How Can Cybersecurity Companies Use Newsjacking / Rapid Response to Earn Media Coverage?

Lessons from the French Supermarket Fridge Hack

by Diane McKaye, Senior Director, Si14 Global Communications Cybersecurity startups can learn a lot about how to gain significant PR by analyzing media coverage of the recent cyberattack on fridges at hundreds of supermarkets. In this blog, our team at does the heavy lifting for you, dissecting dozens of articles about the hack for insights on what was/n't effective in grabbing reporters' attention. We also share knowledge gained over 15 years of running rapid response campaigns that landed clients in The Wall Street Journal, VentureBeat, CNN, The Hill, SiliconANGLE, The Economist, and a wide range of trade outlets. Key Findings

• Claroty's Team82 owned the vendor conversation. Its August 2026 vulnerability research on Danfoss refrigeration controllers was cited in close to 40% of the articles, including Reuters, AP, and CNN. Claroty regularly publishes unique research as a key part of its media strategy, as noted in our Cybersecurity Brand Pulse Report.
  

• Mainstream press published commentary from researchers. Over 20% of the coverage included Sekoia's senior threat analyst Félix Aimé’s commentary to Reuters which provided further insight on the attack, showing how credibility counts. Aimé previously worked at ANSSI, the French national cyber agency that is now handling the investigation.
  

• Scan data was the second currency. Vendors including Censys, Onyphe, SecurityScorecard, UpGuard, and U.K. Cyber Defence won mentions with exposure counts rather than opinion.

•  42 cybersecurity vendors appeared at least once. Only four appeared in ten or more articles: Claroty, Sekoia, Censys and Pen Test Partners.

Key themes

Five messages carried most of the vendor commentary in the initial tranche of articles. The first, internet exposure, came up in almost every article that quoted a vendor.

Theme	Who pushed it	Sample line
Get OT off the public internet	Claroty, Waterfall, Pen Test Partners, Forescout, Coalition, Check Point, Rapid7, Cogent	"Bottom line: take your gear off the Internet." — Andrew Ginter, Waterfall (Dark Reading)
Known flaws, unpatched legacy kit	Claroty Team82, Synacktiv, Onyphe, Censys, Sophos, Delinea	“Most exposed Danfoss interfaces still run outdated firmware.” — Onyphe (Reuters)
Simple attack, deliberate intent	Pen Test Partners, Synacktiv and Claroty (simple) vs Almond (sophisticated); Wavestone on motive	Hitting hundreds of units at once shows "a certain level of sophistication". — Antoine Hautin, Almond (AFP)
Physical harm without stolen data	Huntress, CyberSmart, Filigran, Galvanick, LevelBlue, IGEL	"Defrost isn't an exploit; it's functionality." — Joshua Steinman, Galvanick (Industrial Cyber)
Third-party and OEM remote access	Xona, Forescout, Filigran, Pen Test Partners, Claroty (Pearce), Check Point	“Suppliers need to be asked probing security questions.” — Ken Munro, Pen Test Partners (CNN)

Observations on Commentary

Experts were split on sophistication and motive.Almond saw "a certain level of sophistication" in hitting hundreds of units at once. Synacktiv and Claroty called the attack simple. Wavestone weighed activists against state sabotage. Pen Test Partners doubted a nation-state was behind it, calling it "mischief."

Exposure counts became their own story. Each scanner published a different number, which kept the story running all week. Censys also noted a 71% drop in exposed French panels after the attack, picked up in six trades including Infosecurity.

Mainstream vs. Trade Media

Vendors gained the most exposure in the cyber and tech trade press, where 73% of articles quoted or cited a vendor, versus 47% of mainstream outlets. Sekoia's wire service interview was syndicated across mainstream business outlets.

Key Takeaways

Research published before the incident won the week. A fast, factual comment on the wire services came second, with data and quotable reactions roughly tied behind.

1. Original research/data is the strongest newsjack. Claroty’s Team82 research paper, which was covered by trade press when it went live in August, was cited extensively now by top business media outlets. That made Claroty the story's reference point.
   

2. Pair research with a named spokesperson. By proactively reaching out to media with a fresh statement paired with this past summer’s research, Claroty earned its CTO the longest quotes in Infosecurity and Industrial Cyber.

