Earned Media for Cybersecurity Companies

Cybersecurity companies operate in the most overcrowded, highest-stakes earned media environment in B2B technology. Every week, Series A and B security companies are raising funding, launching products, and pitching the same five security reporters. Gartner projects global information security spending to reach $212 billion in 2025 — a 15% increase year over year — and Forrester's Global Cybersecurity Market Forecast projects that number will exceed $302 billion by 2029. The capital flowing into the category has made the editorial landscape noisier, not quieter. Standing out requires understanding the specific editorial logic that governs security coverage — and building a program that works within it.

The stakes are higher than most categories. According to GrackerAI's 2026 B2B research data, 40% of security decision-makers now use AI assistants — ChatGPT, Perplexity, Claude — for initial vendor research, rather than Google, and G2 found that 51% of B2B software buyers now start research with AI chatbots more often than with Google (G2: B2B Software Buyers and AI Chatbots). And MuckRack's analysis of over one million ChatGPT citations found that 89% originated from earned media placements. Which earned media, for cybersecurity specifically, is now measured: the Machine Relations Index records which root domains six answer engines cite on cybersecurity questions, and in its September 18, 2026 release the editorial outlets inside cybersecurity answers are the security trade press on news-shaped questions, while the general-interest technology outlets an earned media plan usually names reach cybersecurity buyer questions in two runs between them or not at all. That measurement is below, and it changes which placements the program should chase first.

The Constraints That Make Cybersecurity PR Different

Generic earned media playbooks fail cybersecurity companies for structural reasons. The category imposes constraints that don't exist in SaaS, fintech, or most other B2B verticals.

You cannot tell the best stories. The most compelling cybersecurity narratives — the breach you stopped, the attack chain your platform caught before it executed, the CISO who avoided a $40 million incident — live under NDA. Your customers won't go on record. Even when they would, their legal and security teams often won't allow it. Case studies with scrubbed details and anonymized industries don't move security journalists. They've seen too many of them.

Your claims are inherently suspicious. Security journalists at Wired, TechCrunch, and Ars Technica have spent careers covering companies that overpromised and underdelivered. They're deeply skeptical of vendor marketing dressed as news. "Our platform stopped X% of attacks" is not a story. It's a sales deck. Editors who cover this beat have explicit editorial policies against coverage that reads as vendor advocacy. The threshold for what constitutes a real finding — as opposed to a product claim — is higher in cybersecurity than in almost any other technology category.

The threat landscape moves faster than your content calendar. A ransomware surge, a zero-day disclosure, or a regulatory shift can make your entire editorial plan obsolete overnight. But security journalists also don't want reactive pitches that arrive twelve hours after a story breaks. The publications that matter in this category want sources who give them intelligence before it becomes news — not after.

IBM's 2026 X-Force Threat Intelligence Index found a 44% increase in attacks exploiting public-facing applications, driven by AI tools that help attackers identify weaknesses faster than defenders can patch them. That acceleration means the threat environment your earned media program has to navigate is more fluid than ever. The editorial angle that works in Q1 may be stale by Q3.

These constraints aren't reasons to avoid earned media. They're reasons to build a program that's specific to how security coverage actually works.

What Security Journalists Will Write About

Understanding what drives a story in security journalism is the foundation of a functional earned media program. The answer is narrower than founders usually expect.

Original research is the primary driver. Threat intelligence findings, behavioral data, attack frequency analysis, and category-level insights backed by your platform's telemetry are the angles that generate real coverage. A statistic your platform can uniquely produce — one that advances the field's understanding of the threat landscape — is a publishable finding. "We analyzed 150 million endpoint events and found that identity-based lateral movement now precedes 73% of ransomware deployments" is a story. "Our platform provides superior detection capabilities" is not.

Leadership credibility matters more than in most categories. Wired and Ars Technica will write about a company when they can find a founder or CISO who speaks authoritatively about the threat environment — not just about the product. Building editorial relationships with security reporters requires demonstrating subject matter depth, not just product awareness. The executives who become regular sources for security publications are the ones who give journalists useful intelligence proactively, before a story is in motion. That kind of relationship doesn't come from PR pitches. It comes from becoming genuinely useful to reporters covering a beat.

Funding and partnerships earn entry-level coverage, not sustained presence. A Series B announcement will earn you a TechCrunch mention, the way it does for most B2B companies. But funding coverage creates a moment, not a body of editorial presence. The companies that compound over time are the ones that produce research findings, executive commentary, and category-defining claims consistently — not the ones who are covered once when they raise money and then disappear from the editorial ecosystem.

