From fear to acceptance: why cyber messaging has to change

Hooded hackers, countdown clocks, the average cost of a cyberattack in bold type: for years, the cybersecurity market sold fear. And it worked.

Not anymore. The threat is no longer fiction: your buyers have accepted it. They don't need to be scared anymore, they need to get organized to face it. Yet many vendors are still speaking one step behind their customers.

Why the market sold fear

Historically, cybersecurity was a fairly non-strategic topic for companies. It was a cost center rather than an investment with a direct ROI, at least as long as nothing happened.

The CISO, for their part, was always convinced of the value of cybersecurity solutions. Their job was mostly to keep convincing everyone internally of how important they were.

In that context, the most effective argument was the insurance industry's: fear. Show what could happen to justify spending whose benefit remained invisible.

But the game has changed. Cyber risks have become real and moved to the forefront for any company with even a minimal digital footprint. No one is safe from being attacked or from unintentionally exposing their systems.

The change curve applied to the cyber market

To understand where the market stands, you can use the change curve, inspired by the Kübler-Ross model. It describes the stages people go through when facing a major upheaval.

Applied to the cyber threat, it gives five stages:

1. Denial. “It only happens to large corporations.” Cyber is a cost center. Vendors sound the alarm with attack statistics.
2. Fear. The first attacks hit people close by or competitors. Vendors sell fear, like insurance.
3. Bargaining. “We'll do the minimum to tick the box.” Vendors sell compliance.
4. Acceptance. “We will be attacked: the question is when, and how we'll respond.” This is where most of your buyers are today.
5. Structuring. Organization, processes, tools, internal culture. The conversation is about capabilities, resilience and ROI.

The arrival of NIS2 is a good illustration of the bargaining stage. The directive was an obligation for companies, and therefore a commercial opportunity: every cyber company positioned itself on it.

That's where the gap lies. Your buyers have moved on to acceptance and are arming themselves to better face the threat. If your messaging is still at the fear stage, it answers a question they no longer ask.

Not every market is at the same stage

Not every company moves at the same pace. Large accounts and regulated sectors are often already at the acceptance stage, or even structuring. Some SMEs are still somewhere between denial and bargaining.

Your messaging therefore needs to take your targets' maturity into account, rather than addressing the whole market the same way.

The CISO and the CEO in the same room

The CISO's role now extends well beyond compliance, and cybersecurity has become a leadership topic.

A study by Splunk with Oxford Economics, among 500 security leaders and 100 board members in ten countries including France, shows it clearly. 82% of the CISOs surveyed interact directly with their CEO, and 83% attend board meetings fairly often or most of the time (Splunk, 2025).

Regulation is moving the same way. Under NIS2, management bodies must approve cybersecurity measures, oversee their implementation, and can be held liable for failures. They must also undergo training (NIS2, Article 20).

For a vendor, the consequence is direct. The CISO becomes an ally who champions your solution in front of leadership, and they need business arguments to do so. The CEO, meanwhile, joins the decision. So you need two levels of messaging, consistent with each other: one for the CISO, one for the CEO.

The messaging for the next stage

Today, everyone understands the threat and what it means. So you need to position your solution differently, highlighting:

• its capabilities: what it concretely lets you do;
• its resilience: what it guarantees when an incident occurs;
• its ROI: what it brings in or saves the company;
• its ease of use, for teams whose maturity varies widely from one profile to another.

Cyber messaging thus moves closer to that of traditional SaaS solutions, which speak to CEOs. Fear is no longer an argument: what makes the difference is your ability to help the customer get organized.

Three questions to ask yourself

There is no one-size-fits-all messaging. Before rewriting everything, start by asking yourself three questions:

1. How do you feel about your current positioning?
2. Does it still truly speak to the CISOs you talk to?
3. How do you see your positioning and messaging evolving over the coming months?

FAQ

Should you stop talking about the threat altogether?

No. The threat remains the context, but it should no longer be the main argument. Your buyers already know it: what they expect is how your solution helps them face it.

Is NIS2 still a good sales argument?

It's a compliance argument, useful for companies still at the bargaining stage. For more mature buyers, it's no longer enough: they expect capabilities, resilience and ROI.

Who should a cyber vendor's messaging speak to?

The CISO and the CEO, with two consistent levels of reading. The CISO needs technical elements and business arguments to champion the decision. The CEO needs to understand what the solution changes for the company.

How Plan B can help

Plan B supports cybersecurity vendors on their positioning and brand messaging, to speak to the CISO as well as the CEO. An audit takes stock of your current messaging and how far it lags behind your targets' maturity.