Investigations Report, and the findings set the weather your buyers live in. Credential abuse opened 22 percent of breaches. Ransomware appeared in 44 percent. You are not selling into curiosity. You are selling into scar tissue.

Key numbers for this decision:

I. Discrimen

Being quoted on threats is not the same as being trusted with defence

Standfirst: Every vendor can rent a headline on a bad week. Few can survive a buyer technical review.

Draw the distinction first, because security buying turns on it. There is commentary value, your name in articles about the threat landscape, and there is shortlist value, your name surviving contact with a chief information security officer who has been burned by three previous platforms. The two are weakly related. Commentary is bought with speed and a quotable researcher. Shortlist value is earned with detection evidence, honest scope limits, and a record of behaving decently when things went wrong.

An agency fluent in general technology will optimise for the first and call it brand building. An agency fluent in security understands that your buyers discount commentary almost to zero and audit everything else. In this market the pitch meeting should start with a discussion of proof. If it starts with a discussion of angles, you are interviewing a publicity firm, not a security communications partner.

II. Machina

The security press runs on incidents, research, and disclosure timelines

Standfirst: Your coverage calendar is written by attackers and by researchers, not by your launch plan.

Learn how the machine actually turns. Security journalism has three engines. The first is the incident engine: breaches, ransomware events, and vulnerability disclosures, which arrive on attacker timing. The second is the research engine: your own threat team publishing findings that journalists can verify against telemetry. The third is the evaluation engine: structured tests, detection assessments, and peer review platforms where claims get measured in public.

A competent security agency works all three engines with different muscles. It maintains a rapid response protocol measured in minutes for the first, a research publication discipline measured in quarters for the second, and a long evidence game for the third. Ask candidates to walk you through one week in each engine for a current client. Vague answers reveal a firm that mostly issues releases and hopes the engines turn kindly. They will not. For context on how these programmes interlock, browse the resources library.

There is a fourth engine, quieter than the others: the community itself. Practitioner forums, researcher social feeds, and open source project channels decide which vendors are considered serious long before a formal evaluation begins. An agency that monitors those conversations, and occasionally contributes something genuinely useful to them, gives you early warning of narrative shifts that trade press will only report weeks later. Ask candidates how they listen, not just how they broadcast. In security, listening is a defensive control.

III. Exemplum

The vendors buyers believe publish their misses as well as their detections

Standfirst: Credibility in security is a disclosure habit before it is a product feature.

Study the firms whose research gets cited by competitors own sales teams. Their pattern is consistent: they publish methodology with their findings, they name the limits of their telemetry, and when their own product is implicated in an incident or a bypass, they disclose early and in technical language their customers can forward internally. Their communications staff include people who have sat in a security operations centre or a newsroom on incident night, and it shows in the drafting.

Now the counter pattern. A vendor issues fear led commentary on every headline breach, claims its platform would have prevented each one, and never submits to public evaluation. Security leaders keep lists of such vendors, and the lists are shared. An agency that proposes fear as a strategy is proposing that you join that list. Decline, in writing if necessary.

IV. Damnum

In security, your communications partner is inside the blast radius

Standfirst: When the incident comes, and it will, your agency is either rehearsed or it is a liability with a retainer.

The cost side of this hire is unusually concrete. Since 2023, United States securities rules have required public companies to disclose material cybersecurity incidents on Form 8-K within four business days of determining materiality, which compresses disclosure drafting into a legal and communications sprint. If your agency cannot draft under counsel review, at speed, in language that satisfies regulators without misleading customers, the retainer is mispriced no matter how cheap it looks.

There is also the matter of your own house. Verizon (2025) found third party involvement in breaches doubled to 30 percent. Your agency will hold embargoed research, customer names, and incident drafts. Its security posture, access controls, and staff vetting are therefore part of your risk surface. Ask for them, documented. A firm that finds the question impertinent has answered it.

V. Genus

The controlling variable is researcher credibility, not media contacts

Standfirst: In this market, the scarce asset is a threat research voice that practitioners believe.

Every agency will show you a media list. The lists converge, because the security press corps is small and known. What does not converge is whether the agency can develop and place genuine research: original telemetry, novel attack technique analysis, vulnerability discovery handled through coordinated disclosure. That capability is the variable that separates firms. Journalists take calls from agencies whose research has helped them before. Practitioners share findings from vendors whose work respected the evidence.