Regulatory and compliance shifts are underexploited angles. The EU's ongoing work on critical infrastructure cybersecurity, NIST Cybersecurity Framework updates, CISA's Secure by Design program, SEC reporting requirements, and sector-specific compliance mandates create genuine news hooks that security journalists follow closely. A company that can credibly explain what a regulatory change means for enterprise security operations — and position its platform in that context — has an editorial angle that doesn't require disclosing customer data or making product claims.

Building an Earned Media Program That Works

A functional cybersecurity earned media program is built around three capabilities: producing publishable research, developing journalist relationships, and maintaining presence across the outlets the engines actually cite for cybersecurity.

Research production. The most effective cybersecurity companies treat their platform as a research instrument, not just a product. They analyze aggregate, anonymized data from their sensor network, identify patterns that are genuinely novel, and release findings through credentialed channels — academic partnerships, conference presentations at Black Hat and DEF CON, and media pitches backed by methodology. This is not marketing dressed as research. It's actual analysis that happens to also serve an editorial purpose. The distinction is visible to journalists, and it matters.

Journalist relationships. Security coverage is relationship-driven in a way most B2B categories are not. Zack Whittaker at TechCrunch, Lily Hay Newman at Wired, and the handful of other journalists who cover enterprise security full-time receive hundreds of pitches weekly. They respond to sources who have given them accurate intelligence in the past — and they will not respond to cold outreach from companies they've never interacted with. Building these relationships requires time, consistency, and a willingness to give useful information without expecting immediate coverage in return. The AT guide to how earned media drives AI search results covers the structural mechanics of why relationship-driven coverage outperforms transactional pitching.

Coverage where the engines find editorial sources. A placement in Wired is valuable to the human reader. For the AI answer, the Index says which outlets are inside cybersecurity citations and which are not, per question shape, and the list is not the one a general-interest PR plan would write. Read it before choosing targets; the measured table is in the next section, and the full seven-shape and fifteen-outlet tables are on the cybersecurity hub.

The program structure described in the complete AEO playbook for earned media applies directly to cybersecurity: anchor research, distribution across the editorial ecosystem, and AI citation audits that tell you whether the coverage is landing in the framing you want. The execution in cybersecurity requires adapting each step for the category's specific constraints — but the underlying structure is identical.

The AI Citation Dimension, Measured

Cybersecurity earned media has always driven enterprise pipeline. In 2026, it also sits beside something that didn't exist five years ago: AI answers that shape vendor shortlists before buyers ever contact your sales team. Which sources those answers cite is no longer a matter of assumption.

The Index monitors ChatGPT, Claude, Gemini, Google AI Mode, Google AI Overviews and Perplexity on buyer prompts and records which root domains each answer cites. Release mri_score_v2.0+2026-09-18+8fa38e54dd0a, window 2026-05-10 to 2026-09-18, publishes all seven cybersecurity segments. Read from each outlet's own profile:

Outlet	Cited runs, whole Index (of 15,782)	Cybersecurity buyer-question standing (six shapes)	Cybersecurity news-driven standing (of 1,340 domains)
SecurityWeek	46	Not observed	#7 (44 of 623 runs, 7.06%)
CSO Online	35	Is it worth it #39 of 227 at 4.58% (6 of 131 runs); problem-first #66 of 263 at 2.40% (3 of 125 runs)	#55 (15 of 623, 2.41%)
TechCrunch	164	Not observed	#64 (14 of 623, 2.25%)
Help Net Security	18	One run each on three shapes	#77 (12 of 623, 1.93%)
VentureBeat	46	Not observed	#148 (8 of 623, 1.28%)
Dark Reading	4	Not observed	#266 (4 of 623)
Forbes	649	One run each on two shapes (#207 of 325, #159 of 227)	#272 (4 of 623, 0.64%)
WIRED	47	Not observed	Not observed
Ars Technica	3	Not observed	Not observed

"Not observed" means the Index recorded no citation of that domain in that segment during the window; it is a statement about these monitored prompts on these six engines, not about every AI answer, and a citation is not evidence that the answer was supported by the source.

