12 Questions to Ask a Cybersecurity Content Marketing Agency Before You Sign

Every cybersecurity content marketing agency I have ever seen pitch sounds good in the first meeting, right, they know the acronyms, they have a slide showing logos from security companies, they talk confidently about thought leadership and technical credibility and the practitioner audience, and the problem is that almost all of them sound the same, so a marketing leader at a security company ends up choosing based on which pitch felt most confident, which is a poor predictor of which agency will actually produce content your practitioners respect a year from now.

So here are the twelve questions I would ask, grouped into four areas, along with what a good answer sounds like and the answers that should make you end the call early. I run a content and distribution studio, so I obviously have a view on what good looks like, and I have tried to write these so they are fair to every kind of agency, including ones very different from mine, because the point is to find the right fit for your company rather than to steer you towards us.

How do you test an agency's technical credibility?

By asking questions whose honest answers reveal whether the agency can produce content your practitioners will not immediately see through. The first three questions are all about that.

Who on your team checks the technical accuracy of what you publish?

A good answer names a real process, usually a review by your own experts plus someone on the agency side with genuine security background, and explains how they catch errors before publication. A weak answer is "our writers are specialists" with no review step, because even specialist writers get details wrong, and in security one wrong detail can undo months of credibility. The best answers also mention how they handle disagreement, what happens when your engineer says a paragraph is technically wrong and the writer thinks it is fine.

Can you show me a piece where you went deep on a specific technique?

You are looking for evidence the agency can produce content with real depth, a walkthrough of an attack technique, a detailed research breakdown, rather than broad overviews. If every sample is a high level piece on "the evolving threat landscape", that is the kind of content the agency is comfortable making, and it is exactly the content your practitioners scroll past. Ask them who the expert behind the piece was and how much of the depth came from the client versus the agency, which tells you how they actually work.

How do you handle vulnerabilities under disclosure or customer incidents?

Security content regularly touches things that cannot be published yet, vulnerabilities under coordinated disclosure, incidents involving customers who cannot be named. A good agency has thought about this and has a clear process, embargo handling, anonymisation, legal review where needed. An agency that looks surprised by the question has probably not worked on genuinely technical security content before.

How do you test production and expert time?

Because the scarcest resource in security content is your experts' time, and how an agency uses it predicts whether the program survives the first six months.

How much of our experts' time will you need each month?

The answer I would hope for is around two to three hours per expert per month, one prep call, one recording, one review. An agency that needs weekly calls, long written questionnaires or multiple rounds of draft review from your engineers will exhaust them, and the content will get vaguer as the experts quietly disengage. I go into the interview approach that keeps this sustainable in getting security engineers on camera without burning them out.

Do you produce video and audio in-house, or outsource it?

Video matters more in security than many agencies admit, because practitioners learn from watching techniques demonstrated and explained, and much of the most trusted security content is video. An agency that writes well but outsources video will usually be slower and more expensive at exactly the format you need most. Ask where the editing happens and who does it.

What does one recording session turn into?

This reveals whether the agency thinks in systems or in one-off pieces. A good answer describes a set of outputs from a single session, a long-form video, clips, articles, posts in the expert's voice, a newsletter piece, the kind of month I lay out in what a cybersecurity content agency should ship you every month. A weak answer is "a blog post", because it means your experts' time is being converted into a fraction of what it could be.

How do you test distribution and measurement?

With questions about where the content goes and how success is judged, because this is where many security content programs quietly fail.

Where will our content actually be seen, beyond our own channels?

A good answer includes your experts' personal profiles, where practitioners actually follow people, YouTube for search and depth, and the specific communities and newsletters where your buyers spend time. An agency that only talks about your company blog and company LinkedIn page is planning to publish into a room mostly full of your own employees.

What will you report on each month?

You want to hear about influence on pipeline, content the sales team used, inbound conversations that mentioned specific pieces, and growth in the practitioner and leadership audiences you sell to. If the report leads with page views and impressions, the agency is optimising for what is easy to count. Honest agencies will also admit that attribution in long security deals is imperfect and talk about influence rather than claiming credit for closed deals.

How will you reach CISOs specifically, not just practitioners?

Practitioners and security leaders need very different content, and many agencies only really know how to reach one of them. A good answer distinguishes clearly between the depth practitioners want and the risk, strategy and peer perspective that leaders want, which I cover in content marketing to CISOs.

The pitch meeting tells you how confident an agency is. These questions tell you what they will actually be doing in month nine.

How do you test commercial fit?

With the last three questions, which are about how the relationship will actually work.

Who will we actually work with day to day?

In many agencies, the senior people who pitch are not the people who do the work. A good answer names the specific people, their experience and their role. A vague answer about "a dedicated team" often means junior staff you have not met.

What would you do in the first ninety days?

A strong agency can describe the first quarter specifically, audience mapping, expert interviews, the first recordings, the first month of assets, the first report. An agency that describes a long onboarding and strategy phase before anything is published is going to spend a quarter of your budget before you see anything real.

Can we run a paid test before a full retainer?

The best way to evaluate an agency is a small, real piece of work, one recording session with one of your experts and a month of assets from it. Confident agencies welcome this. Agencies that insist on a long commitment before you have seen their work on your content are asking you to take a risk they are not willing to take themselves.

How should you use these answers?

As a way to narrow a shortlist to two, and then let a paid test decide between them.

How would Pixel Samy answer these?

Openly, including the parts where we are weaker. Pixel Samy Studio is founder-led and runs out of Dubai with close to 50 people working in-house, the video and audio production happens there rather than through a vendor, and our editors cut more than 400 podcast episodes a month, so turning expert conversations into a month of video, clips and articles is our everyday work. We test formats on our own YouTube channels, seven of them with over 100,000 subscribers each, before recommending them, and we build an accuracy review with your experts into every piece. Where we are not the right fit is if you mainly need a security PR firm to place stories with journalists, which is a different skill. And I would welcome a paid test, because I would rather you judge us on your own content than on a pitch. If something in your program would be new territory for us, I will tell you so.

If YouTube is part of your plan, ask every agency how they handle packaging, the thumbnails and titles that decide whether security videos get clicked. Our sister studio ClickTheory covers that gap in cybersecurity content marketing agencies and the YouTube packaging gap. The wider guide to the best content marketing agency for cybersecurity firms and the piece on why content fails for cybersecurity firms are worth reading alongside these questions.

If you are running an agency selection right now, send me the brief and I will answer all twelve questions for your company in writing, if that makes sense. So yeah. That's my way of saying it.