Inside the Media Mind of Ken Underhill: eSecurity Planet

Christine Blake: Welcome to Inside the Media Minds. We are your co-hosts Christine Blake

Madison Farabaugh: and Madison Farabaugh. 

Christine Blake: This show features in-depth interviews with tech reporters who share everything from their biggest pet peeves to their favorite stories. 

Madison Farabaugh: From our studio here at W2 Communications, let's go Inside the Media Minds.

Christine Blake: Hello, everyone. On this episode of Inside the Media Minds, Madison and I are talking to Ken Underhill. He is an award-winning cybersecurity professional, best-selling author, and seasoned IT professional. He is currently the cybersecurity newsletter writer at eSecurity Planet. We had a great conversation with Ken. We really enjoyed talking to him. He gave a lot of really good tips and tricks for PR people pitching him different research stories, and he gave a lot of great insight too into what eSecurity Planet is looking forward to writing about the rest of the year, including predictions and including Cybersecurity Awareness Month. So definitely listen for some of that information. Madison, what did you find most helpful?

Madison Farabaugh: I loved hearing about Ken's background and how he got into writing, and even to eventually his role at eSecurity Planet. We got to hear about a lot of his previous side quests, which were very interesting. So he's had a hand in a cybersecurity show called Cyber Life, and then he also has written a best-selling book, Hack the Cybersecurity Interview. So it was definitely cool to hear the personal experiences that he had while working on these different projects and how rewarding they were for the audiences that they were intended for. So definitely looking forward to sharing more information there.

Christine Blake: We hope everyone enjoys this episode. 

Christine Blake: Hello, Ken, and welcome to Inside the Media Minds. We're excited to talk to you today.

Ken Underhill: Yeah, thanks for having me. Appreciate it.

Christine Blake: Absolutely, we're excited to learn more about you. So our agency has worked with you a lot over the last year, but we haven't really had a chance to hear more about your background and your story. Understanding you have hands-on experience, were a company founder experience in cybersecurity and IT, how did you land here in journalism?

Ken Underhill: Magic. I, I retired. So, so for those that don't know me, I've got over 20 years in IT and security, including as Christine said, few of my own startups have exited. Last year, I technically retired, which lasted like I think two or three months, and I was like, I got to do something. I'm going crazy. I didn't want to go into a more technical role. I was, kind of dealt with that. I didn't want to do executive leadership for somebody else's company because that's a whole other ball game. And I was like, well, I like the writing stuff. 

You know, I've done like, my own marketing. I actually didn't even know the term content marketing still until I started like looking for writing roles. I was like, "Oh, there's actually a term for the things I've been doing for, for many years now. So, so I was specifically looking for a writing role. Technology advice happened to have one open that matched what I was looking for, and I've been doing that ever since.

Christine Blake: That's awesome! I love that you came out of retirement

Ken Underhill: Yeah, just, just yeah. Honestly, just to meet you two. That was my bad.

Madison Farabaugh: Oh, oh, we're honored. Well, that's a great background to get. And just curious, as someone with some of that hands-on experience, how does that skill set that you have impact the way that you approach your writing for eSecurity Planet and other editorial needs?

Ken Underhill: Yeah, so there's a term that you'll, you probably are familiar with in industry called FUD, Fear Uncertainty Doubt, or I call it Chicken Little Syndrome. That's the vast majority of news you see out there, and it's like everything's critical. And, and when you, like actually look at it, so, going to your question directly. Having the technical background, having actually done it for a long time, I'm able to like look at something like yeah, that's not as big a deal as they're claiming it. You know, it actually is. 

So that is, allows me to basically kind of filter a lot of what I'm planning to cover. Like, what does the audience actually care about, and how can I remove all the hype around it, and add in hype when it's needed, but really focus on like as a practitioner or a senior leader reading this, like what can you actually walk away with from this news that I'm writing about, and like what are some steps you can do today, versus like everyone's gonna die, and it's like no, not not really, you know, not in the real world.