Three things in that table rewrite the earned media plan. The security trade press is where editorial citations inside cybersecurity answers actually come from, and it is the news-shaped answer they land on: SecurityWeek #7, Infosecurity Magazine #13, CRN #14, TechRadar #27, CSO Online #55, Help Net Security #77, all of 1,340. The general-interest technology outlets are not there: Wired and Ars Technica are unobserved in every cybersecurity segment, Forbes reaches cybersecurity buyer questions in two runs across 649 cited runs Index-wide, TechCrunch and VentureBeat appear only on news. And the buyer-question answers, where the shortlist is formed, are not made of editorial coverage at all: the most-cited source on every one of the six buyer shapes is a security vendor's own site or a community platform (huntress.com 58.67% of 75 best-tools runs; Reddit in the top six on five of six shapes; GitHub leading problem-first research), with editorial publications holding 6 to 15 of each buyer-shape top 100. When a security architect asks ChatGPT to evaluate the top threat detection platforms for a cloud-native enterprise, the answer is downstream of the vendor comparison pages, practitioner threads and repositories the engine already cites for that shape, and of trade press coverage when the question is about what changed. A company with no presence in Wired, TechCrunch, Ars Technica and Forbes is, on this release, in the same position as every vendor the engines do cite.

Machine Relations is the practice of building presence in the source classes the engines cite, measured per release, with earned media as one of those classes. For cybersecurity companies, that means two tracks: an owned source page per buyer shape, structured so the answer is extractable, and earned coverage in the outlets the Index finds inside cybersecurity news answers, with the general-interest press pitched for the human buyer and the investor. Every research finding released, every journalist relationship cultivated, and every placement earned still has two audiences: the human readers who form opinions today and the AI systems that assemble the answer tomorrow. The cybersecurity machine relations guide explains how the two audiences interact. The Index is published by Machine Relations and is not an AuthorityTech product; it measures observed root-domain citations in monitored prompts, not recommendation quality, traffic or revenue.

The companies that own category authority in AI-assisted vendor research by the end of 2026 will have built that position through consistent work on both tracks over the preceding twelve months, read against each quarterly release so the plan starts from a number rather than an assumption.

FAQ

What publications matter most for cybersecurity earned media?

For the human buyer and the investor: Wired, TechCrunch, Ars Technica, VentureBeat and Forbes, for the reasons a PR plan has always named them. For AI citation inside cybersecurity answers, the September 18, 2026 Index release says otherwise: SecurityWeek (#7 of 1,340 on cybersecurity news-driven citations), Infosecurity Magazine (#13), CRN (#14), TechRadar (#27), CSO Online (#55, and #39 of 227 on "is it worth it") and Help Net Security (#77) are the editorial outlets the engines cite; TechCrunch is #64 and VentureBeat #148 on news only; Wired and Ars Technica are not observed in any cybersecurity segment; Forbes reaches cybersecurity buyer questions in two runs. Dark Reading and CSO Online are worth targeting for practitioner credibility, and CSO Online is also inside the answers, above TechCrunch on cybersecurity news. The Wired coverage guide and the TechCrunch coverage guide carry each outlet's measured standing and editorial priorities.

How long does it take to see pipeline impact from earned media?

The first placements from a well-executed program typically appear within 60 to 90 days. Enterprise sales cycles in cybersecurity run 6 to 18 months, and buyers research vendors throughout that window. The programs that drive measurable pipeline impact are the ones built for sustained coverage, not single moments. Whether the coverage is reaching AI answers is a separate reading: check your own domain in the cybersecurity segment of the Index against the release id, and treat correlation between a placement and a later citation as correlation until a release shows otherwise.

Can cybersecurity companies earn coverage without disclosing customer data?

Yes. The strongest earned media angles in this category are threat intelligence findings (your data, not customer data), leadership commentary on category-level developments, and original research produced in partnership with academic institutions or industry groups. The constraint is real, but it redirects editorial energy toward angles that tend to be more durable — research-based coverage ages better than customer story coverage.

How does earned media fit with an existing PR retainer?

Earned media and PR are not the same. PR is the operational function — media relations, pitch writing, press release distribution. Earned media is the outcome: third-party editorial coverage in publications that matter to your buyers. A PR retainer can support an earned media program, but a retainer that delivers press release distribution without strategic placement in named publications is not building presence in any source class the engines cite; the Index's paid wire layer is nine domains carrying 0.20% of all citation as the release classifies its members, or 0.37% once PR Newswire is counted as wire distribution rather than the editorial publication the release files it as. The distinction matters when evaluating program ROI. The how-to guide on appearing in ChatGPT answers through earned media covers how to measure this specifically.