Key Takeaways
- Cyber‑security buyers must rely on marketing claims to judge highly technical products, so accuracy and transparency are essential.
- Recent high‑profile attacks (M&S, Co‑op, Jaguar Land Rover in 2025) show that breaches are inevitable; organisations need realistic expectations about protection, resilience and recovery.
- A survey of 152 UK cyber‑security marketing, PR and communications professionals reveals widespread use of absolute language such as “100% protection” (99% have encountered or used it) and concerns that many claims are unsubstantiated or misleading (51%).
- While 89 % acknowledge that such absolutist wording creates a false impression of total security, 86 % remain confident in their own organisation’s materials, indicating a confidence gap between self‑assessment and perception of the wider market.
- Competitive pressure and the difficulty of explaining complex technology to varied audiences drive the temptation to over‑simplify or exaggerate capabilities.
- Misleading communications have tangible consequences: nearly half (47 %) of respondents report their organisations have suffered commercial or reputational damage from inaccurate or over‑simplified messaging.
- Many firms employ legal/technical reviews and disclaimers, yet 30 % admit their messages are still misunderstood, especially by non‑technical readers.
- There is strong appetite for industry‑wide standards: 94 % want clearer communication standards or a code of practice, 86 % support cyber‑related accreditation for practitioners, and 97 % agree PR has a key role in curbing misinformation.
- A voluntary, cyber‑specific code could curb absolute claims, demand stronger evidence, improve testimonial use, and shift language toward realistic outcomes—risk reduction, resilience and faster recovery—thereby rebuilding trust through transparency rather than hyperbole.
Market Context and the Trust Imperative
In a marketplace where purchasing decisions hinge on trust, cyber‑security vendors face a unique communications challenge. Buyers often lack the technical depth to evaluate sophisticated solutions themselves and must therefore rely on marketing claims to gauge effectiveness. Consequently, any statement about protection, resilience or risk reduction must be clear, evidence‑based and proportionate, especially when addressing audiences with disparate levels of expertise.
Real‑World Stakes Highlighted by Recent Attacks
The urgency of accurate messaging is underscored by recent cyber incidents. In 2025, attacks on major UK organisations such as Marks & Spencer, Co‑op and Jaguar Land Rover inflicted hundreds of millions of pounds in damages. These events demonstrate that the question for any enterprise is no longer “if” a breach will occur, but “when” and whether its people, processes and supply chain are adequately prepared. The fallout from such breaches amplifies the need for vendors to communicate realistic capabilities rather than promises of invulnerability.
Survey Findings: Prevalence of Exaggerated Claims
New research involving 152 senior cyber‑security marketing, PR and communications professionals reveals the extent of the problem. A striking 99 % reported having encountered or used language such as “100% protection” or “fully protected” in their marketing collateral. More than half (51 %) have seen claims they believe to be unsubstantiated or misleading, and 30 % admit to having been directly involved in producing those statements.
Professional Awareness of the Risks
Despite the prevalence of absolutist phrasing, most respondents recognise its drawbacks. Eighty‑nine percent acknowledge that claims of total protection can create an illusion of certainty that no security solution can genuinely deliver. This awareness suggests an understanding that overstatement erodes credibility and may ultimately harm both vendors and their customers.
The Confidence Gap: Self‑Assessment vs. Industry Perception
An intriguing divergence emerges when professionals evaluate their own organisations. Eighty‑six percent express full confidence in the accuracy and integrity of their own marketing and PR content, even while many voice concerns about exaggerated or misleading claims prevalent across the sector. This confidence gap indicates that organisations often view themselves as exempt from the industry‑wide communication problems they observe elsewhere.
Competitive Pressure and Technical Complexity
Two intertwined forces drive the temptation to over‑simplify. First, the global cyber‑security market is intensely competitive; the UK government estimates roughly 2,600 firms vie for visibility against overseas rivals. Second, explaining intricate security technologies to audiences ranging from technical CISOs to non‑technical board members is inherently difficult. The survey identified the challenge of conveying complex capabilities to varied knowledge levels as the most frequently cited major obstacle (38 %), surpassing even concerns about miscommunication (23 %).
Audience Diversity and the Need for Consistency
Because decision‑makers possess vastly different technical backgrounds, vendors must ensure that claims are accurate and consistent across all channels. A board member approving budgets may interpret a statement very differently from a CISO evaluating technical feasibility. When messaging becomes too broad, absolute or insufficiently supported, the risk of misunderstanding rises, potentially leading to commercial or reputational harm for both buyers and sellers.
Consequences of Misleading Messaging
The fallout from inaccurate or over‑simplified communications is not theoretical. Nearly half of the respondents (47 %) state that their organisation has suffered commercial or reputational damage as a result of such messaging. These repercussions can include lost sales, eroded customer trust, regulatory scrutiny, and damage to brand equity—outcomes that directly contradict the trust‑based foundation of the cyber‑security market.
Mitigation Efforts and Their Limitations
In response, many professionals reported subjecting marketing copy to legal and technical review before publication, and a majority incorporate disclaimers, plain‑English explanations or risk guidance. Nevertheless, 30 % admit that their messages are still misunderstood, particularly by readers lacking specialist knowledge. This gap suggests that existing safeguards are inconsistently applied or do not sufficiently account for how non‑technical audiences interpret the information.
Call for Clearer Communications Standards
There is strong consensus on the need for industry‑wide guidance. Ninety‑four percent of survey participants advocate for clearer communication standards or a formal code of practice to curb miscommunication. Additionally, 86 % believe practitioners should hold a cyber‑related accreditation, and 97 % agree that public relations plays a pivotal role in reducing the risks associated with misleading claims, placing responsibility on agencies and in‑house teams to challenge unsupported statements rather than merely amplify them.
Elements of a Proposed Cyber‑Specific Voluntary Code
A voluntary, cyber‑focused code of practice could address the sector’s unique challenges. It would discourage absolute claims such as “total security” or “100% protection,” instead encouraging language that reflects realistic outcomes—risk reduction, greater resilience and faster recovery when—not if—an incident occurs. The code would promote the use of robust evidence to substantiate claims, enforce careful and transparent use of testimonials, and ensure that product descriptions and partnership announcements are accurate and not overly broad. By aligning marketing language with what solutions can genuinely deliver, the code would help shift the narrative from hyperbole to honesty.
Conclusion: Trust Built on Evidence, Not Hyperbole
Ultimately, cyber‑security depends on trust—trust not only in the technology itself but also in the claims used to sell it. Implementing clearer communications standards would enable vendors to earn that confidence through transparency, evidence‑based messaging and realistic expectations, rather than relying on marketing hyperbole. As the sector continues to grow and threats evolve, aligning communication practices with the true capabilities of security solutions will be essential for sustaining buyer confidence and fostering a healthier, more trustworthy marketplace.