On this page9
Cybersecurity PR Service: Analyst Relations and Security Press
My cybersecurity PR service is a fractional, senior-led program for security startups: $5K to $12K a month on a 3 to 12 month retainer, or a $15K to $40K launch sprint over 4 to 8 weeks. It covers three things security companies need and generalist agencies rarely do well: analyst relations with firms like Gartner, Forrester, IDC and KuppingerCole, earned coverage in security trade press such as Dark Reading, SC Media, CyberScoop and The Record, and disclosure and incident communications. AI search visibility is built in. For comparison, the median Series B cybersecurity agency retainer sits near $23,500 a month.
Why security PR is its own discipline
Security buyers are the most skeptical audience in B2B. CISOs have been sold to by hundreds of vendors claiming to stop every threat. Security reporters have read every "AI-powered next-generation platform" press release and ignore all of them.
That changes the job. The levers that work in general tech PR, like funding announcements and product launches, work less well here. What earns coverage in security is evidence: original threat research, a vulnerability your team found and disclosed responsibly, data from your telemetry nobody else has, or a founder who can explain an attack clearly on deadline.
And the stakes are different. A badly handled disclosure or a slow response to an incident doesn't just cost coverage. It costs trust with exactly the buyers you're trying to win.
What's included in the cybersecurity PR service
| Workstream | What I do | What it produces |
|---|---|---|
| Positioning and message house | Define the category you compete in, the threat you're best placed to talk about, and the proof behind it | A messaging foundation analysts and reporters can repeat accurately |
| Analyst relations | Map which analysts cover your category, prepare briefing decks, secure vendor briefings, track follow-ups | Analysts who know who you are before they write the next market report |
| Security trade press | Pitch research, expert commentary and news to the reporters who cover your area | Coverage in outlets CISOs and practitioners read |
| Research-led PR | Turn your telemetry or research team's findings into a publishable, pitchable report | The single strongest earned-media asset a security company has |
| Disclosure and incident comms | Coordinated disclosure timelines, holding statements, customer and press messaging | Communications that protect trust when something goes wrong |
| AI search visibility (AEO) | Structure your site, research and coverage so AI assistants cite you on category questions | Showing up when buyers ask ChatGPT or Perplexity who to evaluate |
| Founder and researcher profiling | Op-eds, podcasts, conference talks for your CEO or head of research | A named voice reporters call for comment |
Analyst relations: the part most startups skip
Analysts at Gartner, Forrester, IDC and KuppingerCole shape enterprise security shortlists. A CISO evaluating vendors will often check what the analysts say before taking a meeting.
Most startups ignore analysts until a sales rep loses a deal because "you weren't in the report." By then they're a year behind. The good news: the major firms accept vendor briefings from companies that aren't paying clients, so early-stage teams can start the relationship without a large subscription.
What I run for analyst relations:
- A target list of the specific analysts covering your category, not just the firm
- A briefing deck built for analysts, which is different from a sales deck
- Briefing requests timed to product milestones or research releases
- Prep sessions with your founder or product lead before each briefing
- A tracker of what each analyst asked, and follow-ups with the data they wanted
- Guidance on when paid analyst services are worth it for you, and when they aren't
If you're starting from zero, my analyst relations 101 guide covers the basics you can do yourself.
Security press: who reads what
| Outlet type | Examples | What they want from you |
|---|---|---|
| Security trade press | Dark Reading, SC Media | Practitioner-relevant analysis, research, expert comment |
| Policy and government security | CyberScoop, The Record | Nation-state activity, policy impact, public-sector security |
| Mainstream business and tech | Forbes, AI Magazine | Business consequences, AI security, founder stories |
| Crypto and Web3 security | CoinDesk, The Block, Decrypt | Exploits, wallet and protocol security, incident analysis |
I've placed Web3 and AI founders in Forbes, CoinDesk, Cointelegraph, Decrypt, The Block, Blockworks and AI Magazine for six years. A lot of security news now sits right at that overlap: wallet infrastructure, AI model security, protocol exploits. Those are beats where knowing both the crypto desks and the AI desks pays off. For trade-specific tactics, I wrote a longer piece on getting into Dark Reading, The Record and BleepingComputer.
Disclosure and incident communications
Two scenarios, two different playbooks.
When your team discovers a vulnerability in someone else's product. This can be your best PR moment or a reputational mess. The difference is process: coordinated disclosure with the affected vendor, an agreed timeline, a CVE where appropriate, and press briefed under embargo only once the fix or mitigation is ready. I coordinate the comms side of that timeline with your researchers.
When something happens to you. Speed and accuracy matter more than polish. Holding statements are drafted before you need them, approval chains are agreed in advance, and customers hear from you before they read about it.
HOLDING STATEMENT TEMPLATE (for the first hours of an incident)
We are aware of [brief, factual description of the issue] affecting [scope, if known].
Our security team is actively investigating, and we have [immediate action taken].
At this time, we [have / have not] identified impact to customer data.
We will share an update by [specific time and timezone] and directly notify affected customers.
Questions: [named contact or press email]Fill in only what you know is true. Never speculate on scope in a holding statement.
Pricing and how it compares
| Option | Price | Length | What it fits |
|---|---|---|---|
| Fractional retainer | $5K to $12K per month | 3 to 12 months | Ongoing AR, press, research PR, AEO |
| Launch sprint | $15K to $40K total | 4 to 8 weeks | A funding round, product launch, or research release |
| Typical Series B security agency | Median near $23,500 per month | Varies by agency | Large account teams, broader coverage |
The range depends on how many workstreams you need running at once. A seed-stage company focused on trade press and AEO sits at the lower end. A Series A or B company running analyst relations, a research report and founder profiling in parallel sits at the upper end.
You work with me directly. There's no junior account team in the middle and no handoff after the pitch meeting.
Who this fits, and who it doesn't
Good fit:
- Seed to Series B security startups with a real technical differentiator
- Teams with research, telemetry or a researcher who can talk to press
- Web3 security, AI security, or identity and wallet infrastructure companies
- Founders who want analyst relations started before it becomes urgent
Not a fit:
- Companies that want to fear-market off other people's breaches
- Teams with nothing technical to say and no plans to publish research
- Late-stage companies needing a 20-person global agency team across many regions at once
- Anyone wanting guaranteed placements in a named outlet
Objections founders raise
"Do you have cybersecurity case studies?" My published case studies are Web3 and AI, including wallet infrastructure work for Web3Auth. The security-specific playbooks, from analyst relations to disclosure comms, are what I'll walk you through on the call, with specifics for your category rather than generic claims.
"Analyst relations feels premature at seed." Paid analyst programs often are. Free vendor briefings aren't. Getting on an analyst's radar a year before you need them costs a few hours.
"Why does AI search matter for security?" Buyers increasingly start vendor research by asking an AI assistant. Those assistants cite coverage, research and well-structured pages. My piece on why PR drives AI search citations explains the mechanics.
Getting started
A 30-minute call is enough to tell you which workstreams matter first and what a realistic first quarter looks like. Full scope is on the cybersecurity PR service page.
In security, the vendor reporters trust is usually the one that published something useful before it had anything to sell.
Want an honest read on your security PR plan? Book a 30-minute teardown.