Hard Numbers 📈

I've been thinking about trust in cybersecurity recently given that 95% of organisations report that they don't fully trust their cybersecurity vendors. Much of the industry's marketing has historically been built around a simple premise: if buyers better understand the risks they face, they'll be more likely to act. But as the market matures, I wonder whether that approach is becoming less effective as a source of differentiation. Walk the halls of Black Hat or Infosecurity and you'll see countless variations of the same story. Similar messaging, identities and narratives about threats, breaches and what's at stake. This tendency becomes particularly visible around Halloween, when many cyber brands embrace horror-themed creative. There's nothing inherently wrong with that, but it does raise an interesting question: if every brand is building urgency through fear, what actually creates differentiation? The recent reaction to the PHP vulnerabilities offers an interesting example. A flaw that reportedly existed in PHP for years has been thrust into the spotlight after AI-assisted research helped uncover it, prompting headlines about internet-scale risk and disruption. While the threat is real and organisations should act accordingly, the speed with which the conversation shifted towards worst-case scenarios highlights just how instinctively our industry still gravitates towards fear. At a time when buyers are becoming more sceptical and more rigorous in how they evaluate vendors, trust is emerging as a far more important factor in decision-making than many organisations realise. The companies building momentum are often the ones investing in customer advocacy, visible experts, transparent communications and evidence that supports their claims. In other words, they are making it easier for buyers to believe them. As competition intensifies, I suspect we'll see an increasing gap between organisations that compete on fear and those that compete on credibility, and for CMOs that's an interesting challenge. If everyone in the market can communicate risk, what are you doing to build trust? There are some interesting perspectives from marketing leaders in our Cyber Trust Report and I would seriously recommend a read: https://bit.ly/4wq7UWT

🛡️ Don't make it easy for them. That’s the message at the heart of Cybersecurity Awareness Month and it applies just as much to communications as it does to passwords, phishing attempts or technical controls. Because while organisations invest heavily in preventing cyber incidents, far fewer prepare for what happens after one. And that’s where reputations are won or lost. I hear the same thing from marketing leaders: “It’s not the breach that scares me, it’s losing control of the story.” Our latest Cyber Trust report shows that breaches don’t automatically destroy trust, but silence, confusion and slow communication do. The lesson from high‑profile incidents like M&S and ASOS is clear: When something goes wrong, transparency, accountability and timely communication can make all the difference. As communicators, our role is about not making it easy for fear, speculation and misinformation to fill the gaps. If you’re thinking about how your organisation would communicate during a cyber incident, downloading our report is a good place to start: https://bit.ly/4wq7UWT

How do you respond when a cyberattack becomes a push notification? Yesterday, ASOS customers woke up to a chilling message: ASOS HACKED. Hackers had reportedly gained access to the company's notification infrastructure and used it to send an extortion message directly to customers phones. There are lessons to be learned from both the breach itself and the response. As Joe Tidy reported, ASOS did not respond to media enquiries for more than five hours, instead prioritising communications with the stock exchange. In that time vacuum, speculation filled the gap, giving attackers the opportunity to shape the narrative. This is exactly what we highlight in our Hard Numbers 📈Cyber Trust Report. In a cyber incident, the technical breach is only half the story. The other half is trust, and that part is entirely in the organisation’s control. When organisations don't communicate, others do it for them. Social media accelerates fear, misinformation spreads and customers begin to question whether leadership is present or even aware of what’s happening. There's an important contrast with the M&S response to its recent breach: M&S moved quickly to acknowledge the incident, explain the actions being taken, and reassure customers, helping to stay ahead of the narrative rather than reacting to it. In doing so, they protected the trust they’ve built over decades. Cyber incidents are often viewed as technical events, but for customers they're trust events. Acknowledging what's happened and explaining how the situation is being managed can be just as important as containing the attack itself. Transparent communication is not a “nice to have” in a crisis, but a core component of cyber resilience. The companies that understand this will recover faster, retain customer confidence, and emerge stronger. The ones that don’t will find that the real damage isn’t caused by the breach itself, but by the silence that follows.

