Jonathan Munshaw started out as a newspaper editor in the D.C./Baltimore area before a former colleague recruited him into cybersecurity. He spent years telling stories for Cisco Talos and Sophos. He recently joined Netcraft to support its marketing function.

I sat down with Jonathan to talk about why most rebrands are a positioning problem in disguise, why he thinks the industry’s AI messaging is years behind the actual technology, and why he encourages researchers to swear on a podcast

How did you end up in brand communications, and what’s kept you in cybersecurity?

If someone is an expert in a topic, they will use clean, clear, simple language to explain it. If they’re not, they will use complex jargon as a defence mechanism to confuse you.

I like explaining complicated things. That’s why I got into journalism. I worked in newspapers for a couple of years before a former coworker recruited me into security. 

I didn’t even know I wanted to be in this industry until I arrived. I left journalism for the job security, but I fell in love with the work because it let me keep using that same research brain. One week I’m having to become a pro on a stock or a banking regulation, and the next week it’s a piece of malware or a threat actor group.

Either way, I want to (have to) be able to explain it to somebody as if it’s the first time they’ve encountered an idea. I use my parents as a measuring stick. If they understand what I’m saying, I’m doing my job.

When is a rebrand necessary, and when is it just someone wanting to leave their mark?

A rebrand is only warranted if; what you do as a company has significantly changed, your audience demographics have significantly changed, or if you are repositioning to speak to a new demographic entirely.

Rebrands are often used as suitable distractions for marketers who want to come in and seem like they’re shaking things up. Changing logos, fonts, words, and websites without understanding…;

• “What you say?”
• “How you say it?”
• and, “Who you say it to?”

[Without those answers] it’s a recipe for wasted time and wasted money.

Most of the time when people think they need a rebrand, what they actually need is a clearer go-to-market message.

What does a well-run content program look like to you?

It’s one run with intent. It doesn’t matter what form the assets come in.

A program doesn’t need video, a podcast, a blog, or a newsletter to be effective. Any one of those can carry weight if you know your audience and message. 

I once built a video series by shooting footage on my phone and editing it in Premiere, with no budget beyond a fifty-dollar ring light, and it ended up running across Cisco’s TikTok channels.

Over the last few months, we found that our blog and social programs have been working really well because we’ve been deliberate about who we’re trying to reach: people worried about scams, spam, and phishing.

As we evolve as a team, we’re starting to integrate video into our workflow to extend our reach and think about how our audience is consuming content today. It’s about being intentional and having a strategy to make sure that when we create a piece of content, we are maximizing its potential.

Companies always feel pressure to prove brand value against demand-gen numbers. How do you balance that?

Our CMO at Netcraft built a custom brand score before I joined, a weighted algorithm the team put together that adjusts over time based on what the CEO and board say matters most in a given quarter.

That brand score gives us a number to put in a QBR deck, something like brand presence growing eight percent quarter over quarter, and it’s proven useful because so much of this is otherwise impossible to attribute cleanly. Someone sees a LinkedIn post, goes to Reddit, then fills out a contact form weeks later, and there’s no clean line connecting those dots.

You have to build your own way of measuring what actually matters to your specific business rather than leaning on numbers that just look good on a slide.

How do you personally keep up with what’s happening in security and marketing?

I’m still using an RSS reader, which might make me one of the last people doing so.

I stay off personal social media for my own sanity. For actual reading, I follow traditional outlets that cover security the way a sports desk covers a league: Dark Reading, Ars Technica, The Verge. 

I set aside time most mornings the way I would with a physical newspaper. On the newsletter side, I’d point people to This Week in Security from Zack Whittaker at TechCrunch, and to the Threat Source newsletter out of Cisco Talos.

What’s the uncomfortable truth about AI and cybersecurity marketing people won’t say out loud?

AI is not the solution a lot of people think it is. And people impressed by certain abilities of AI (like content creation), tend to be easily impressed.

AI can’t replace your brand’s personality or your marketing team, because if every security company is writing with the same tool, every security company sounds the same! 

Our audience is great at spotting AI-generated content, partly because they’re already trained to spot scams. Even something you wrote yourself entirely will get flagged if it leans on the tells, like a sentence structured as “it’s not X, it’s Y.” 

If a technical audience decides your content is coming out of a machine, they’ll tune you out fast, especially somewhere like a dedicated Discord, Slack, or Mastodon community where people are already primed to call it out. 

Jonathan Munshaw leads content and brand communications at Netcraft. He previously told stories for Cisco Talos and Sophos, and started his career as a journalist covering business news in the Washington, D.C./Baltimore area.

About Bora

We’re Bora. We work with security companies to turn complex technical capabilities into clear, credible market narratives.

Get in touch for a free 30 minute consultation. If we’re not the right fit, we’ll help find someone who is.