It is Tuesday morning. You are the CISO of a growing SaaS company, or the founder of a security startup, and you just finished a quarter that taught you something hard. Maybe your team cut incident response time in half by changing how on-call rotations work. Maybe you learned the expensive way that a security tool your board pushed for did not fit your environment. You think other security leaders should hear about it. CSO Online is where they would read it.
CSO Online, published by Foundry, the company formerly known as IDG Communications, covers security from the leader’s chair. Its stories focus on running security programs: risk, governance, staffing, budgets, vendor choices, regulation and the threats that drive them. If you want to know how to get featured in CSO Online, start by accepting that its readers are your peers, and that they will read you the way you read vendor pitches. Skeptically.
Know who CSO Online is written for
The core reader is a security leader responsible for a program, a team and a budget. That might be a CISO at a large enterprise, a director of security at a mid-sized company or a head of security at a startup who also handles IT. They read to make decisions. Should we restructure the security operations center? How do we report cyber risk to the board? What are other companies doing about third-party risk? Which tools are worth the money?
That focus separates CSO Online from publications aimed at hands-on researchers, and it shapes how to get featured in CSO Online more than anything else. A deep technical write-up of a new exploit technique may suit a research-heavy outlet better. CSO Online readers want to know what that technique means for their risk, their priorities and their budget. Technical depth is welcome when it serves a leadership decision.
The tone follows from the audience. Security leaders are busy, well informed and tired of hype. Many of them have sat through dozens of vendor briefings that promised the same outcomes, and they can spot a recycled message in the first sentence. They value candor about failures, specific numbers and advice that acknowledges trade-offs. They do not value fear, superlatives or vague calls to action.
How CSO Online sources experts
CSO Online stories rely on several kinds of sources. Security leaders at user organizations describe what they did and what they learned. Analysts provide market context and survey data. Researchers explain threats and vulnerabilities. Lawyers and compliance experts explain regulation. Vendor experts appear too, when they bring something the other sources cannot: data across many customers, deep technical knowledge or a candid view of how a market works.
Writers on security leadership topics often do multi-source features. A piece on board reporting might quote five CISOs, an analyst and a governance expert. That is good news for anyone pitching, because it means a writer can use your input even if you are not the main subject. You need one useful insight, delivered clearly, from someone with credible experience.
Muck Rack’s State of Journalism 2026 found 58 percent of journalists value interview access to relevant sources, and 70 percent named clear relevance to their beat as what they value most. Your job is to offer a relevant source with a specific, useful perspective on something the writer is likely to cover.
The CISO Peer Test
Before pitching CSO Online, put your idea through what we call the CISO Peer Test. Imagine you are presenting the idea at a closed-door roundtable of ten security leaders, with no press, no vendors and no marketing in the room. Then ask three questions.
Would the room find it new? If every leader there already knows it, it will not interest CSO Online readers either. “Security awareness training matters” fails. “We cut phishing click rates by changing who sends the simulated phish, and here are the numbers” might pass.
Would the room find it credible? Credibility comes from experience and evidence. Did you or your source do this, measure it and see the results? Is there data, and can you explain how it was collected?
Would the room find it useful? Could a leader take the idea back to their team on Monday and act on it? Ideas that end with a decision or a change in practice pass. Ideas that end with “it depends” do not, unless you explain what it depends on.
Here is the test applied to a real-world style idea. “Zero trust is a journey, not a destination” fails on all three counts. Every leader in the room has heard it. Now consider: “We rolled out device posture checks to 2,000 laptops in six weeks, and the hardest part was not the technology. It was the 140 executives who had exceptions nobody had documented. Here is how we handled it.” That version is new, because it names a specific obstacle. It is credible, because it comes with scale and a timeline. And it is useful, because every leader in the room has executives with undocumented exceptions. Swap in your own facts, but keep that shape.
An idea that passes all three is worth pitching. An idea that passes one or two needs more work. And an idea that only passes because your product is involved will fail the test as soon as you imagine a roomful of CISOs hearing it.
Five things CSO Online editors want
Put the test and the audience together and five things come up again and again in what security leadership editors look for.
The first is experience over opinion. A CISO describing a decision, its cost and its result beats a commentator sharing views. If you are a vendor, find the experience inside your company. Many security vendors employ former CISOs and practitioners. Let them speak from their time running programs, not from their current job selling them.
The second is numbers with context. Readers want to know how much, how fast, how often and compared with what. If you cite a metric, explain how it was measured. Muck Rack’s survey found 40 percent of journalists value original data or research. In security, data across many organizations, such as how long incidents take to detect or how often certain controls fail, can anchor a strong story.
The third is honesty about failure. Security leaders learn more from mistakes than from success stories. A source willing to say “we got this wrong, and here is what it cost” is rare and valuable. You do not need to share confidential details. You need to share the lesson.
The fourth is speed and availability. Security news breaks fast. When a major breach, vulnerability or regulatory change hits, writers need sources within hours. If you can offer an expert who will respond the same day with a clear, quotable perspective, you become someone writers return to.
The fifth is no promotion. This is the rule vendor pitches break most often. Do not name your product in your insight. Do not frame your company’s approach as the answer. Do not ask for a link. Editors will cut it, and they will remember that you tried.
Keep the pitch itself short. Sixty-nine percent of journalists in the Muck Rack survey prefer pitches under 200 words, and 62 percent prefer a one-to-one email. Name the topic, state the insight in one sentence, give two sentences on the source’s experience and offer a time to talk.
A 30-day plan to earn your first mention
If you want to get featured in CSO Online and have not been before, give yourself a month and work in four steps.
In the first week, read. Go through the last two months of CSO Online coverage. Note which writers cover the topics you know best, which sources they quote and which questions they keep returning to. Build a short list of three writers whose coverage overlaps with your expertise.
In the second week, prepare. Choose one source, yourself or a colleague, and write down three specific insights they could share, each passing the CISO Peer Test. Gather any data that supports them, with a clear note on how it was collected. Prepare a short bio that shows real experience: programs run, teams built, incidents handled.
In the third week, pitch. Send one short, personal email to the writer whose recent work best matches your strongest insight. Reference a recent piece they wrote and explain how your insight adds to it. Send it before noon, which 78 percent of journalists prefer. Offer the source for a call that week.
Before you send, ask a colleague who has not seen the pitch to read it in thirty seconds and tell you the insight in one sentence. If they cannot, rewrite it. Writers at a security leadership publication read the same way.
In the fourth week, follow up and stay ready. If you have not heard back, send one short follow-up with a new detail. Then shift to rapid response. Watch the security news, and when a story breaks in your area, send the relevant writer a two-sentence note offering your source’s perspective. Many first mentions come this way, because a writer on deadline needs a credible voice fast.
Expect the plan to take longer than 30 days in some cases. Writers may be working on long features that will not publish for weeks, and your source may be quoted in a story that runs well after your interview. That is normal. Keep a simple log of pitches, replies and interviews so you can see the pattern over a quarter rather than judging success by a single month.
After the first mention, keep the relationship going without asking for anything. Share useful observations, point writers to good sources and respond quickly when they reach out. A security leader or vendor expert who helps writers do their jobs well will be quoted again. That is the long answer to how to get featured in CSO Online: become useful before you become visible. Over a year, that steady presence in the publication your peers read will do more for your credibility than any campaign.