Threat research is the highest-leverage PR asset a cybersecurity vendor owns. A well-packaged report on a real vulnerability, a novel attack chain, or a newly observed threat actor campaign will earn genuine tier-1 coverage on Dark Reading, Wired, Ars Technica, TechCrunch, Forbes, and the named security desks at Reuters and the Wall Street Journal, without a wire fee, without a press release, and without a journalist being asked to cover a product. The research is the story. Your job is to package it so a security reporter can say yes in four minutes.
I run fractional cybersecurity PR for security vendors and researchers, and the question I get most often from technical founders is not "how do we get covered" but "we have all this research, why isn't anyone writing about it?" The answer is almost never that the research is bad. It is that the research has not been packaged for journalists who cover six stories a day, do not have a PhD in your specific subdomain, and need a crisp, factual, disclosable finding in a format they can act on quickly. That packaging gap is what kills most research-led PR programs before they start. This playbook closes it.
Why research earns coverage that announcements cannot
A security reporter's job is to inform their readers about real threats. They are not looking for a reason to write about your product, and most of them will actively avoid a story that reads like a vendor pitch. What they are looking for is a real finding, reported accurately, with enough technical substance to be credible and enough translation for a general technical readership to care.
Research satisfies that need in a way no announcement does. A press release about a new threat intelligence platform tells a reporter nothing useful. A report naming a previously undocumented ransomware group, mapping its infrastructure, and attributing twelve confirmed intrusions gives them a story they can own. The vendor's name appears in the coverage not because they bought it but because they produced the finding. That is a fundamentally different kind of credibility, and it compounds. Bylines from Dark Reading, Ars Technica, or Wired sit in Google results and AI engine citations for years. Product announcements do not.
The four types of research that reliably earn coverage
Not all research is equally press-worthy. After running threat-research PR programs across vendors in vulnerability research, threat intelligence, DePIN security, and zero-trust infrastructure, I have found the categories that consistently convert with security desks.
| Research type | What makes it press-worthy | Best targets |
|---|---|---|
| Vulnerability disclosure (CVE) | Named CVE, CVSS score, affected vendor confirmed, patch available or in progress | Ars Technica, Wired, TechCrunch Security, Dark Reading, Bleeping Computer |
| Threat actor / campaign attribution | Named group or new cluster, confirmed victim sectors, TTPs mapped to MITRE ATT&CK, IOCs publishable | CyberScoop, Recorded Future News, Dark Reading, Reuters, WSJ security desk |
| Novel attack technique | New class of attack, reproducible PoC or responsibly withheld, clear affected surface | Ars Technica, Wired, Black Hat and DEF CON proceedings, The Register |
| Scale and data-driven threat landscape | Original dataset, non-extrapolated methodology, year-over-year comparison, surprising finding | Forbes, Dark Reading, Infosecurity Magazine, SC Media, Help Net Security |
The common thread is original finding, not original opinion. Security reporters can instantly tell if a report is a survey of already-public information repackaged with your logo on it. They are not interested. The reports that land every time are based on something the vendor's own sensors, researchers, or reverse-engineering work produced that nobody else had.
Coordinated disclosure: the non-negotiable foundation
Before any of the PR mechanics matter, the disclosure process has to be right. This is not a legal nicety, it is a trust issue with the reporter and with the wider security community. A vendor that drops a vulnerability story without giving the affected vendor a reasonable window to patch will find security journalists reluctant to work with them again. The PR angle is secondary to the ethics, and the good news is that doing disclosure right also makes the PR angle stronger.
The standard coordinated disclosure timeline
- Private notification to the affected vendor. Send a clear technical summary of the finding, the affected product and version range, a severity assessment, and a proposed disclosure date. Ninety days is the broadly accepted window, established by Google Project Zero and widely followed.
- Vendor acknowledgment and patch development. Track the response. Most major vendors are responsive within a week. If there is no acknowledgment after two weeks, a second notice with a shorter window is reasonable.
- CVE assignment. If you have not already, coordinate with MITRE or the relevant CNA for a CVE ID. This is required for coverage in any serious outlet; reporters will ask for it.
- Embargo with journalists. Once you have a patch date confirmed, you can embargo the story with two to four reporters simultaneously for 48 to 72 hours before the patch goes live. This is when you do your PR outreach, and the exclusivity of the embargo window is what gets tier-1 reporters to invest time in your story.
- Public disclosure. Publish your full technical report simultaneously with patch availability. The embargo lifts, reporters publish, and the story moves.
Packaging research for journalists who are not your PhD peers
The biggest gap I see between good research and zero coverage is translation. Your technical report is written for other security researchers. The journalist version is written for someone who is smart, technically literate, and covering ransomware, cloud security, and critical infrastructure on the same deadline. Here is what the journalist version needs to contain.
The journalist brief: five sections, two pages maximum
- The one-sentence finding. What did you find, in plain language, in a single sentence. Not "we identified a novel attack surface in widely deployed enterprise software" but "a flaw in Product X versions 4.2 through 6.1 lets an unauthenticated attacker gain root access over the network, affecting an estimated 40,000 internet-exposed instances." That sentence is the story.
- Who is affected and why they should care. The sectors, the scale, and the real-world consequence of exploitation. If nobody cares, nobody covers it.