Most companies still measure thought leadership as a marketing vanity project, focusing on the metrics that get marketing and PR written off as a cost centre: article counts, downloads and clicks. That's what makes Workato decision to hire its first dedicated thought leadership employee and align them with sales rather than comms really stand out. Every PR has had that conversation with a CEO who sees marketing spend as overhead, but PR is 100% about value creation. Alex Lamascus from Workato summed it up perfectly when he said: "The primary value of content is not only gaining attention. It's building business infrastructure." Too many B2B companies churn out thought leadership that's really just repackaged trends and safe statements. It's content designed not to offend anyone, with no point of differentiation, which means it doesn't give buyers much reason to think differently either. The brands that win are the ones willing to say something meaningful and thought-provoking, that actually helps a buyer make a decision because it's rooted in expertise rather than marketing polish. Hard Numbers 📈Cyber Trust: The Next Growth Frontier found that 95% of organisations don't fully trust their cybersecurity vendors and in this high-stakes sector, trust is no longer just a brand metric; it's a procurement challenge. Buyers are sceptical, risk-conscious and largely immune to marketing fluff. To address this, thought leadership needs to be viewed as something that helps build trust throughout the buying process, rather than a cost centre measured solely by content outputs. Find the full report in the comments and drop me a message to see how we can help your brand build trust.

“GEO is just SEO” - it’s one of my favourite takes right now — because it shows how boxed in the SEO industry has become. Clients are asking about Generative Engine Optimisation, and getting the same answer: “you need more Search Engine Optimisation” The irony here is, of course, that the SEO industry is trying to tell clients they’re looking for the wrong thing… AI platforms don’t rank pages in the same way search engines do, so the thinking needs to be different. They cite sources. They recommend brands. They look at a broad range of inputs - which change often in terms of the frequency and importance of shaping results - which more broadly speak to the overall online reputation of a business. Which means the advantage shifts to those in the reputation management business, towards: 📈 Credible, high-authority content 📈 Positive media coverage 📈 Brands that have a consistent, positive reputation across as many touch points as possible. In other words - the balance has shifted to public relations management. At Hard Numbers 📈, we’ve been researching this for nearly two years, and both myself and Paul worked in the SEO industry before we started the business six years ago. Our work (with partners like Onclusive) consistently shows that brands with stronger positive media coverage are significantly more likely to be recommended by AI platforms. The opportunity for PR industry is that we’re not trying to retrofit an old product to a new problem. We can meet the “GEO need” head-on, and across all the channels that shape online reputation.

How do you spot a snake oil salesperson in the Generative Engine Optimisation space? In the last week alone, I've had approaches from more than ten companies offering to "help Hard Numbers rank / be found in AI search / Generative Engines / Generative Search / AI platforms" and one telling me that "to show on ChatGPT you need to publish content DAILY. Takes 4 hours to write an article, 30 mins using AI, but only 30 secs with [immediately forgettable product name redacted]". As Paul Stollery (he/him) often enjoys reminding me, I'm old enough to have worked through every major technological shift since the dot-com bubble, and I’ve seen the rise of SEO and social media marketing first-hand. That experience helps me to identify some of the traits that mark out those peddling snake oil, from those genuinely looking to help customers to understand the latest disruptive trend in marketing. Here's three tells that you're talking to someone who’s peddling snake oil, and may not be the right partner for you to speak to: 🐍 They talk in absolutes or claim to have "definitive" knowledge of this area. The claim that to show on ChatGPT "you have to publish content daily" is clearly, demonstrably tosh. Avoid anyone who makes definitive claims like this. 🐍 They say things like "no-one uses Google anymore" or "SEO is dead". I've got *5 trillion reasons* that Google is still rather an important channel for reaching your audience (that's the number of searches conducted on Google every year). SEO is NOT dead, and Google is STILL the dominant way that people seek information online. It's more the case that channels for those looking for information online are proliferating, and new search behaviours are being spawned... But that's another post... 🐍 They've not conducted their own research in this space, they just cite someone else's. At Hard Numbers 📈, we've done the hard yards. Back in 2024 we conducted the first research from a comms agency in the UK into what sources influenced ChatGPT, and since then we've published two more research papers in this space. We've won many client mandates for GEO audits and GEO work since as a result, and all that research, experience and expertise we pour back into our work and the content we put out. Snake oil salespeople in this space tend to just quote from other people's research. I could add a fourth - they rarely wear gilets. I don't make the rules. Clearly, the gilet is a mark, or indeed, a barometer of trust (hat-tip Karan Chadda and Maja Pawinska Sims for noticing) If I've missed any, let me know in the comments...