Test for the variable directly. Ask each finalist to critique, live, a piece of threat research from a non client vendor: what is strong, what is overstated, what would an editor cut. You will learn more in ten minutes than in a credentials presentation.

VI. Segmentum

Platform, tool, and services firms answer to different courts

Standfirst: A managed services provider is judged by clients it cannot name. A tool vendor is judged by tests it cannot script.

Segment the field by your model. Product vendors are adjudicated by evaluations, peer reviews, and researcher sentiment, and their agencies need fluency in test cycles and disclosure norms. Managed detection and services firms sell trust in people and process, often to buyers who prohibit public naming, so their agencies must manufacture proof from anonymised outcomes, certifications, and analyst validation without breaching client confidence.

Consultancies and assessment firms trade on the authority of named individuals, which makes their communications a talent strategy as much as a media one. One shortlist rarely fits all three models. Ask candidates which model accounts for most of their security revenue, and require examples that match your model exactly. The scoping framework on the public relations services page organises selection this way for a reason.

One more segmentation cut decides budget allocation. Vendors selling into regulated sectors, healthcare, finance, energy, face buyers whose compliance teams read your public statements as evidence of control maturity. A careless superlative in a release can be quoted back in a vendor risk assessment. Vendors selling to practitioners first face the opposite risk: language so sanitised by legal review that the community dismisses it as marketing. Your agency must know which court your company is usually tried in, and draft for that court while keeping the other one from objecting.

VII. Occasio

The opening is the disclosure gap: buyers reward the vendor who explains plainly

Standfirst: Jargon inflation has made clarity a differentiator a competitor cannot copy overnight.

Here is the underexploited ground. Security buying committees now include finance, legal, and board members who do not speak the dialect, and they increasingly decide outcomes. Vendors whose communications translate risk into business language, without dumbing down the evidence, win internal arguments that purely technical rivals lose in translation. Few agencies can write both registers well, the practitioner brief and the board brief, from the same facts.

Test for this in selection. Hand finalists one technical finding and require two artefacts: a practitioner summary a security architect would respect, and a board paragraph a chief financial officer would understand on first reading. Score both. The firm that can hold the evidence constant while changing the register is the firm that will make your product legible to the whole committee. Structure and staffing for that dual register work are described on the team page.

VIII. Structura

A senior incident bench beats a deep junior roster every night of the year

Standfirst: Security news does not keep office hours, and neither do attackers.

Choose structure for the worst week, not the average one. You need named senior people who can be reached at 2 in the morning, who have drafted under legal review before, and who know which facts must never be speculated about in public. You also need a research desk with a weekly rhythm. Many agencies offer one of these. Your selection process should refuse to accept fewer than both.

Ask structural questions with auditable answers. Who is on the incident rota this month, by name. What is the contracted response time. Which staff hold security training or clearances relevant to your segment. How are embargoed materials stored and who can access them. Write the answers into the agreement. Structure that exists only in a pitch is choreography.

Notice what this structure does to your launch calendar. In security, a launch is a claim entering a hostile review environment, so launch preparation includes pre briefings for researchers, documentation for evaluators, and a rehearsed answer to the question every launch eventually attracts: what does it not do. Agencies that plan launches this way produce fewer, heavier announcements, and their clients develop a reputation for saying exactly what the evidence supports. In a market exhausted by superlatives, restraint becomes a recognisable brand asset.

IX. Consilium

Select with a live fire exercise and a research critique, then a scoped pilot

Standfirst: In security, you do not hire the presentation. You hire the behaviour under pressure.

Design selection as rehearsal. Give each finalist a simulated incident at a fixed hour: a credible report of a bypass affecting a fictional product, a journalist requesting comment within two hours, and a customer asking whether they are exposed. Score the drafts for speed, accuracy, legal awareness, and restraint. Then score the research critique from section V. The combined result predicts the relationship better than any reference call.

Follow with a pilot scoped to one research publication cycle. A full cycle, from data to placement, exposes every strength and weakness the agency has, inside a single quarter.

X. Quaesita

Questions buyers ask before they sign

Should our agency be a security specialist?