3. A credible threat researcher with a relevant interesting fact that advances the story beats company statements in the mainstream press. Sekoia’s Aimé was picked up in around 40 articles, mostly through syndication of his quote in Reuters.
   

4. Furthering the story with additional data buys entry. Censys, Onyphe, SecurityScorecard, Predicta Lab, IPinfo and U.K. Cyber Defence placed without a strong opinion because each provided a scan number nobody else had.
   

5. Wire service coverage nets wide pick-up. Pen Test Partners’ “basic hygiene” line reached 10 articles through Reuters; equally punchy lines in trade titles stayed in one article.

Frequently Asked Questions About Newsjacking and Rapid Response

What is newsjacking in PR?

Newsjacking, also called rapid response, is the practice of offering expert commentary to journalists on breaking news. It lets a company earn media coverage when it has no news of its own to announce. Done well, it builds company credibility and the professional reputation of founders, CEOs and CTOs.

How can a cybersecurity company get media coverage without news to announce?

Offer executive commentary on breaking stories, such as major breaches, legal action against cybercriminal groups, or government threat warnings. Si14 Global has used this approach to place clients in The Wall Street Journal, VentureBeat, The Hill, Newsweek, Silicon Angle, CSO, and more.

How fast do you need to respond to breaking news?

Respond the same day, preferably within a couple of hours. Commentary on yesterday’s news rarely gets used. Former TechCrunch reporter Frederic Lardinois has said the chance he’ll use a CEO’s comment on yesterday’s news is “nil.” Executives who are slow to respond miss the opportunity.

How do you prepare for news you can’t predict?

Interview executives regularly, before news breaks, so you already know what they can and will comment on. Track growing trends and upcoming regulations to get ahead of the news cycle. When a story breaks, a quick call captures a fresh take while the window is still open.

Should you mention your product when commenting on a breach or cyberattack?

No. Rapid response usually goes wrong when executives push a sales pitch. Reporters want original insight that moves the story forward, not “if they’d used our product, this wouldn’t have happened.” The goal is to help the public understand the implications of the news.

What kind of commentary do journalists actually use?

Bold, original insight that reveals a new layer of the story. Comments that are obvious or echo the status quo rarely get picked up. For example, when officials warned that the Russia–Ukraine war could trigger cyberattacks on large American organizations, Cymulate’s cyber evangelist was quoted in CSO. He pointed out that U.S. pressure on ransomware gangs was pushing some of them toward easier mid-sized targets, an angle that hadn’t been covered yet.

How do you find the right newsjacking opportunities?

Monitor the news constantly and match stories to each executive’s specific expertise. Sending reporters sample quotes also helps, since it gives them a preview of what an interview would deliver. When DeepSeek launched, Si14 pitched Voxel51 co-founder Dr. Jason Corso because of his leadership in the open source community. The Wall Street Journal included his perspective in its feature on DeepSeek’s rise.

Is a mention in a broader news story worth it?

Yes. Audiences spend more time on news and market trends than on content about specific products. Being quoted in trend and breaking-news coverage reaches a wider audience than product-focused stories, which builds brand awareness and name recognition. It also puts your company at the center of the conversation when your target audience is paying the most attention.

Does rapid response lead to longer-term media relationships?

Often, yes. When reporters see an executive as a useful source, they come back for comment on related topics. Si14 pitched commentary to one reporter for months to familiarize him with our client's perspectives on the industry. When he later wrote about companies hiring robots for The Wall Street Journal, he reached out to Si14 for our client's input.

Should cybersecurity companies comment on a data breach right away? Yes, but comment on what’s known, not on what isn’t. Early breach reports are often incomplete or wrong, so avoid speculating about who was responsible, how attackers got in, or what the victim did wrong. Instead, offer context that holds up regardless of how the facts develop: what this type of attack typically means for affected customers, what similar organizations should check now, or how the incident fits a broader threat trend. That lets you respond the same day without staking your credibility on details that may change by tomorrow.

When should a cybersecurity company stay silent on breaking news?

Stay out of a story when you have nothing original to add, when your comment would amount to blaming the victim, or when the only angle is your product. Also skip stories where the victim is a current customer, partner or prospect, or where your company is directly involved; those call for crisis communications, not commentary. Passing on the wrong story protects your relationship with the reporter, which is what earns you the call on the next one.