Madison Farabaugh: That's so important. Yes, very, very refreshing considering the industry that we work in. I think that's definitely that can be a temptation for many, especially chasing news cycles. So it's great to hear that that's the perspective that you take.

Christine Blake: Yeah. So we understand your title is cybersecurity newsletter writer at eSecurity Planet. So can you break that down for us? What does that entail? What, how do you approach that role?

Ken Underhill: Yeah, so it entails a lot of writing for, I mean, white papers, trend reports, even some like email ad copy. Like, if I feel like a client's ad copy is not going to convert well with the, the audience, I'll, I'll go ahead and give suggestions to rewrite it. Then also, as a as the name implies, writing for the Cybersecurity Insider newsletter, writing articles, et cetera, et cetera. That whole, job descriptions are, used to be that line that would say all other duties as assigned. So, like that's what it kind of boils, boils into is doing all sorts of writing on all things cybersecurity. So, not a specific domain, but like across all the entire breadth of security.

Madison Farabaugh: That makes sense. And in terms of determining how or what your team will cover versus not cover, is there a specific strategy that you all have for that? And what's the best way to get in touch with your team for specific news stories or research and things like that?

Ken Underhill: Sure. So honestly, the first part first. Really, it's it's knowing your audience. So for those out there who are like, what kind of content should I create? Like you, you have to know your audience. So, for example, our audience loves remote code execution or RCE. Like anything around that is super exciting to them. I don't know why. Well, I do know why, but, but also things that are like big-name breaches, large data breaches, like if it's affected, you know, millions of records these days. Anything around like AI threats, AI governance, the recent stuff. We won't name names, but the recent stuff where some fundamentals were not done, and so we expose the test environment of AI agents to go out to the internet and have fun with other people's companies, things like that. Those are things that we'll cover because our audience usually will love those. 

But also different research. You know, one of you had mentioned research earlier. So we work with a lot of different security companies. They might do deep dive research on a certain threat actor group and what they're doing or certain attacks they're doing. That's interesting for our audience as well. It doesn't always pop as much as some of the other stuff. So it's more about knowing your audience and then kind of trying to focus on those buckets that you know they enjoy and then testing some different things around that. Second part of your question: How do you get in touch? I'm hesitant to say my email address on here because there's probably somebody malicious watching. But use whatever tool you use to harvest my email address, and it'll be the technology advice one. And then just send an email around that. 

Don't send it to any other addresses you harvest because I'll just put you on, on a blacklist. That being said, if you're reaching out, like, we literally never cover the latest widget your company's launching, like our audience doesn't care about that. However, what you could do instead is say, "Hey, we've got some cool research our team did. Hey, by the way, here's a press release about our latest widget that's launching that covers you know that thing or whatever,” and I can't guarantee it, but sometimes I can get that link through like editorial for your press release in the article about the actual cool topic. So, but like just straight pitching about our widget, our widget, our widget, our new features, blah, blah, blah. In most cases, if you keep doing that, after I've said via email like, "Hey, we don't want that. We don't cover that,” I'm just going to block you, and you'll build a spam folder from then because I don't have time. Like, I get literally probably 150 pitches at least a week from different PR firms. So like, hey, cover our thing. So we just, I just don't have the time to sort through all that.

Christine Blake: Yeah, definitely hear that. So, no product news covering your research. Research is the most important thing to you and your audience. So, yep. Ken, good insight. And you know, it's interesting too. You mentioned some of the, the security topics, right? AI all the time, all the things happening this week, last week alone. Are there any security topics you feel are talked about too much, overhyped, or ones that aren't getting enough attention that need to be getting more coverage?

Ken Underhill: I think the overhyped is more around the the writer, and I don't want to knock anyone that's that's writing, but I think it is, so please don't take offense. But I think a lot of the writing is done by people without experience, and where I'm leading with that is that a lot of it's what I mentioned earlier, the Chicken Little kind of news, and it's not always critical. So I think that stuff is covered too much. Like, oh my goodness, it's critical. The world's going to end. But when you actually look at like the security advisory from, I'll just say Palo Alto Networks, for example. It's very isolated use case of a certain thing. Now, some of it actually is legit, Chicken Little, but, but a lot of it's very isolated use cases that depend on specific scenarios. 

