Alan Shimel has witnessed almost three decades of change in the technology industry. From the early commercial internet and the dot-com boom, to DevOps, cloud, cybersecurity, and now AI. He’s had a front-row seat to the evolution of technology markets, media businesses, and vendor narratives.
He went to law school, hated it, became his law firm’s accidental tech expert, fell into web hosting, sold his company, rode the dot-com wave up and out, built a security startup called Still Secure at a moment when the word “cybersecurity” barely existed, and eventually turned years of blogging and podcasting into Techstrong Group. The group is now home to Security Boulevard, DevOps.com, TechStrong TV, and a growing suite of technology media properties.
I sat down with Alan to talk about what changed in the media and PR relationship, why most vendors are still operating on a set of assumptions that stopped working years ago, and what it takes to build presence in a market that is drowning in content.
People in cybersecurity marketing know your name, but they probably don’t know the story behind it. How did you build TechStrong?
I went to law school and passed the bar. I hated law school, and hated being a lawyer. But, I became the WordPerfect expert at my firm. In those days lawyers typed letters and briefs and didn’t know much beyond that. I taught myself, and from WordPerfect you had to learn a bit of networking, and from networking I got completely hooked. This was Novell Networks and DOS, before Windows was really Windows. I had machines at home, my own little network, and I was playing on bulletin boards and early online services way before the web went commercial.
When the web did take off, a friend and I started what we thought of as a digital landlord business. We bought discs, set up a server, ran a small ISP out of Long Island, and about a year and a half in, we had 5,000 websites paying us fifty dollars a month. Brochure sites mostly, but it was real revenue. I sold that company to a firm that was doing a roll-up in the hosting space. The guy leading it was Brad Feld, who was then at SoftBank Venture Capital and later co-founded Techstars and founded Foundry Group. We did thirty acquisitions in thirty-six months, went public, and did the whole dot-com thing. I rode it all the way up, and left around 9/11 when the bubble was well and truly gone.
After that, I did a couple more venture-backed startups, then built what became Still Secure. We had IDS, IPS, vulnerability management, and network access control. This was 2001, and what we now call cybersecurity was just catching on. At the time, many of the companies that are giants today were starting up, so I knew all the founders. I stayed until about 2009, then opened a consulting firm. I thought I’d be helping small companies with their security, but because of the relationships I’d built, vendors kept calling me for go-to-market help. And I had been blogging and podcasting since 2003, so I had a platform.
That became the seed of Techstrong. A dinner with Gene Kim, where he showed me an early draft of the Phoenix Project, got me writing and speaking about DevOps. Brad Feld told me I should do a whole site around it, and that became DevOps.com. I had always wanted to do something with the Security Bloggers Network I had built, so shortly after that, I started Security Boulevard, and because we had the Network as the backbone, we were publishing a lot of content from day one.
Security Boulevard grew faster than DevOps.com, then came Cloud Native, then a big push into video before COVID hit. When AI started reshaping the market last year, I realized we needed to be more than just a media company, so Techstrong became part of Futurum, which brings analyst research, financial intelligence, and advisory work to the table. It has been a long, strange road.
You receive more vendor pitches than almost anyone alive. What does the industry get wrong about media relationships?
When you’re a hammer, everything’s a nail. The problem is, the world has changed under my feet, under your feet, under agencies’ feet.
The old model worked like this. A PR agency would charge a vendor anywhere from $7,000 to $25,000 a month, help them craft something that looked newsworthy, and pitch it to publications like mine. Publications needed content because their job was to report the news, so they wrote it up, Google indexed it, and when someone searched for that company or topic, the story appeared, sent traffic to the publication, and everyone was happy. The media company got eyeballs, sold advertising, and sold sponsored webinars. The vendor got coverage. The agency got paid. That flywheel worked for a long time.
We’re not getting traffic from Google the way we used to. Google keeps all that traffic for itself now. They have a no-click-out bias. They want to give users the answer inside Google and keep them there. Where 85 percent of our traffic used to come from Google, that number has been cut in half. So as a publisher, if I am not going to get that traffic in exchange for running your content for free, I have to rethink my model. That means less content, better content, and far more of it monetized in some form, whether that is a reg wall, a subscription, or a sponsored article flag.
What I get from agencies now is still the old pitch. Here is a piece about our client’s new product. Here is what money they raised. Here is who they just hired as CMO. I do not care. My readers do not care. These are smart, senior technical people. Forty-plus percent North American, 14 percent C-suite, 52 percent managers. They are not reading momentum releases. For something to earn a free placement with me now, it has to be newsworthy, something those readers would register to read if I put it behind a form fill. That is a real bar, and most pitches do not come close to clearing it.