For your core programme, yes, or at least security led within a wider firm. The norms, coordinated disclosure, embargo discipline, evaluation calendars, are specific enough that generalists learn them at your expense and occasionally at your cost.

How do we get quoted on incidents without looking opportunistic?

Be useful or be quiet. Journalists will use your analysis if it adds verified technical detail, and they will remember if it adds only a product paragraph. A good agency enforces that line internally, especially on bad days.

What role should our researchers play publicly?

A central one, with coaching. Practitioner audiences trust named researchers over corporate statements, so your agency should build their profiles carefully, with clear boundaries on what they can disclose and debate in public.

Can an agency help with a vulnerability disclosure of our own?

It should be a core competence. Coordinated disclosure has timelines, embargo partners, and advisory drafting that cannot be improvised. Ask for anonymised examples and the timeline discipline they used.

How should success be measured in security communications?

Research citation by independent outlets, inclusion in evaluation and peer platforms, share of informed commentary during relevant incidents, and movement in competitive shortlists. Impressions during a breach news cycle are a vanity metric with bad incentives.

What about the agency access to our incident plans?

Grant it deliberately and document it. They need enough access to draft at speed, under the same confidentiality and access controls your own staff follow, and the arrangement should be reviewed like any other third party access.

Should we publish threat research if our dataset is small?

Yes, if the methodology is honest about scope. A narrow dataset with clean labelling often teaches the market more than a vast one with vague provenance, and researchers respect the candour. Your agency should help you frame limitations as part of the finding, not as a footnote of shame.

How fast must an agency respond in a crisis?

Contract it: acknowledgement in minutes, holding language within the hour, senior staff on the bridge for the duration. Then test it in the simulation before you sign, not after the first real incident.

XI. Methodus

How this guide was built, and its limits

The breach statistics are from the Verizon 2025 Data Breach Investigations Report, which analysed over 22,000 incidents and 12,195 confirmed breaches. Regulatory framing reflects the United States Securities and Exchange Commission cybersecurity disclosure rules adopted in 2023, and workforce context draws on ISC2 published research. Evaluation references are to the MITRE ATT&CK Evaluations programme and to guidance published by the Cybersecurity and Infrastructure Security Agency.

The limits matter in a market that trades on precision. DBIR figures describe confirmed breaches in the contributing dataset, not all attacks everywhere, and percentages shift as the dataset grows. Disclosure timelines vary by jurisdiction and listing venue. Agency structural advice generalises from common patterns; verify every claim about a specific firm against references in your own segment, and re-run the verification annually, because agency staffing in this specialty turns over faster than the case studies on their websites do.

XII. Incipe

Where to start

Frontier Industries handles communications for security vendors whose buyers audit claims for a living, including research placement, evaluation strategy, and incident drafting that has been rehearsed before it is needed. If you want your current public record stress tested against a simulated incident before you commit to a retainer, start the conversation or call 401-219-4207. Bring the claim your researchers are proudest of. It will get a fair and rigorous reading.

Sources

1. Verizon, 2025 Data Breach Investigations Report press release. https://www.verizon.com/about/news/2025-data-breach-investigations-report 2. Verizon, Data Breach Investigations Report hub. https://www.verizon.com/business/resources/reports/dbir/ 3. MITRE, ATT&CK Evaluations. https://attackevals.mitre.org/ 4. US Securities and Exchange Commission, Cybersecurity Disclosure Rules, 2023. https://www.sec.gov/news/press-release/2023-139 5. Cybersecurity and Infrastructure Security Agency, guidance and advisories. https://www.cisa.gov/ 6. ISC2, Cybersecurity Workforce Study. https://www.isc2.org/Research/Workforce-Study 7. National Institute of Standards and Technology, Cybersecurity Framework. https://www.nist.gov/cyberframework 8. Edelman, 2025 Trust Barometer, Technology Sector Insights. https://www.edelman.com/trust/2025/trust-barometer/report-tech-sector 9. G2, Buyer Behavior Report 2024. https://research.g2.com/hubfs/2024-buyer-behavior-report.pdf 10. Gartner, Worldwide IT Spending Forecast, January 2025. https://www.gartner.com/en/newsroom/press-releases/2025-01-21-gartner-forecasts-worldwide-it-spending-to-grow-9-point-8-percent-in-2025