For the past few months, this blog has handed the mic to cybersecurity marketers. CMOs, heads of content, PR veterans, and SEO specialists have told us what’s working for them, what isn’t, and where the budget goes.
That’s half of the story. The other half belongs to the CISOs, practitioners, and security leaders. Everyone all that marketing is aimed at, the people who read our content, sit through our webinars, and decide whether a vendor deserves a conversation.
So, we’re starting a second Q&A series to run alongside the first. In this one, cybersecurity professionals tell us what they make of cybersecurity marketing, what they value, what makes them close the tab, and what they wish vendors would do differently. We’ll talk about the big developments in security along the way, too.
Jane Frankland has spent almost three decades in the industry. She ran her own penetration testing company, received an MBE for her contribution to cybersecurity, and now serves as a bridge between security leaders and the vendors trying to reach them. CISOs trust her and vendors hire her, which puts her in a position to understand both sides of what should be a symbiotic partnership.
We spoke about agentic AI, the gaps between security silos, why AI didn’t invent slop, and what the most important parts of the cybersecurity marketing job.
What is the most significant development in cybersecurity right now, and what do businesses get wrong about it?
I hate that my answer has to be AI, but it has to be AI. It’s all anyone talks about. Agentic AI in particular.
For years, we’ve thought about cybersecurity in terms of people and technology. Now we’re introducing agents with identities, permissions, and the authority to act autonomously. That changes the speed and the scale of everything. I think about the three Ms of harm: malice, mistake, and malfunction. Agents amplify all three, and they do it faster than any person could.
What businesses get wrong is treating AI as one more technology to secure. Agents change how an organization operates, so what you’re really doing is redesigning the organization, and security has to sit inside that redesign.
For me, doing AI well comes down to doing governance right. We know how to do governance. We’ve just never really done it at this scale.
Process is a big part of what’s missing. Everything I’m working on at the moment comes back to design. We already talk about secure by design, and that’s important. But I’m talking about design at a different level: how the organization works as a system. There’s a lot of good work happening in individual silos, but just because each piece works on its own doesn’t mean the pieces will work when you put them together.
What is one cybersecurity topic that doesn’t get the coverage it deserves?
The gaps between things. Cyber has a real tendency to stay inside its silos, and the space between them gets little attention. The gaps between the silos aren’t technology problems. They sit in the connections between technology, process and people – in hand-offs, dependencies, authority and assumptions.
Organizations don’t usually fail because one thing is completely absent. Detection, for example, tends to get picked up fairly quickly. Security fails because of latency, and because the whole collection of small things isn’t right and has never been tested in an interdependent manner.
I recently came across a job role called Integration Engineer. It exists in some high-impact engineering disciplines, but we don’t have anything like it in cyber, someone explicitly looking at how all the pieces behave together and what happens at the joins. I think it’s time we had that role, or at least started the conversation about these missing elements. Picture a tiger in a cage. The tiger only stays put because the bars are close together. If the bars move apart, the tiger walks free. That’s what the gaps between our components look like.
A dashboard can tell us that a control exists. A compliance framework can tell us that a requirement has been met. Neither necessarily tells us what will happen when several individually functioning parts of the organization are put under pressure simultaneously.
What does cybersecurity marketing get wrong when trying to communicate the value of products?
Cybersecurity marketing needs to draw a much clearer line from features to capabilities to business outcomes.
Most buyers don’t wake up thinking they need another cybersecurity product. They wake up thinking about the problems and opportunities they have. An incident. A new regulation that makes them personally accountable. The board, their costs, their customers.
And what do we give them? Acronyms, features, and claims, (now with an AI claim, too) that sound almost identical to everyone else’s.
Marketers should understand everyone they serve. There’s a buying committee and a buying cycle. Many vendors don’t map that ecosystem. They focus all their attention on the CISO, and that’s where it stops. What they don’t do is help the CISO sell it up the chain.
When I had my penetration testing company, we’d help security leaders build the internal case to get budget. Three decades on, that still isn’t happening. A single, one-page sheet that helps a CISO make the case to the CIO, the CFO, or the board would do more than most campaigns.
They’re also old-fashioned. Vendor marketing is always lagging behind. Most teams believe they’re current, but they don’t understand how the social channels work now or what’s happening with the algorithms. Even the way they measure value is outdated. We measure what we can measure, with those numbers rarely matching the outcome we’re trying to achieve.
Has AI helped or damaged cybersecurity marketing? Do you see slop and look-alike messaging?
Both, in roughly equal proportions.
AI has made the market far more crowded and noisy because AI scales everything, and scaling is mostly what it’s doing. Slop is the word we like to attach to AI content. But we were sloppy before. Much of the cybersecurity marketing was benign. There was no story, no hook, none of that feeling of “you know me so well, it’s as if you’re inside my head.” That feeling is what I always aim for when I work with clients on messaging and positioning. AI didn’t create the sloppiness. It scaled it because people are using it lazily.
There’s another effect people don’t talk about much. Marketing departments have wanted executives to write more and get out there more for years. Executives were busy, or they had a PR agency capture their voice for them. Now they can do it themselves with AI, so there’s far more of it. That means more competition for visibility and voice, on top of the sloppiness that’s been scaled.
What can cybersecurity marketing teams do to communicate more effectively?
Get to know the customer. Understand their problems and their aspirations across the entire ecosystem of people involved in the decision.
Before anything else, ask the basic questions. What is your objective? What is your voice, and how do you want to come across? And who are you selling to?
Salespeople already work this way. They go after the full buying committee. Marketing usually focuses on one avatar, one persona, and in our industry, that’s the CISO. But the person who matters might be the CIO, the CEO, or the CFO. It might be someone further down the organization. Procurement matters a little, maybe even HR. They all count, and your messaging has to matter to each of them. That takes real care and attention.
I use the word selling deliberately. As a marketer, you are selling. It’s about messaging, having a conversation, building trust, and building engagement. So be clear about what you want from each piece of work. Is it visibility? Or is it moving someone to the next action, like registering for a webinar, coming to your conference, filling out a survey, answering a poll, or leaving a comment that helps you understand them better so you can market to them more effectively?
What is the role of (cybersecurity) marketing?
Building trust and making your name synonymous with the problem that needs to be solved.
We think in categories. We like putting things in boxes. When I was heavily focused on Women in Security, people would say, “Oh, women in security, that’s Jane. Let me introduce you to Jane. We’ve got that problem, Jane can fix it.” They didn’t remember my company. I never set out to brand my company, although I use it a bit more now. They remembered the problem and the name that went with it.
That’s the position vendors should be working towards, and everything you do should move you closer to it. It requires an awful lot of trust. Ask a security leader about phishing-resistant MFA, and they’ll say FIDO. They won’t think of anything else.
Jane Frankland MBE is an author, strategist, and leading authority on cyber survivability. Her work explores how organisations can reduce the impact of cyberattacks, preserve choice under pressure, and recover better. With nearly three decades in cybersecurity, Jane founded an early penetration testing company and later became a Managing Director at Accenture. Today, she works with leaders and global organisations, challenging conventional thinking about cybersecurity through a focus on leadership, culture, governance, defence and collaboration. Jane was awarded an MBE for services to women in cybersecurity and has enabled more than 542 scholarships for women in cybersecurity since 2018. Find her on LinkedIn or at jane-frankland.com.
ABOUT BORA
We’re Bora. We work with security companies to turn complex technical capabilities into clear, credible market narratives.
Get in touch for a free 30 minute consultation. If we’re not the right fit, we’ll help find someone who is.
