🔥[Belyaev_Podcast]🔥 - Выпуск №21: «Построение стратегии коммуникаций для ИБ компаний и CISO»

Main topic

The episode discusses how cybersecurity companies should build long-term strategic communications, especially around CISOs and anti-crisis PR during and after cyber incidents. It also explains why poor coordination can lead to reputational chaos.

1) Career and why “cyber crisis PR” became the focus

• Guest Nika Komarova describes her path into PR:
  • starting in PR agencies and journalism/agency publications
  • moving into IT/security-adjacent roles (e.g., a systems integrator with a security department, then security/IT companies)
• She later joined the IB group and worked there for years, building deep operational understanding.
• After that, she launched a consulting practice focused on anti-crisis response to cyber incidents.
• She notes that in Russia, cyber PR as a systematic discipline was (in her view) less developed than in international practice.

2) What should come first: business strategy, not communications

A core argument: communications (including PR) should be developed after the company’s direction is defined.

• First: business strategy
  • where the company wants to be long-term
  • which markets to enter
  • what to sell
• Then: functional strategies
  • information security
  • product
  • sales
  • communications/PR

If PR/marketing/SEO/commercial teams operate independently without a unified strategic “order,” messaging fragments and creates reputational chaos (e.g., different departments pushing incompatible narratives).

3) PR vs marketing and where PR fits in B2B

• The hosts debate whether PR is “just a marketing tool.”
• The conclusion emphasizes that in B2B, PR is not merely short-term reach tactics.
• Instead, PR supports brand perception, trust formation, and long-term positioning.
• In B2C, the balance may differ, but the discussion remains grounded in B2B cybersecurity realities.

4) How to justify strategic communications to a skeptical CISO

A skeptical CISO should see communications as part of business risk management, because cyber incidents tend to evolve:

• technical → management
• management → reputational
• reputational impact can extend to clients, partners, and regulators

So the CISO should ensure a scenario-based approach that includes:

• internal incident handling
• and external crisis communications to avoid contradictory statements, panic, and public confusion

5) CISO personal brand: when it helps vs when it becomes a risk

Komarova argues that:

• A CISO’s personal brand is an asset only when it doesn’t compete with the corporate brand.
• It must be coordinated through communications strategy so public messaging stays consistent.
• If an expert’s public activity becomes off-message, speculative, or overly politicized, their personal brand can become a reputation risk for the company.
• Overregulation can also be harmful: too many constraints can blur sincerity and weaken positioning.

6) Handling information policy and “how much freedom” executives should have

The discussion stresses common sense and avoiding extremes:

• too strict control that kills authentic expert messaging
• too much freedom that causes brand mismatch or careless statements

Many companies maintain an information policy outlining sensitive topics and prohibited areas. Public figures and their channels should respect it while keeping coherent positioning.

7) Limits of “situational marketing” using others’ leaks

A question from Cybermedia asks whether it’s legitimate to use competitors’ high-profile leaks for PR.

Komarova’s view:

• Capitalizing on someone else’s misfortune is generally unethical because no company is immune from becoming the next target.
• She distinguishes interest in the communications aspect from “hype”:
  • she analyzes the communications component of incidents
  • not “profiting” from the leak itself
• She also notes that journalists sometimes seek attacker comments—but that doesn’t justify opportunistic exploitation.

8) Crisis response: the “first 24 hours” destroy credibility

She highlights three actions that strongly undermine trust:

1. Panic (loss of clear assessment)
2. Lack of coordination / no exercised crisis plan
3. No timely communication once the incident becomes noticeable (silence creates uncertainty, calls, and speculation)

The central theme: credibility depends on readiness and knowing when and who communicates.

9) Internal communications: preventing insider leaks

To reduce internal information flowing to Telegram channels/journalists, she recommends:

• briefing employees and setting clear rules for who speaks

• using “silence regime” practices (PR/press service and/or designated speakers only)

• managing employee behavior in public spaces (comments, posts, and social networks are still public and can be screenshotted)

• using contracts/charters/principles and structured authorization

10) Is publicity mandatory for a successful CISO?

Komarova’s answer is “unpopular”:

• Publicity is everyone’s choice; being public is not mandatory.
• However, engaging professionally (speaking, attending industry venues, networking behind the scenes) helps avoid an “information bubble.”
• “Publicity for publicity’s sake” is criticized—what matters is message quality and usefulness.

11) “Normal or scary” examples (final “game”)

In quick judgments, the discussion emphasizes:

• don’t coordinate everything with PR in a way that becomes performative/overprocessed (“scary”)
• “reposting yourself everywhere” without new value can feel filtered and less credible
• brand content should be meaningful rather than repetitive—otherwise audiences tune it out

Presenters / contributors

• Dmitry Belyaev (host)
• Nika Komarova (guest; founder of PIR-machines; anti-crisis communications consulting)
• Yulia Churikova (co-host; independent PR expert; previously at PR company Garda)