A cybersecurity PR agency earns coverage in security trade press and mainstream tech media for vendors, researchers and platforms. It is harder than general B2B PR for one reason: security reporters receive more vendor pitches per breach cycle than almost any other beat, and most of that mail says nothing they cannot already get from a vendor blog. The pitches that work supply something the reporter cannot obtain elsewhere — original telemetry, a named researcher, or a customer willing to describe an incident on record.
This page covers what security reporters respond to and the questions to ask an agency before you hire one.
Why is cybersecurity PR harder than other B2B categories?
Three structural reasons, none of which an agency can charm its way around.
The news is already written. When a major breach lands, every security reporter is already filing. Your pitch is not competing for attention against other vendors — it is competing against the story they are mid-way through writing.
Vendor commentary is commoditised. Dozens of firms send near-identical "our CISO can comment on the X breach" emails within hours. Reporters have learned to ignore the format entirely.
Claims need substantiation. A security reporter who prints an unverified number gets corrected publicly by people who enjoy correcting things. They are appropriately sceptical, and the burden of proof sits with you.
"Security reporters get pitched more than almost any beat, and most of it is vendor noise around a breach they're already writing about. The ones who answer us are the ones we gave something they couldn't get from the vendor's blog."
Justin Mauldin, Founder, Salient PR
What reply rate is realistic in cybersecurity PR?
Our reply rate between December 2025 and August 2026 was not evenly distributed. Our technical, infrastructure-adjacent programmes run materially higher than our consumer work:
| Company shape | Contacted | Open rate | Response rate |
|---|---|---|---|
| Established name, category past its news cycle | 269 | 54.5% | 11.4% |
| Pre-revenue, launching into a category the press doesn't cover yet | 351 | 54.3% | 10.6% |
| Late stage, recognised founder, crowded category | 700 | 48.3% | 8.5% |
| Market leader in a vertical with specialist trade press | 494 | 47.9% | 8.2% |
Every response, auto-replies included, across the four programmes we could classify this way.
How far the funnel actually gets
Of every 100 pitches delivered, 51 register as opened.
That 51% understates it, and the reason is structural. A tracking pixel only records an open if the recipient's email client loads remote images, and a large share never do. Thunderbird, HEY and Mimestream block by default, and Proton Mail routes images through a proxy that loads them without revealing the reader, and journalists are a plausibly heavy user base for privacy-first clients.
There is a circularity worth knowing about: email client market share is itself measured by tracking pixels, so clients that block the pixel are invisible to the statistics people use to size the problem. Litmus notes this in its own methodology.
So we work on roughly 7 in 10 rather than 51%. That is our estimate and not a measurement — every blocked pixel is a read nobody counted, which makes the recorded rate a floor. We would rather say where the number comes from than dress it up as measured.
We also see it directly, which is why we are comfortable saying it: replies arrive from people the outreach tool records as never having opened the email. That is only possible if the pixel never fired.
Between December 2025 and August 2026 we also recorded a 1.0% bounce rate and zero unsubscribes.
"Our recorded open rate is 51%. The real number is closer to 7 in 10, because a big share of reporters read mail in clients that block tracking pixels. We know it happens because we get replies from people our system says never opened the email. Treat any open rate you're quoted as a floor, including ours."
Justin Mauldin, Founder, Salient PR
Follow-ups do less than you think
| Sequence step | Delivered | Open rate | Reply rate | Replies |
|---|---|---|---|---|
| First email | 2,063 | 47.6% | 6.0% | 124 |
| Follow-up 1 | 1,576 | 37.4% | 3.7% | 59 |
| Follow-up 2 | 69 | 40.6% | 4.3% | 3 |
Two-thirds of every reply came from the first email. The follow-up is opened ten percentage points less often and replied to at little over half the rate. Most cold-email advice treats the sequence as where results come from; on a journalist list, the first email does the work.
"One follow-up, and it has to add something. If the second email is just 'bumping this up,' you've told them the first one wasn't worth reading either."
Lindsey Ranger, Account Lead, Salient PR
What do security reporters actually respond to?
From our own reply logs, the pitches that got answers had one of four things in them.
1. Original data from your own telemetry. Not a survey you commissioned. Numbers that come out of your product because of what it observes. This is the single strongest asset a security vendor has and most never publish it.
