If you are working out how to get featured in Dark Reading, the fastest way is to bring the publication something its readers cannot get anywhere else: original security research with a clear method, a finding that holds up under scrutiny, and a researcher who can explain it plainly. Commentary from experienced practitioners is a second route. Product announcements, however they are framed, are not a route at all.
Dark Reading has covered cybersecurity for security professionals for years and is now part of Informa TechTarget. Its readers include security analysts, engineers, architects, CISOs and the IT leaders who work with them. They read it to learn about new threats, new vulnerabilities, new research and how other defenders are handling the same problems. They are also some of the most skeptical readers in technology media. That skepticism is the main thing to plan around.
What Dark Reading readers want
Security professionals read for three things. They want to know what attackers are doing now, so they can check whether their defenses would catch it. They want to know about weaknesses in software and systems they use, so they can patch or mitigate. And they want to learn from peers about running security programs: staffing, budgets, tooling decisions and incident response.
Every story in Dark Reading serves one of those needs. A news piece on a new ransomware campaign serves the first. Coverage of a vulnerability disclosure serves the second. A commentary piece on how a CISO restructured a security operations team serves the third. If your pitch does not fit one of these, it is not a fit for the publication.
This audience also knows the vendor playbook. Security vendors publish a steady stream of reports, many of which are thin surveys designed to generate leads. Readers have learned to discount them. So have editors. Your work has to rise above that background noise, and the way to do that is evidence.
Three doors into Dark Reading
There are three practical ways to appear in Dark Reading, and each needs a different kind of preparation.
The first door is research coverage. If your team has found a new vulnerability, tracked a threat actor, analyzed a malware family or collected data on attacker behavior, that can become news. This is the most valuable route because the coverage is about your findings, and your company is named as the source.
The second door is expert sourcing. Reporters covering breaches, new threats and policy changes need experts who can explain what happened and what defenders should do. If your researchers or executives can respond fast and speak with technical precision, they can become regular sources.
The third door is commentary. Practitioners and experts can write pieces that share a point of view, a lesson or a technique. Commentary gives you a byline and room to make an argument, but it has strict rules. Product promotion will be cut, and pieces that read as marketing will be rejected.
Each door also has its own timing. Research coverage follows your release schedule, so you control it. Expert sourcing follows the news, so you have to be ready on short notice. Commentary follows the editor’s calendar and can take weeks from pitch to publication. A security company that plans for all three, with a research calendar, an on-call list of experts and one or two commentary ideas in reserve, will appear more often than one that waits for a big announcement.
Anyone serious about how to get featured in Dark Reading should plan for all three doors. Most security companies try the third door first because it seems easiest. It is not. The first two doors usually produce more credibility, and they build the relationship that makes commentary easier to place later.
The Breach-Proof Pitch Standard
Before you pitch research to Dark Reading, check it against a four-part standard we call the Breach-Proof Pitch Standard. The name is a reminder that your pitch will be read by people who look for weaknesses for a living. If the research cannot survive that reading, it is not ready.
Part one is method. Can you explain how the research was done in two or three sentences? If not, the reporter cannot describe it well, and nobody else will trust it. How many samples, systems or events did you analyze? Over what period? Using what tools or techniques? A reporter needs this to describe your work with accuracy and to judge whether it is credible. If your method is “we surveyed 200 IT professionals through a panel provider,” say so, and understand that it carries less weight than analysis of real attack data.
Part two is verification. Can someone outside your company check the core finding? For vulnerabilities, that might mean a CVE identifier, a vendor advisory or a proof of concept shared with the reporter under embargo. For threat intelligence, it might mean indicators of compromise that other researchers can match. Findings that can only be taken on trust will get far less coverage.
Part three is disclosure. If the research involves a vulnerability in someone else’s product, have you followed responsible disclosure? Has the vendor been notified, and have they had reasonable time to fix it? Reporters at reputable security publications will ask. A pitch that skips disclosure will raise ethical concerns and can damage your reputation in the community.
