Cybersecurity Awareness Month: Better Questions Lead to Better Insights

October is Cybersecurity Awareness Month. For cybersecurity brands, it is also an opportunity to ask what security leaders, buyers and employees actually need—and build communications around credible answers.

That is where original research can help. A well-designed study moves the conversation beyond broad claims, giving PR and marketing teams evidence they can explain, share and use.

Staying connected to the cybersecurity community

I attend RSAC, Black Hat, InfoSec World, SecureWorld, BSides and company-sponsored events across the cybersecurity industry. These conversations bring useful context to research planning. What are security teams struggling to implement? Which priorities compete for budget? What do buyers need to understand before evaluating a vendor?

A conference conversation is a starting point. A structured study can investigate whether a concern extends across a defined audience and where experiences differ.

At CITE Research, our cybersecurity market research connects industry understanding with structured research that supports communications, marketing and business decisions.

The strongest research starts with a specific question

For example: how do security leaders prioritise investments against operational constraints? Where do employees report using AI tools outside approved policies? Which barriers make security products difficult to evaluate or adopt? How do executive expectations differ from practitioners' experiences?

These are research questions, not conclusions. A neutral questionnaire allows the findings to support, refine or challenge the initial hypothesis.

If a security leader raises concerns about employees using unapproved AI tools, that could lead to questions such as: How many employees use AI tools for work? How clearly do they understand their organisation's policies? What information do they feel comfortable entering into those tools? How do employees' answers compare with security leaders' expectations?

Measure the gap between awareness and behaviour

Cybersecurity Awareness Month is a natural time to examine what people know. But knowledge alone does not tell the whole story.

An employee might understand the importance of reporting suspicious messages while remaining unsure how to report one. A business leader might feel confident in readiness without knowing when the response plan was last tested.

A useful study explores awareness, confidence and reported behaviour separately—producing more actionable findings and helping identify where clearer communication or further investigation may be needed.

Ask the right audience

A CISO, a security practitioner and an employee can describe different parts of the same issue. Choosing participants only by a broad job title can miss the responsibilities and organisational context the study requires.

Cybersecurity market research should define relevant roles, company characteristics and decision involvement. Executive interviews can add depth where the question requires a closer look at strategic reasoning.

Turn original research into useful content

For cybersecurity PR and marketing teams, original research can give an awareness campaign a clear focus. One study can support a report, media outreach, executive commentary, conference content and sales discussions.

Through PR survey research, findings can support media outreach, executive commentary, webinars, conference presentations and sales conversations. Published findings should include clear methodology so readers can evaluate the evidence.

An October study can also establish a baseline. Repeating consistent questions helps organisations examine how reported attitudes and behaviours change over time.

The same findings may also become useful references across traditional and AI search when published accessibly and attributed clearly.

Make listening part of the strategy

Cybersecurity Awareness Month creates a timely moment. Relevant research can give that moment a longer life through better market understanding, stronger content and informed business discussions.

The better we understand those audiences, the better questions we can ask—and the more useful our research becomes.

Talk with CITE Research about developing a cybersecurity study for your next awareness campaign, thought-leadership programme or business decision.

---

Andrew Edwards is the Founder and CEO of CITE Research. His background includes Nielsen and Edelman, combining research expertise with an understanding of PR and communications. He stays connected to the cybersecurity community through RSAC, Black Hat, InfoSec World, SecureWorld, BSides and company-sponsored events.