So I think as an industry as a whole, for years we've covered that too much of like trying to panic everybody. I think what's maybe not being covered enough out there in media, specifically not really in conversations, but just in media, is really around AI governance, governance, and more tactical things you can do. Like everything's kind of surface level, but like when I read it, like tell me what is a practitioner for say a healthcare company, what can I go do today in my environment? You know, yes, you're not going to know my environment specifically, but like, just tell me, like, hey, based on healthcare companies we work with, here are some of the things that you can go, you know, do or be mindful of today around this topic. And I think that specifically is not really covered in general, both from media, but also from security companies or marketing teams again, not knocking anyone, but that's, that's an area where I think there's a gap a lot of times, and I think that's where you can kind of shine working with your different SMEs to kind of flesh that out.

Christine Blake: Yeah, that's interesting. So more that like practical use as a use case is how you can use something in your environment, and I like how you mentioned you know your, and what we talked about earlier, your experience is what makes you kind of approach writing about this topic in a different way that is less FUD and more practical use and more informative. So I think no, that's a really good perspective that you shared.

Madison Farabaugh: Yeah, and I know, kind of, hopefully steering away from the FUD aspect of things, but I'm definitely curious outside of AI if there are any trends in just the research that you're reviewing and what you're hearing from organizations. Is there any next big threat on the horizon, or maybe just emerging trends in maybe threat actor behavior that is unique to you that you're kind of paying attention to these days? 

Ken Underhill: I don't know about unique. We're just seeing more threat actors, and this is broader for the industry. We're seeing threat actors leverage, you know, Gen AI, Agentic AI in their attacks more. To me, that's just kind of a trend that's, it's already there, and we'll just see it continuing. Again, you know, some of the research is deep dives that we get on certain threat actor groups. I think more of that would be nice to see. A lot of the research that's pitched to me these days, besides AI, is going to be around identity. So, I mean, and everyone again, a lot of the initial pitch I get is “identity is a new attack surface.” I'm like, yeah, it's, it's been that for, you know, years now. 

So in that case, like if your SMEs are actually working on like, hey, here's a specific attack path we've seen with our clients, and here's how we help them solve it. Like something like that is interesting, and kind of maybe a new angle to look at. Because, again, a lot of people that are pitching ideas out there, whether they're marketers or PR firms, it's more like surface-level ideas that get pitched, and, and that might work for other outlets. I, you know, I don't know, and I understand you got to pitch the broad thing, but for Ken specifically, make it sexy if you can. Give me something sexy to work with because that's, usually, I'll try to cover it. I can't usually do it like same day in most cases, but like I'll tell you, like, hey, yeah, we'll go ahead and get this in the pipeline. Go ahead, you know, send over more details or whatever. Like

Madison Farabaugh: That makes sense. So, in terms of, I guess your preference on, you know, I'm thinking how can how can PR professionals be of better service to you? How can vendors be of better service? So, if they have new research, perhaps that's in the initial stages. Is that something that you'd be interested in, and getting kind of like firsthand look at something, and then perhaps like they keep you in the loop as it develops? Or is there a specific, I guess, type of pitch that really catches your eye that'll help differentiate clients or vendors who might be reaching out to you with kind of what might seem like the same type of pitch?

Ken Underhill: Sure. Any subject line that says free Beyoncé tickets, I'm, I'm opening that email, so I'm guaranteed. As far as like actual pitching, just something short, sweet. Like some emails I get are a whole, I mean, I've had my own companies, done executive leadership and security. So, like, the shorter the better. Like, just hit me with it. Like, a couple sentences. Like, “Hey, team's working on this. Is this of interest with you?” And I'll tell you yes or no on, on it. Like, hey, can you send me more details? Or feel free to, you know, shoot it over and I'll take a look. Same thing with like, guests because we have guest author contributions that come through sometimes. Same thing there. Like if before they write the article, like if they're thinking about an idea and you're wondering, like, is this something we might cover? Instead of them writing everything and taking all that time, just like shoot me a couple sentences. “Hey, they're thinking about this idea.” Like, I had someone today, like, “Hey, this is the idea I'm thinking of,” and I and I shot back. “That's cool. What about also adding this in there?” And, and that doesn't take a lot of emails. It's just a couple, you know, whatever back and forth. So to your question directly on like standing out, it's really just more about making it concise. 