- What you found and how. Two to four paragraphs on the research process, in accessible language. This is the credibility layer that separates your report from a vendor blog post.
- Current status. Is a patch available? Is this being actively exploited? What should affected organizations do right now? Reporters always ask this, so answer it before they have to.
- Your expert, available for quotes. Name the researcher, their specific expertise, and confirm they are available to brief the reporter on background or on record. A named researcher with a track record of conference talks, prior CVEs, and a visible profile increases the story's credibility and the reporter's confidence that this is real.
The full technical report goes as a PDF attachment or a link to a staging URL the reporter can access under embargo. The journalist brief is the cover document. Do not make the reporter excavate the one-sentence finding from forty pages of technical appendices.
The security desks that matter and what each one wants
Every major outlet with a security desk has a different editorial appetite. Pitching the wrong type of story to the wrong desk wastes a relationship. Here is the working map I use for threat-research placements, informed by the Dark Reading coverage guide and ongoing work with cybersecurity clients.
| Outlet | Best for | What they need |
|---|---|---|
| Dark Reading | Practitioner-facing technical findings, threat intelligence, vulnerability research | Strong technical substance, MITRE mapping, practitioner relevance |
| Ars Technica Security | Novel attack techniques, CVE disclosures affecting consumer software, technically rich narratives | Reproducible or clearly explained technique, good sourcing |
| Wired Security | Nation-state campaigns, significant CVEs, stories with broad societal stakes | Scale, named victims where possible, strong researcher credibility |
| TechCrunch Security | Startup-relevant disclosures, cloud and SaaS vulnerabilities, breach news | Consumer or enterprise relevance, patch status, rapid turnaround |
| CyberScoop | Government, critical infrastructure, threat actor attribution | Policy angle, CISA or FBI coordination where applicable |
| Bleeping Computer | Ransomware, malware analysis, active exploitation | IOCs, sample hashes, affected version ranges, fast turnaround |
| SC Media and Infosecurity | Enterprise security programs, compliance angle, CISO audience | Business impact framing, risk quantification |
| Forbes and WSJ security desk | Large-scale breaches, significant threat campaigns with business impact | Named companies, executive quotes, financial or operational impact |
The pitch to each desk is not the same pitch. Dark Reading wants the MITRE ATT&CK mapping and the IOC list. Wired wants the societal stakes and a named researcher with a track record. Forbes wants a business-impact number and a company name. Customizing for the desk is not optional, it is the minimum bar for a reply. More on building these pitches is in the cybersecurity PR guide for 2026.
Building a research-led PR calendar
One-off research drops are fine. A recurring research cadence is what builds a brand. The security vendors that own a beat, the ones where reporters proactively reach out when something happens in that space, are the ones that publish on a schedule and make their researchers available consistently.
A workable annual cadence for a security vendor looks something like this: two to three major CVE or threat-actor disclosures timed around the embargo and patch cycle; one annual threat landscape report timed ahead of RSA or Black Hat to capture the conference media cycle; one to two conference-season briefings at DEF CON, Black Hat, or mWISE where you brief reporters in person and set the agenda for what you are working on next; and quarterly practitioner-focused research notes, shorter and more frequent, that keep your researchers visible on desks like Dark Reading and Help Net Security without requiring a full embargo cycle each time.
What to do when research crosses the crisis line
Research-led PR and crisis comms overlap more than founders expect. If your research uncovers an active campaign against critical infrastructure, a zero-day being exploited in the wild, or a breach at a named organization that has not yet disclosed publicly, the PR program is not the first call. The first call is legal counsel, followed by CISA or the relevant national CERT if critical infrastructure is involved, followed by the affected organization directly.
The scenario I see most often is a vendor whose research team discovers evidence of an active intrusion at a third party, and the founder wants to go straight to a reporter with the story. That path, without the proper disclosure steps, risks legal exposure, harm to ongoing investigations, and a complete loss of trust with the security journalism community. The full framework for navigating that territory is in the cybersecurity breach crisis comms guide. Read it before you need it.
The economics of a research-led PR program
Research-led PR is not free, but it is one of the most capital-efficient earned media programs a cybersecurity vendor can run. You are not buying placements. You are investing in researcher time, report production, and the PR operator who packages and places the work.
The cost structure typically looks like this: your researchers produce the finding as part of their normal work; the PR layer is packaging, media training for the named researcher, building and maintaining journalist relationships on the relevant security desks, and running the embargo logistics. A fractional cybersecurity PR operator running that program costs $5,000 to $12,000 per month. A full agency running the same program costs $15,000 to $45,000 per month. The research itself, already produced, is the asset the operator is placing, not something they manufacture.
The return is coverage in outlets where a sponsored placement would cost $20,000 to $50,000 per article, with less credibility and a disclosure label that signals to readers it is paid content. Earned coverage from research compounds differently: it is cited by other journalists, picked up by aggregators, referenced in analyst reports, and increasingly cited by AI engines when buyers in your category ask who the credible vendors are. That compounding is why I treat research-led PR as the core of the cybersecurity PR program, not a nice-to-have add-on to a standard announcement cadence.
Frequently asked questions
Running a security research team with findings that deserve coverage? Start with cybersecurity PR for the full program, then read the cybersecurity PR guide for 2026 and the breach crisis comms playbook. The full playbook library covers pitch guides, pricing, and the earned media stack.