Cybersecurity incidents are no longer rare, isolated events. As organisations face growing threats from data breaches, ransomware and other cyberattacks, reputation is increasingly shaped long before a crisis occurs. From media engagement and thought leadership to stakeholder trust and organisational preparedness, communications can play a critical role in building credibility before a breach makes headlines.
Telum Media spoke with Oliver Ellerton, Director at Ellerton & Co. Public Relations, about the reputational challenges of cyber incidents, the value of pre-crisis credibility, and how communicators can help strengthen organisational resilience.
Cyberattacks and data breaches have become a recurring headline globally. From a communications standpoint, what makes cybersecurity incidents particularly challenging for organisations to manage in terms of reputation?
Security breaches are no longer a question of “if”, but “when”. For communicators, the challenge is not whether a cyber crisis will happen, but whether they are prepared to respond when it does.
A few things make cyber incidents different from most crises. The first is speed - or more accurately, the gap between when a breach occurs and when it is detected. According to IBM's Cost of a Data Breach Report 2024, organisations take an average of 258 days to identify and contain a breach. By the time communications begins, the organisation is often already on the back foot.
The second challenge is technical complexity. Most organisations struggle to explain what has happened in a way that is both accurate and accessible. The result is often either vague statements that say very little, or overly technical explanations that confuse rather than clarify.
There is also a stakeholder challenge. A breach can affect customers, partners, regulators, employees, and investors simultaneously - each with different expectations. Messaging that reassures one group can raise concerns for another, making it difficult to strike the right balance under pressure.
The regional dimension adds another layer. Asia was the most attacked region globally in 2024, accounting for 34 per cent of all incidents investigated according to IBM's X-Force Threat Intelligence Index. However, the approach to disclosure varies widely across markets. That gap between legal obligation and actual practice can itself become a reputational risk.
What does “pre-crisis credibility” look like in the context of cybersecurity communications, and why is it increasingly important in today’s threat landscape?
Pre-crisis credibility comes down to a single question: is your brand one that can be trusted? Everything else - from whether leadership has spoken publicly about cyber risks to whether journalists and analysts understand how the organisation operates - builds from that.
It is the cumulative result of how an organisation communicates before anything goes wrong. In cybersecurity, this foundation is particularly important because the default assumption after a breach is that the organisation knew more than it disclosed, or acted too slowly. You are starting the conversation at a deficit.
Much of this credibility is built through consistent, often unglamorous work - media relationship sessions, off-the-record briefings, and showing up before there is anything to announce or defend. Over time, this creates familiarity and trust that can shape how an organisation is perceived when an incident occurs.
What pre-crisis credibility looks like in practice: leadership engaging on cybersecurity topics in trade and business media before there is a headline. Companies proactively discuss their governance processes, which include board-level oversight, investment decisions, and training programmes as well as maintaining a visible presence in relevant industry conversations.
As cyber incidents become more frequent, stakeholders are no longer judging organisations solely on how they respond, but on whether they appeared to take the risk seriously beforehand. Those who have built that foundation tend to be viewed as more credible, while those who do not often appear reactive - even if their response is sound.
Many organisations only engage the media after a breach happens. How can communicators proactively work with journalists to build understanding and credibility around cybersecurity issues before a crisis unfolds?
Many organisations hesitate to engage with journalists unless they have something to announce. In cybersecurity, that approach can be counterproductive. Relationships built before a crisis are often what determine how an organisation is covered when something goes wrong.
Journalists are generally more responsive to organisations that are accessible and willing to provide insight without any product agenda. Offering subject-matter expertise - for example, having a CISO or Head of IT explain how certain threats work or share lessons from industry incidents - is genuinely useful to journalists and helps build relationships.
Providing data and original insight is also effective. Cybersecurity reporting is often driven by numbers and case studies, so organisations that can contribute research or analysis, even within a specific niche, are more likely to build ongoing engagement with media and be positioned as a source, rather than just a subject.
Participating in broader industry conversations also helps establish credibility over time. Whether through forums, panels or briefings, these interactions create familiarity, so that when a story breaks, journalists are more likely to approach organisations that have already demonstrated knowledge and openness.
Another approach is spokesperson briefings. Although walking journalists through a technical topic or industry trend with no immediate news peg is a significant time investment, it pays off. Reporters remember who helped them understand something, and when a story breaks, they are far more likely to reach out to those who have already demonstrated their expertise.
None of this requires disclosing sensitive information. It requires an investment of time, substance, and a willingness to engage meaningfully before a crisis occurs.
Beyond media outreach, how can thought leadership contribute to building reputational resilience around cybersecurity before an incident occurs?
