I’m not a wizard.
By that I mean I can’t give you a foolproof way to write perfect copy for a cybersecurity audience that’s guaranteed to convert (or at least get somebody moving into the next stage of your sales funnel).
But, I am somebody with a lot of experience. Somebody who’s made mistakes and assumptions. Who has believed myths and seen them dispelled in the results I got from the copy I wrote for a cybersecurity audience.
And it’s those mistakes – all made while working in the trenches of copywriting – that I’m going to share with you.
Avoid them, and you’ll make more sales.
They’re not.
That isn’t to say there aren’t some nuances (which we’re going to explore in the mistakes to come), but the tried-and-true customer research process works just as well for this audience as any other.
Interviews.
Surveys.
Message testing.
You still have to do all of that stuff because working from assumptions about what the cybersecurity audience wants means you usually end up failing to deliver.
When I first started writing content in this vertical, most of it was directed at people who already knew cybersecurity inside and out. Why? Because they were the people making the buying decisions for their companies.
But that isn’t the case anymore.
Over time, I realized more and more of the purchases being made off the back of my copy were coming from people who weren’t part of a cybersecurity team. Think developers for websites: they care about keeping their sites secure but they’re not in the industry.
The problem was I often wrote copy saying things like “this solution is going to decrease the back-and-forth between you and your developers.” That’s alienating – any developer who reads a line like that will assume the product isn’t for them.
So, you have to know exactly who’s buying your products or services.
Snyk does a great job of this. Head to their website and you’ll see a catchy headline:
“Developer loved, Security trusted.”
They know they’re writing for two audiences – one in cybersecurity and one focused on development – and that headline lets both know they’re in the right place.
When I first started working on cybersecurity content, I did so under an assumption: they’re all tech whizzes who dream in code. So just because something was confusing to me, that doesn’t mean it’ll be confusing to them.
But as I got deeper into the cybersecurity world, I discovered it was inundated with an absurd number of acronyms and technical language.
And frankly, the audience was getting sick of it.
This comes back to the second mistake in this list, because most of my audience simply didn’t know what those acronyms meant. Developers, directors, and executives were often involved in the purchases, and they didn’t want to wade through a ton of language they didn’t understand.
Keeping things simple solves this problem.
Use your homepage content and navigation bar to match your content to the level of expertise your audience has. Human and conversational is the key – almost every time I’ve tested that against tech, it wins.
This is the flipside of the equation.
You’ll make this mistake if you follow too closely the most common mantra in copywriting:
“Focus on benefits over features.”
I’m not saying that’s wrong. It’s absolutely true.
But even if your audience contains a healthy component of non-technical buyers, it also contains technical people. They know what they need, and they want you to explain how your product gets them the benefits.
They need facts. They want to see features. That more tech-oriented audience needs to know about the product’s specific capabilities so they can see if it works in the cybersecurity environment they’re creating. If you aren’t answering those questions, you have a large audience that won’t even go on a product demo because they don’t know what your product actually does.
To avoid this mistake, signpost the more technical side of your content on your website. Aquasec does a great job of this – they hit you with high-level content that most people can understand, but that content has links to the techy stuff for the audience that wants the technical information.
Also, make your technical documents easy to find. I recommend a repository page for every doc, along with links to relevant documents in product pages.
This is the one I’m most guilty of because (surprise!) I’m a marketer.
Writing like a marketer is a mistake because of an old idiom in the cybersecurity field: never trust, always verify.
In other words, cybersecurity buyers are skeptical realists. They’re often practical people, which means they’re not going to be taken in by the marketer’s attempt to differentiate their product.
Claiming your product is 100% secure is an example of this. Any cybersecurity professional worth their salt knows that probably isn’t the case, because any system can be broken if enough time and effort are put into cracking it. So the marketing content went to an extreme, and the reader’s skepticism antenna started tingling.
The problem is marketers using superlatives and absolutes for an audience that doesn’t work in absolutes.
A cybersecurity-minded audience craves honesty and transparency because they live in a world where nothing is foolproof. They know better. So, treat them that way – avoid absolutes like “100%,” “never,” and “guaranteed.” You’re trying to build credibility, which you can’t do when you’re using marketing speak that doesn’t gel with an audience full of realists.
When I started writing cybersecurity content, the only thing I knew for sure was “hackers are bad.” That assumption led me down the road of writing content that attacks hackers, only for me to make a discovery – not all hackers are bad.
There are ethical hackers (also known as “white-hat hackers”), for instance. They use their skills to test systems and identify security flaws, so they don’t want to be lumped into a category that demonizes them. I even discovered that some companies put out bounties, where they pay them to hack their system. They want the hackers to find flaws, because finding flaws is the first step to fixing them.
There are two things you can do to avoid this mistake.
The first is obvious: don’t make the hacker the villain of your piece. You can talk about vulnerabilities and “malicious parties,” but straight-up saying hackers are bad annoys a cybersecurity audience who knows this isn’t the case.
Secondly, keep away from the cliché hacking imagery. You know the type of images – a guy in a hoodie that hides his face tapping away at a laptop. These pictures give your content a sinister edge that sends out the “hackers are bad” messaging, turning many in your audience off.
Work in copywriting for long enough and you’ll learn that pain is a really good way to motivate people. We even have a framework for it – PAS (Problem, Agitation, Solution). The idea is you introduce a problem, agitate it by talking about how that problem can get worse, and position your product as the solution.
Simple.
But if you take that approach with cybersecurity content, you’re talking to an audience that is already well aware of the problems and agitations. It’s their job to know. By focusing on those problems, you’re fearmongering rather than speaking to them from their side of the table.
This doesn’t mean you don’t approach the problem in your copy. You do, but you do it in a more empathetic way. Maintain a more positive tone rather than turning your copy into something that feels like a political attack ad against the problems cybersecurity audiences face.
The main takeaway here is: writing solely for the technical side of cybersecurity means you alienate other buyers (developers and executives) who need solutions, but don’t understand all of the lingo.
That’s not to say you don’t get technical. Strike the balance between focusing on your product’s benefits, and what it actually does to maximize sales for your cybersecurity product.
Tip the scales too far in either direction and you either get copy that’s too technical for half of your audience, or so close to direct marketing that it turns off the skeptical cybersecurity buyer.
