When it comes to case studies, cybersecurity poses special challenges.
The cybersecurity landscape is saturated with solutions—and so sales and marketing teams have never been hungrier for customer success stories they can share as proof of their product’s abilities.
But cybersecurity clients are very reluctant to be featured. They don’t want to talk about the time they almost got hacked, they don’t want to disclose the details of their setup and risk more attacks, and they just plain don’t want to risk looking bad.
To top it all off, the cybersecurity space is highly technical. It’s easy to derail a powerful story by burying it under a load of technical jargon and details.
Let’s take a look at some of the biggest challenges cybersecurity companies face when they’re trying to produce case studies—and the solutions we’ve developed to make those studies happen.
Challenge 1: No one wants to admit to an attack or prior vulnerability
We hear about cybersecurity disasters in the news all the time. Giant ransomware attacks and breaches affecting millions of customers are sadly common.
But the success stories? The attacks stopped, the leaks prevented? We never hear about those.
Companies don’t want to draw attention to breaches that almost happened. It can erode trust and make customers think they’re targets. There’s no reason to put that idea into their minds, especially over an attack that failed. No data was lost, so why advertise the fact that there was an attack at all? It’s scary. Companies prefer to play it safe and decline to be featured.
On top of all that, no one wants to dive into the details of their setup and the security measures they’ve put in place—there’s too much risk of accidentally divulging something that hackers can use for their next attack.
If you can get a cybersecurity customer to agree to feature in your story, you’ll see this play out in real-time: the stories they’re likely to tell are all about how proactive their company is and everything they’ve put in place to avoid the possibility of a data breach. “Look how safe we are!” those stories will tell you. But safe stories don’t often make for interesting reading material.
Don’t get me wrong, these stories serve a valuable purpose. If you want to feature your customer’s logo, you have to compromise on the content to get your customer’s approval.
But if you want to go into detail about how your solution helped prevent a serious cyberattack, there’s a much better option.
The Solution? Anonymous case studies
Anonymous case studies are common in cybersecurity, even more so than in other fields. We’ve made the case before for the value of anonymous case studies, and how to do them well.
Do you want to hear a real hot take on anonymous case studies?
When it comes to cybersecurity companies, anonymous case studies aren’t only acceptable. They’re often better.
That’s right: we’re saying that anonymous cybersecurity case studies are often better than named studies.
Anonymous cybersecurity case studies are often better than named studies.
A reluctant client who doesn’t want to scare their customers with news of a near miss will be much more likely to agree to an anonymous case study. You’ll be able to go into all of the juicy details, and the story will be much more compelling than a named case study with the same company would have been.
And they’ll be able to protect themselves and their reputation.
An anonymous case study lets your customer save face. They can tell a more honest story about a time that something went wrong because their name and reputation aren’t attached to it. The stories you get will be much more specific and exciting to read.
As our story lead, Steven Peters, puts it: “Everybody loves an eye-catching logo. But the caveat is that big brands don’t want their name attached to major problems—especially when it comes to compliance issues (or worse) a data breach! Sometimes, you want the logo at all costs. But other times, it’s better to drop the logo in favor of a more compelling and specific story.”
Sharing (anonymously) is caring
There’s another less obvious point in favor of anonymous case studies: they show care for your clients.
By forgoing that flashy logo, you’re showing your clients that you prioritize them and their comfort over your marketing. It helps deepen those relationships you’ve worked so hard to build and it validates the trust they’ve put into working with you.
Challenge 2: The biggest win is “and then nothing happened”
When it comes to cybersecurity case studies, your biggest win is preventing something bad from happening: the crisis was averted, the attack failed, the status quo was maintained. Nothing happened. Big yawn, amirite? It’s hard to make a story about nothing interesting.
It’s even harder to find compelling metrics, especially when those metrics boil down to “we had 0 problems”. You can’t prove a negative.
Even if there are metrics to share, customers can be reluctant to share those numbers, sometimes even in anonymous case studies.
There are lots of ways to make a metric-less story shine.
For cybersecurity case studies, the most important is to focus on the human element.
The solution? Focus on the human element
Most case studies tell a company story: Company A had a problem, and Company B’s solution helped solve that problem. For cybersecurity case studies, this approach doesn’t always work. Legal departments are sensitive, and without metrics or a compelling headline a story that boils down to “this attack didn’t succeed” is going to fall a bit flat.