Thought leadership is often discussed but not always executed well. A lot of what passes for thought leadership is essentially repackaged press releases and AI-generated op-eds. That is not what I am talking about.
Effective thought leadership demonstrates that leadership is actively engaged with cybersecurity as a business issue, not just a technical one. It shows a willingness to address difficult questions and, importantly, provides something useful to the audience, whether that is journalist, regulator, client, or investor.
This could take the form of a CEO writing publicly about why cybersecurity governance needs to sit at board level, not just under the IT function. It could also be senior executives sharing insights on industry-specific threats or contributing meaningfully to discussions around regulatory developments.
The value from a reputational standpoint is straightforward. When an incident occurs, stakeholders will ask whether the organisation took cybersecurity seriously. A visible track record of informed and consistent engagement helps answer that question. While it does not eliminate reputational damage, it provides important context that the organisation has been aware and engaged in cyber-related issues.
Cyber preparedness is often associated with well-resourced multinational companies, yet smaller organisations are increasingly targeted. How should communicators adapt their role and priorities across businesses of different sizes, and where can smaller organisations focus their efforts to have an effective reputational impact?
This is where the gap between perception and reality is most pronounced. There is a widespread assumption that attackers target large organisations because that is where the money is. In practice, Verizon's 2025 Data Breach Investigations Report found that ransomware was present in 88 per cent of SMB breaches, compared to 39 per cent for larger organisations, underscoring the scale of the risk for smaller businesses.
The challenge is that these organisations typically have fewer resources, less experience in crisis management, and limited media relationships. As a result, communicators need to focus on a smaller set of high-impact priorities.
The mistake smaller organisations often make is assuming that reputational strategy is only relevant once you are at a certain scale.
And when an attack lands, the financial exposure goes well beyond the initial demand. Verizon’s same report puts the median ransom payment for SMBs at US$115,000 - before you factor in downtime, recovery costs, regulatory penalties, and the reputational fallout that can take years to repair. That kind of impact does not discriminate by company size.
Basic preparedness is critical - having holding statements ready, clearly defined spokesperson roles, and an understanding of regulatory obligations. Beyond that, building a modest but credible presence in relevant industry communities can help establish context and familiarity. Owned channels, such as LinkedIn, can also play a role in signalling how the organisation approaches its operations, including its commitment to responsible practices.
The communicator's job, regardless of the size of the organisation, is to help leadership understand that the reputational dimension of a cyber incident is not a secondary consideration. It is central to recovery.
You might also enjoy
.jpg)
Every few years, someone declares the death of the media release.
Today, the arguments sound familiar. Journalists don't read them anymore. Everything is social-first. AI is replacing traditional media outreach. It's all about the pitch. Press releases are becoming little more than AI-generated filler.
And yet, when we speak with journalists across Asia Pacific and the Middle East, a different picture emerges.
Media releases aren't dead, but expectations around them have changed significantly.
We've analysed more than 10,000 Journalist Interest Survey responses in the Telum Media platform collected over the past five years, alongside insights gathered from conversations with editors, reporters, and producers across the region.
Key takeaways:
- Journalists still value useful PR content
- Relevance matters more than reach
- The pitch and the release serve different roles
- The best releases reduce friction for journalists
- Modern releases need to support multiple platforms
The conclusion is clear: journalists still value media releases, but they value them for different reasons than they once did.
The media release has evolved from a distribution tool into something far more strategic.
The media release is no longer the story
For decades, many PR professionals treated the media release as the centrepiece of media relations activity.
Write the release. Send it widely. Hope for coverage - “spray and pray”.
That approach was far from perfect, but you could get away with it in an era when newsrooms were larger, competition for attention was lower, and journalists had more time to evaluate incoming information.
Today's reality is very different.
Journalists are producing content across multiple platforms, often with smaller teams and tighter deadlines. Their inboxes are flooded with pitches, announcements, thought leadership submissions, and increasingly, AI-generated content.
As a result, journalists have become far more selective about what earns their attention.
The modern media release is no longer just about news stories. It has become a source-of-truth asset, a newsroom resource, and a content hub that supports broader communications activity.
The best PR teams understand this shift.
“The strongest message from journalists can be summarised in a single phrase: ‘Understand what I cover’. Relevance remains the most important factor in successful media engagement.”
What journalists are actually rejecting
One of the most revealing findings from our analysis is that journalists are not rejecting PR content altogether.
What they're rejecting is low-value outreach.
Across thousands of responses, the same frustrations appeared repeatedly:
- Irrelevant pitches
- Generic outreach
- Mass distribution
- Weak story angles
- Excessive follow-ups
In other words, this is less a rejection of media releases and more a rejection of poor media relations practice.