Even if you're just trying to get someone you're working with like quoted, potentially on a, on, you know, like let's say a couple months now, but like when Shiny Hunters grabbed Udemy's data, and that was a big, you know, thing going on. I think late April, maybe I could have that wrong, could have been May, but, but like something like that. Just like instead of saying, I would say almost like instead of saying, "Do you want a quote from Christine?”, like just send me the quote from Christine on a thing and then if I can use it, I'll try to incorporate it again. Keeping in mind, I'm not going to incorporate 400 pages of quotes in an article, but, but things like that. So, like, reaching out about ideas, just a couple sentences like here's what we're working on, or or what's upcoming, etc. And then I'll ask, I'll usually ask you if you haven't included a date for embargo. I'll say, is there an embargo date for that? Like a lot of the Black Hat stuff and DEF CON stuff for next week is under embargo still, and then it's specifically around like quotes. Just like send them, like “Hey, if you're covering this, here's a quote for it.” You know, I may not always respond to your email, but if I do, if we do write an article and, do, I do include like a quote from your SME in it. I'm gonna shoot you an article link, you know, with the and say, hey, I use some of the quotes in this.

Christine Blake: No, that's good. Good to know. I'm sure you're getting a lot of pictures about Black Hat.

Ken Underhill: That’s all we’ve been getting.

Christine Blake  All that for next week. No shortage of that. I'm curious now. What is one of the most memorable stories or topics that you've written about?

Ken Underhill: I don't know about memorable. I mean, I feel at, at this when I say at this age, I feel like I'm in my 70s, but I'm definitely not. But at this age, I've kind of seen everything, and a lot of it boils down to fundamentals. I would say, I don't know, about, yeah, I, I don't know about like coverage I've done over the years. I would say the thing I liked the most in media in general that I enjoyed doing was years ago. I had a cybersecurity television show, ran that for a few years, and some of the first episodes, of course, I was smart enough to launch it right when COVID was happening. So trying to film in studio, like, I only filmed a few episodes in studio. 

But anyways, I was able to bring on some local kids and tried to show them lock picking. We didn't actually, spoiler, we didn't actually get any locks opened. But that, for me, was like a fun media thing to do, like working with the kids and, and teaching them something around cybersecurity and kind of sparking that interest. One of the, one of the kids, Isaiah, like he would not stop talking about being on the show for like, I mean, he still talks about it, and he's in high school now, so high school. Yeah, he's in high school now. So, so that for as far as like media marketing related things, that was actually the most, like they're the coolest, most interesting thing to me. It's not, it's really not been any news that I've covered. Sorry for anyone out there that's pitched me news. It's, it's not the, it's just kind of like the news is the news. It's always happened in the industry.

Christine Blake  No, I love that, and you have such a diverse background of different, different things that you've done, right? So I think it's cool to have something that impactful as that, as that show. What was the name of the show?

Ken Underhill: It was called Cyber Life. I've got, if you Google my name or if you look up my name on YouTube, I've got a channel that I don't, I haven't done anything with it in years, but I have some of the old episodes uploaded on there from the show. When I actually had the show going. It was professional, like fancy distribution and expensive. YouTube's free, so I put the episodes on that when I stopped the, the show. So there are some episodes, and you'll see the one I'm talking about with the kids and the, the lock picking.

Christine Blake: That's great. Yeah, we'll check that out.

Madison Farabaugh: Yeah, I love that. And just thinking about other side quests that perhaps you've pursued before, so you have a cyber show, and then the other item that we wanted to ask about was about your book, Hack the Cybersecurity Interview. We saw that you had written that, and we're just curious what the inspiration was behind that, and if you have any future plans for writing additional books.