But telling the story of a brave CISO or IT lead who faced a deadly challenge (or ransomware attack) and was able to vanquish their foe, armed with your cybersecurity solution? That’s the stuff heroes’ journeys are made of.
The best and most tension-filled cybersecurity stories often focus on one individual (or team), what they faced—and what they overcame.
The best and most tension-filled cybersecurity stories often focus on one individual (or team), what they were facing, and what they overcame. For a CISO, the cost of a successful breach will be especially high, and their role in preventing it is much more active and ongoing.
Focusing on one person can also help smooth things over with the legal team, since the story isn’t told from the point of view of “The Company” (and yes, you should always get your customer’s approval before publishing, even for anonymous stories).
Challenge 3: Everybody’s cybersecurity setup looks different
For highly technical industries, it usually feels important to dive into the nitty-gritty of the solution and the technical attributes that made the win possible. But that’s tricky to do for cybersecurity solutions because 1. Everyone’s environment and gap is slightly different, and 2. Most companies are reluctant to divulge the details of their setup, lest they accidentally expose themselves to attacks or reveal identifiable information.
On top of that, cybersecurity threats come and go: the ransomware attack that everyone is worried about this year will be irrelevant in six months, and new technologies like AI can dramatically change the landscape. Cybersecurity is a fast-moving field, and stories that get too in the weeds on a specific solution will have a much shorter shelf life.
Cybersecurity solutions are complex, with a lot of different features and a lot of different, often customizable ways to solve enterprise security. It can be hard to find common ground between different solutions, so it’s harder for readers to identify with the solution described in your case study, especially if you go all-in on the technical jargon.
The solution? Wait for it…
Before we dive into the solution for this one, let me mention a slightly different, but related, challenge:
Challenge 4: Cybersecurity is technical, but your readers aren’t necessarily
For cybersecurity case studies, you’ll almost always interview technical experts like CISOs, IT leads, etc.
And those people will read your studies too. But at the end of the day, cybersecurity solutions are expensive, and it’s not the technical people holding the purse strings or making the final decision on the purchase. You need to produce stories that persuade non-technical C-suite executives, too.
That means that you can’t lean too far into the technical jargon to make your solution stand out, or you risk losing the readers you most need to win over.
As our Cybersecurity AWS Report shows, too many companies pack their studies with so many obscure terms and complicated phrases that they become unreadable. Write how you speak, and aim for Grade 9 reading level.
Challenge 3 and Challenge 4 are related because they both make it hard to frame your case study. You don’t know exactly who you’re writing for or how technical their background is, and your reader probably has a different security setup than the one you’re writing about.
They both make it hard to relate to the story you’re telling.
Luckily, both of these problems also share a solution.
The Solution? Find the common ground in the challenges
With so many different variables to consider, what’s the best way to write a story that will resonate with your target audience and have genuine staying power? Tell stories that address the common challenges that resonate across the industry.
In our tenure, we have written over 100 cybersecurity-related case studies. And throughout all of them, the same challenges crop up time and time again:
- Compliance
Every company needs to worry about compliance, whether it’s meeting the requirements of the GDPR or CCPA, complying with HIPAA, or meeting any of the other increasingly strict data protection regulations that governments are passing every year. So leaning into that challenge is a really effective way to find common ground with your readers. Demonstrating the ability to implement these strict controls and adapt to changing regulations is a great way to prove the value of a cybersecurity solution.
- Hiring and retaining talent
There’s a well-known talent shortage in the cybersecurity industry—it’s one of the key “Strategic Planning Assumptions” in Gartner’s 2023 Predictions. Hiring and retaining talent is a concern, and lots of cybersecurity professionals are experiencing burnout. An effective case study can demonstrate how it helps fill that gap (by lessening the workload and reducing the need for headcount) to reduce the stress and uncertainty that an unexpected departure or unfilled role can cause.
- Human error
Human error remains a major point of weakness in cybersecurity. The best security can be foiled if the wrong person gives away their password, and most cybersecurity solutions are working to make sure that can’t happen. Telling a compelling story about how your product can minimize the risk of human error is a great way to write about a universal problem.
Cybersecurity case studies come with challenges—but don’t let that stop you
You just have to understand their unique challenges and know how to tackle them.
Unsure where to start? Luckily, we can help. We’ve written hundreds of cybersecurity case studies, and we know how to make them invaluable for your sales and marketing teams.
Get in touch to see how we can help you with your cybersecurity case studies.