The strongest message from journalists can be summarised in a single phrase:
"Understand what I cover."
Relevance remains the most important factor in successful media engagement. In fact, our journalist surveys over the past two years have seen a sharp increase in a desire for both relevance and personalisation in pitches.
Journalists increasingly assess pitches within seconds. If the connection to their beat, audience, or current priorities isn't immediately obvious, the opportunity is often lost before the email is even opened.
The pitch and the release have different jobs
One of the biggest misconceptions in modern media relations is treating the pitch and the release as the same thing.
They are not.
The pitch exists to earn attention; the release exists to support the story.
The best pitches are:
- Brief
- Human
- Relevant
- Contextual
- Conversational
The best releases are:
- Structured
- Factual
- Complete
- Reusable
- Easy to reference
At a recent Telum Media event, a senior journalist described the fastest way to kill a pitch with a single word: “Respect”. Or a lack thereof.
A generic greeting. A story unrelated to their beat. A mass-produced email that demonstrates no understanding of their audience.
All signal a lack of respect for the journalist's time and expertise.
High-performing PR teams increasingly write pitches and releases for different audiences. The pitch is written for the journalist. The release is written for the journalist's audience.
That distinction matters.
Why journalists still value media releases
Despite predictions of their demise, journalists continue to actively request media releases.
But they want releases that help them work more efficiently.
The most common requests include concise writing, clear headlines, strong news angles, supporting data (with downloadable images and assets), spokesperson access, and easy-to-use formats.
These preferences reveal the modern role of the release: it functions as a workflow tool.
A strong release helps journalists:
- Understand the story quickly
- Verify information
- Access supporting materials
- Build content efficiently
The best releases reduce friction. And in today's newsroom environment, reducing friction is often more valuable than generating hype.
Think beyond media coverage
Another major shift is that media releases are increasingly serving multiple audiences.
A modern release doesn’t just support journalists; it might also support clients and prospects, employees, investors and analysts, partners, and search visibility.
Rather than creating a single-use document, leading communications teams are building content ecosystems.
The release becomes the foundation for:
- Media outreach
- Newsroom content
- Executive communications
- Social media content
- Email campaigns
- Sales collateral
- Thought leadership activity
This approach not only improves consistency but also increases the return on investment from every announcement.
The role of the modern media release
Not every story needs a release
Perhaps one of the most important lessons is recognising when a media release is the wrong tool.
Releases tend to perform best when there is:
- Genuine news value
- Multiple stakeholder audiences
- A need for factual consistency
- Strong supporting assets
- Broader business significance
They are often less effective for internal milestones framed as major news (or self-congratulatory announcements), generic thought leadership, and untargeted mass outreach.
In some situations, a targeted pitch, LinkedIn strategy, executive commentary programme, or direct relationship-based outreach may be more effective.
Good communications strategy isn't about defaulting to a media release; it's about choosing the right tool for the objective.
A framework for modern media releases
If there is one word that captures what journalists are asking for today, it is respect.
At Telum Media, we summarise this through the RESPECT framework:
R – Relevance
Make it relevant to the journalist, their audience and the moment.
E – Efficiency
Help journalists work faster through clear, concise, and usable content.
S – Substance
Provide genuine value through expertise, data, insight, or access.
P – Personalisation
Demonstrate that you've done your homework.
E – Ecosystem
Think beyond the release and consider how it supports broader communications goals.
C – Clarity
Make the key message immediately obvious.
T – Timing
Reach out at the right time, not simply any time.
What journalists are asking for in a pitch / media release: RESPECT
The future of the media release
The debate over whether media releases are dead misses the point.
The more useful question is how do we make releases work better in today’s media environment?
Journalists still value relevant information, credible sources, strong story angles, and efficient communication. Media releases continue to play an important role in delivering those things.
But success today depends less on the existence of the release itself and more on how strategically it is used.
The media release remains a valuable communications tool.
Just not in the way many of us were taught to use it.
FAQs
Are media releases still useful in 2026?
Yes. Journalists still value media releases, but these days want targeted outreach, relevance to their beat, alignment with their audience, and contextual pitching.
What makes a media release useful to journalists?
Journalists are looking for releases in a format that helps them work efficiently. Which means releases that are concise, factual, with a clear angle, contain usable quotes, and come with downloadable assets and supporting data.
What is the difference between a pitch and a media release?
A pitch earns the journalist’s attention in their cluttered Inbox. A media release supports the story by providing structured, factual, and reusable information relevant to their audience.
With more than 30 years’ experience spanning journalism, corporate communications and media intelligence, Reuben Aitchison is Telum Media’s Head of Insights and Communications.
Explore Telum Media tools that help PR teams pitch with precision.
.jpg)