Ken Underhill: Oh boy, I'll address the second part first. No future plans. Having gone through the book process, so initially the book, I like, I kept getting, and I think, I, I think I started the book in 2021, maybe I forget exactly when that contract started for the first the first edition, but anyways I I kept getting a lot of the same questions around like job interview prep on LinkedIn, and I was like I literally cannot respond to hundreds of people a day anymore, so that's where the idea initially came from. Because Pack, the publisher, had reached out, like, "Do you want to write a book? I'm like, "I don't know about a book”. So, anyways, I started the book myself. I then realized how much a book actually takes, as far as time and work and effort and all that stuff. And I was like, "Let me use my social engineering skills and convince Tia and Chris to write the book with me,” which I did. And so they came on to help write the book and write different chapters. So we launched the first edition that became an international bestseller, adopted by several companies. 

I actually knew, knew as part of their interview process for different cybersecurity professionals. Based on the success of that, we then were able to write the second edition of the book, and that also became a bestseller out there. And I think that edition is actually better. One thing I did want to add on the cover: we did have to fight a little bit to keep the, the same cover for the second edition because they wanted to like change it up. Yeah. For me, my, my wife's black, and so for me it was important because I, I taught her some web development like years ago. She, she doesn't do it by the way, but, but she was like, oh, this is cool. I never thought I could do you know something technical because she never saw anyone like her growing up that, you know that, was able to do that. Obviously, nowadays with social media, it's easier to see someone that looks like you doing these things, but, but kind of based on that conversation we had years ago when we first got together, it was very important for me to number one have a black woman in tech on the cover, and number two not have some something on the the cover that was a traditional like ghost-looking hacker in a hoodie thing. Although the, the person does have a hoodie on, but that's a different story. So, but again, it was important for us to keep that same kind of image because it's you know for me personally that was a very thing. So I always like to mention that on podcasts because I think a lot of people just see the cover and they kind of gloss over it. 

They don't understand like the deeper meaning, at least for me, in writing the book and specifically having that, that cover on there, and the, one of the most meaningful, well, two meaningful things for me on feedback on the book. Number one was on the first edition. I think it was someone did a LinkedIn post, and they said if it's, “I was about to give up on like cybersecurity or whatever as a career, but then I saw a book with like me on the cover,” and that was like, for me, I was like, “Oh my gosh, so impactful.” I'm not a crier, but I'll admit, I, I teared up a little in the moment. And then the other aspect of it, feedback was someone last year, I sent them a free copy of the book, and they actually they they actually studied it. Most people don't actually study books; they buy it. But they actually studied it, and they were able to actually succeed at the job interview, and, in fact, a couple of the questions they were asked were directly in the book, so they already knew like how I would answer them or how we would answer them. So that allowed them to, you know, to move forward in the process, and ultimately they got the job offer when they had been searching I think like eight or nine months to try to get a job.

So those two things were very impactful for me on writing the book, but yeah, no future, no future plans right now on another book. It's just, it's a ton of work for anyone that's thinking about writing a book, and then also like, working with a publisher, there's, you know, a lot of chefs in the kitchen, so you can't fully do exactly what you want to do from a creative standpoint if you use a publisher on the book, so. 

Christine Blake: It does sound like a lot of work, but it seems like it was very rewarding since you got such great feedback and really helped people. So congratulations on that. That's amazing. 

Ken Underhill: Thank you. 

Christine Blake: Yeah, we have a couple listener questions also, we want to ask you. The first one is: Do you have anything planned for the rest of the year? I know we have Cybersecurity Awareness Month in October, we have the predictions that happen every year in the, in the cybersecurity industry. Just curious if there's anything you have in mind for the rest of the year.