So what does clear that bar? What does valuable content look like?
Something new. It’s got to be something people in my readership are going to want to read. It’s got to be something people are going to value. Something important enough that they’d register to read it because it matters to their day-to-day jobs.
Take the vulnerability space as an example. A few years ago, discovering and disclosing a significant vulnerability was a meaningful story. Now AI has completely disrupted that part of the world. We are finding vulnerabilities by the tens of thousands. No one gives a shit about you finding a vulnerability anymore. The question is, what are you doing about the vulnerability? The cheese moved from finding vulnerabilities to fixing them, and a lot of vendors are still pitching from the old location.
The same shift happened with data breaches. Five or ten years ago a breach was dramatic news. Now it happens every day. The story that earns column inches is not the breach itself, it is how the organization responded, how transparent they were, and what changed afterward. If your pitch does not account for where your audience is, and what they already take for granted, it will not land.
AI is flooding the market with content. From where you sit, what is that doing to the industry?
Turning it upside down. Across Techstrong, we are now publishing around 500 articles a month and close to 100 videos. A lot of that is AI-assisted if not AI-generated, and we are not an outlier. Every publisher, every vendor, every agency is producing more content faster than at any point in history. So the question that matters is no longer how much you are publishing. The question is whether what you are putting out adds something to the conversation, or whether it is what is known as ‘AI slop’.
The editorial team exists to make that call. I go by gut as much as anything. Does this tell me something I do not already know? Does it give a practitioner something they can use? The ones who are kidding themselves are the people who think the answer is to opt out of AI entirely. I hear peers saying they will never touch it, and I think of people who refused to give up their horse and buggy when cars arrived. AI is here. It’s good to help you organize, it’s good to help you write (to a point), but it’s got to be your thoughts, your opinions, and your feelings.
There was a lot of conversation a year ago about AEO and GEO replacing Google. You have a more complicated view of that.
That narrative missed something important. Google just had its biggest quarter ever. What happened is that Google saw the threat of people searching on ChatGPT and other AI tools, and they adapted. They folded Gemini into search, gave users AI-generated answers inside the Google experience, and kept the traffic. Cleverly, they also made sure Gemini surfaces Google Ads content, so the AI is steering users toward paid results. Google’s revenue grew. Their share of the total search market got smaller because the market itself expanded, people are now searching on ChatGPT, Perplexity, Claude, Copilot, and others. But Google is still generating more revenue than ever from search.
What that means practically is you still have to play the Google game, because whatever traffic comes from it is real traffic. And you also have to figure out this new territory of how you show up in AI-generated answers, which nobody has fully mapped yet. It reminds me of the early days of SEO. A lot of consultants claiming expertise they do not have, a lot of experimentation, not many definitive answers. The fundamentals that keep mattering are the same ones that always mattered. Original thinking, genuine expertise, ungated content that models can read and index. Those things do not change regardless of which system is surfacing them.
If a vendor came to you today and asked how to get the best return on their content and media investment, what would you tell them?
Start by being honest about what you want, because the answer is completely different depending on the goal.
If you want to reach people who are actively shopping right now, that is difficult and expensive. Real purchase intent data, the kind where someone has confirmed what they are buying this quarter, is not the same thing as behavioral signals. Clicking three DevSecOps links does not make someone a buyer. The data that tracks real spending decisions is costly because it is valuable and hard to obtain. We have access to some of it through Futurum now, including data tracking about two trillion dollars in IT investment. That kind of intelligence is not cheap, and it should not be.
If you truly want to do a branding thought leadership campaign, you’ve got to sustain that for a period of six months to a year with a steady stream of content that establishes you. You need consistent output across multiple formats. Some written, some video, some in-person appearances, some virtual events. Steady, sustained, with a clear point of view running through all of it. Too many vendors think of this as one-and-done, and too many people in this industry will happily take your money to deliver one article or one speaking slot and send you on your way. It does not work that way.
The other thing I would say is that most people in this industry are afraid to actually have an opinion. They’re afraid to voice their opinion. What’s the worst that happens? You’re wrong. Everyone’s wrong at some point.
Alan Shimel is CEO of Techstrong Group, publisher of Security Boulevard, DevOps.com, TechStrong TV, and a growing suite of technology media properties. Techstrong is a Futurum company.
About Bora
We’re Bora. We work with security companies to turn complex technical capabilities into clear, credible market narratives.
Get in touch for a free 30 minute consultation. If we’re not the right fit, we’ll help find someone who is.
