Security is the only category where the public relations retainer has to cover both the good times and a potential incident, and where the second scenario can arrive with no notice and a regulatory clock already running. An agency chosen purely on its ability to place vendor commentary will be the agency you are calling at two in the morning. That is the test worth applying when you choose one.
Routine visibility in security is mostly research and commentary
Security media is saturated with vendor announcements and starved of original work. Threat research, incident data drawn from your own telemetry and genuinely expert commentary on a breaking story are the three things that reliably earn attention, and only the third can be done at short notice. An agency's value here is largely in its ability to get your expert quoted while a story is live, which is a function of relationships and response speed rather than writing quality.
Commenting on somebody else's breach carries real risk
Newsjacking an incident is the fastest route to coverage in this category and the fastest route to being the vendor everyone remembers for opportunism. Agree a standard in advance: comment on the class of vulnerability, not on the victim's competence; never claim your product would have prevented something you cannot know; never speculate on attribution. Write it down, because the decision will be made under time pressure.
Disclosure obligations sit behind the communications plan
For public companies, cybersecurity disclosure is regulated: Regulation S-K item 106 requires disclosure of risk management, strategy and governance for cybersecurity, and material incidents carry their own reporting duties. Communications and disclosure are not the same workstream, but they must not contradict each other. The agency needs to know who owns disclosure internally and that nothing goes out ahead of it.
The incident plan has to exist before the incident
Ask any agency you are considering to describe what it does in the first two hours of a client incident. The answer should include who it wakes, what it does not say, how it coordinates with counsel and the incident response firm, and what the holding statement looks like. Then ask for the holding statement template. If the agency has to write one for the pitch, it has not done this before.
Coordinated disclosure is a communications event too
If your researchers find flaws in other people's products, the disclosure timeline is a communications plan as much as a technical one: who is told, when, what is published and what is withheld. Getting this wrong damages relationships with vendors and researchers that take years to build. An agency working in this category should be comfortable with the norms of coordinated vulnerability disclosure and should not be pushing for publication ahead of them.
Questions people ask about cybersecurity pr
Should we retain a separate crisis firm?
Many companies do, and the argument for it is specialist depth under pressure. The argument against is that a firm meeting you for the first time during an incident lacks the context that makes advice useful. A common middle path is one agency with a named crisis lead who is briefed annually and included in tabletop exercises, so the relationship exists before it is needed.
What does cybersecurity PR cost?
It is retainer based like other B2B PR, typically with a premium for the sector specialism and sometimes a separate arrangement or hourly rate for incident support outside the retainer. Get the incident terms written down at signing, because negotiating them during an incident is the worst possible moment to discover they were never agreed.
Can PR help with a breach that is already public?
It can help you communicate clearly and consistently, coordinate with counsel and avoid the second story that follows a badly handled first one. It cannot make the incident go away, and an agency promising reputation repair through content or suppression is selling something you should not buy.
Is threat research worth funding for PR reasons?
Often yes, because it is the one thing in this category that reliably earns coverage and citation rather than buying it, and it doubles as product credibility. Fund it as research with communications attached, not as content marketing with a security theme, because the audience can tell the difference immediately.