2. A named researcher who will talk. Not a CISO with a prepared statement — the person who actually found the thing, available for 20 minutes.
3. A customer who will describe what happened. Rare, difficult, and worth more than everything else combined.
4. A position someone will actually disagree with. "Most MDR is repackaged alerting" is a story. "We take security seriously" is not.
"The pitches that get answered give the reporter something they can't get from the press release. A number, a customer who'll talk, a person who'll say the uncomfortable thing on record."
Lindsey Ranger, Account Lead, Salient PR
What happens after a security reporter replies?
Across 175 replies Woodpecker graded in our database:
| Grade | Count | Share |
|---|---|---|
| Interested — yes | 110 | 63% |
| Maybe | 31 | 18% |
| Not interested | 34 | 19% |
Nearly two in three graded replies are positive. The implication for security specifically: your problem is almost never that reporters dislike your story. It is that they never got far enough into the email to have an opinion.
Should you pitch during someone else's breach?
Usually not, and this is where most security PR goes wrong.
Reactive commentary works in a narrow set of conditions: you have genuinely relevant telemetry about the specific attack, you can supply it within hours rather than days, and your spokesperson will say something more specific than "this highlights the importance of defence in depth."
Absent all three, sending it costs you more than it earns. Reporters remember which firms send noise during a crisis, and the cost is paid on the pitch you actually cared about three months later.
How Salient engages
We ask for a six-month commitment to start, because the first two months are relationship building and judging the work before then tells you nothing. After that there is a 30-day exit, no questions asked, either side. If it is not working we would both rather know.
How do you judge a cybersecurity PR agency?
Ask which security reporters they have placed in the last six months, by name. The security press is small enough that this is a checkable claim.
Ask what they will do with your telemetry. An agency that does not immediately ask what data your product sees is not going to build you a research programme, and research is the most durable asset in this category.
Ask how they handle embargoes. Security research runs on embargoes and coordinated disclosure. An agency that has never managed one will break one.
Ask for reply rates in security specifically, not a company-wide average.
"Ask for the last 20 pitches they sent in your category and what came back. Not case studies, not a logo wall. The actual sends. If they can't produce that, they aren't measuring, and you'll find out in month four."
Justin Mauldin, Founder, Salient PR
Does AI search change cybersecurity PR?
Less than in other categories, and in a way that favours vendors with real data.
"Cybersecurity pr agency" carries a Google AI Overview, like most commercial queries we track. Across the 180 keywords we checked in August 2026, click-through ran about 10% lower where an overview was present — a real gap, but a far smaller one than the figures usually quoted. Security buyers still click through to read.
Where AI does matter is citation. A peer-reviewed study of generative-engine optimisation (KDD 2024) found that adding direct quotations, statistics and cited sources measurably improved how often a page was surfaced in generative answers — by up to 40% on the authors' benchmark, with the size of the effect varying by subject area. For a security vendor, that maps exactly onto publishing your own telemetry with a named researcher attached. The firms that publish original numbers get cited when someone asks an AI which vendors matter. The firms that publish thought leadership do not.
The short version
- Security is the most over-pitched beat in B2B. Volume is not your problem; substance is.
- Expect 8–11% reply rates.
- When reporters do reply, 63% is a yes. Getting read is the constraint.
- Original telemetry beats commentary every time.
- Do not pitch into someone else's breach unless you have something specific and can move within hours.
Salient PR runs cybersecurity and infrastructure PR programmes. All outreach figures on this page come from our own database covering December 2025 to August 2026 and are updated quarterly.
Sources
- Salient PR outreach database, Dec 2025 – Aug 2026
- Ahrefs SERP feature data, 180 keywords, August 2026
- Aggarwal et al., GEO: Generative Engine Optimization, KDD
If you want this run by people who do it every day — Salient PR is a technology PR agency working with security companies. See how we work or start a conversation.
Related reading
About Salient PR
Salient is a B2B tech PR agency. We help startups become the story — landing tier-one coverage, building executive visibility, and turning attention into pipeline.
Senior team. No hand-offs. Radical transparency. If you’re ready to talk, reach out.
How security reporters filter vendor noise, what makes a breach pitch answerable, and the reply-rate data behind it.