Part four is defender value. What should a reader do differently after reading the story? Patch a specific version, hunt for specific indicators, change a configuration, rethink a policy. Research without a defender takeaway is interesting. Research with one is useful, and useful research gets covered.
If your research meets all four parts, write a short pitch that leads with the finding and the defender takeaway, then summarizes the method and verification. Offer the researcher for an interview. Muck Rack’s State of Journalism 2026 found that 58 percent of journalists value interview access to relevant sources and 40 percent value original data or research. In security media, those two together are the core of a strong pitch.
Commentary pieces that survive editing
If you go the commentary route, write from experience. The strongest pieces describe something the author did, saw or learned, and explain what it means for other defenders. A CISO describing how her team cut alert fatigue by reworking detection rules will interest readers. A vendor executive describing the general importance of reducing alert fatigue will not.
Start with a specific situation. The opening paragraph should describe a problem readers recognize, such as an incident, a failed tool rollout or a budget fight. The body should explain what the author tried, what worked, what did not and why. The ending should give readers a step they can take.
Use exact technical language where it matters and plain language everywhere else. Security readers will notice if you misuse a term. They will also notice if you hide a simple idea behind jargon.
Keep the vendor out. Do not name your product, do not describe your company’s approach as the solution, and do not end with a call to action. An editor will remove these, and their presence suggests you have not read the publication’s commentary section with care. If your expertise is real, readers will look you up.
Check the current guidelines for length, format and submission process before you write. Policies at publications change, and following them precisely is the first test of whether you will be easy to work with.
Research is the strongest currency
For a security company, original research is the most reliable route into Dark Reading and the wider security press. It also has value beyond coverage. Good research attracts talent, builds trust with customers, and gives sales teams something credible to share.
Build a small, steady research practice rather than one big annual report. If you are a young company without a research team, start with what you already see. A managed security provider sees attack patterns across its clients. An identity vendor sees authentication failures. A backup company sees ransomware recovery times. Anonymized and aggregated with care, that operational view can become a credible quarterly finding. The point of learning how to get featured in Dark Reading this way is that the coverage builds on itself: each solid finding makes the next pitch easier to read. A threat intelligence team that publishes a solid finding every month or two becomes a source reporters check with when something breaks. A vulnerability research team that discloses responsibly and explains its work clearly earns respect that marketing cannot buy.
Time your releases well. Security news moves fast, and a finding connected to an active campaign or a widely used product will get attention quicker than one with no current hook. Offer reporters an embargoed briefing when you can, so they have time to verify and write a careful story. Respect the embargo and the reporter’s decision about whether to cover it.
When a breach or major vulnerability hits the news, be ready to comment fast. Have a short list of experts who can speak to different areas, with backgrounds the reporter can verify. A reporter on deadline will remember who answered a question clearly within an hour.
What gets you ignored
A few habits will get your pitches ignored, and they are common in security marketing. Surveys with small or unclear samples presented as major findings are the first. Readers and editors have seen too many of them. If you run a survey, be transparent about the sample, and treat it as context rather than headline news.
Fear-driven framing is the second. Pitches that warn of catastrophe without evidence, or that inflate a minor issue, damage your credibility. Security professionals deal with real risk every day and are tired of hype.
Product launches framed as research are the third. A feature announcement with a few statistics attached is still a product announcement. Editors will treat it that way.
Mass pitches are the fourth. Sixty-two percent of journalists prefer a one-to-one email, according to the same Muck Rack survey, and security reporters are no exception. Read the reporter’s recent work and pitch only stories that match it.
A last note on tone. Security editors notice when a researcher writes about attackers with admiration or when a vendor writes about victims with contempt. Neither plays well. Describe threats with precision and describe affected organizations with respect, since some of your readers have been in their position.
The security companies that appear in Dark Reading over and over have one thing in common. They bring evidence, they explain it plainly, and they put defenders ahead of their own marketing. Do that consistently and the coverage follows.