Ken Underhill: Yeah, so we, we typically do those. Typically, do some kind of like usually maybe just like one article or a couple of articles in a, in a series for like for Security Awareness Month. Same thing with the, the trends. Usually that'll come out around December, and from that kind of to our earlier conversation on like pitching ideas. Usually PR firms will, at least my experience last year, I've only been doing this less than a year, but around a year or so, but pitch ideas like if you got SMEs that want to give their predictions, can't guarantee inclusion, but when we do write on that, we can get those in there as well. Kind of talking about like maybe conferences. I'm not going to Hacker 

Summer camp in Vegas. I'm a total introvert, so I try to. I didn't go this year. I may go next year. I don't know. A lot of people want to be out there, so maybe I will. Maybe I won't. We'll see. But I am going to CrowdStrike’s Fal.Con, which is end of August, early September, and then also Proofpoint’s conference, which I think is third week of September or so. So I'll be writing on those conferences. 

So we do typically like write on different conferences that are upcoming as well. So just something to keep in mind for those that are thinking ahead to like RSAC next year, or even Black Hat, DEF CON conferences. We do write on those, but again, not about your latest widget launching. It's about, you know, research that you're publishing, or even if you've got SMEs that are going to be doing talks, you could send their slides or notes to us under embargo. We could write something on it and then launch it after their talk goes live, and that's actually gotten a lot of traction. We did that for RSAC for a couple people, and those articles got a lot of traction in the first couple weeks around the event because the talk was related to the article, and then I don't know how many people actually clicked through and viewed the actual recording, but at least the articles themselves got a ton of views because they were related to the talk and they were more timely news. So, something to keep in mind for future conferences for your SMEs that, you know, we are always writing around conferences, especially the big ones.

Christine Blake: That's great to know, and that kind of reporting is, I think, really timely because people who can't go to the event can read what's happening in the sessions, right? So that's a good idea.

Madison Farabaugh: Yeah, that's great. And then one of our other listener questions, just from your perspective, working in the media landscape, have you noticed any major changes? So a lot of times we've been hearing a lot about how AI is impacting journalism, and perhaps whether that is in the writing, content development, or even the publishing aspect of that. So, AI-related or not, is there anything that you've been noticing recently in the media landscape?

Ken Underhill: Yeah. So, you, you do see a lot more like layoffs for writers in general across industries, just because the, the mindset is, oh, we can just use AI. There are a number of outlets that I can look at their news and I can tell it was AI-generated and that it didn't necessarily have someone go through detailed like looking at it like is this actually accurate? I think the, the bigger concern, and we saw that with PwC recently in the news of AI-generated content that's not being fact-checked. So I'll say we, we use Gen AI as part of the workflow, it does speed up writing. It can help you like rewrite things. Like I might be like, "Does it make sense? Help me rewrite. Give me some options to rewrite this. However, we have as an organization, we always have human in the loop, so AI could maybe get you like let's just say 20% of a draft, and then 80% as a human going through, and then it goes through another check of editorial to have you know. 

So, so anything we write, we may use AI for, like, idea simulation or to maybe kind of help draft an initial draft, but that's going to have humans go through it. And I think the, the bigger lesson for any company out there, any business owner, any senior leader is that you can't replace humans with AI. We've tested it with. Oh no, I can't. I think Quill is the one. We've tested it with, like ChatGPT, Quill stuff like that, to try to see like could we get a, a good AI draft that would be maybe like 80% of the way there and just need a little touch touching of the human, and it's just disastrous at this stage. So maybe AI at some point will get there, but right now I think the big lesson companies need to realize like you can't fully replace writers with AI because right now I can look at stuff and I, I can look and say that's AI slop and I can see that in like seconds. 

So if I was actually your audience, which I am a lot of times looking at the news, I'm like that's that's junk, and I look away. Being someone in media, I still have to like look at the other outlets of news. But for me, as like a news or as a person consuming news, I immediately look at other sources for the news. What I see is just AI slop. So I also see that on like articles on company websites and things like that. So I think the lesson I just want people to know is like AI is not going to replace humans right now for the writing, and I don't think it should. It helps speed up, but it's just a tool. It's a tool, and you still need someone to like, fact-check things because I've seen some other big companies, and I've been looking at some of their things, and like, I look at the actual citation, which is not actually a real statistic, and I'm like, that's, that's not real. And I reach out to them and say it, but some of them still don't change it. So I think, I think the lesson there around AI in general is like it's not going to replace humans, and you need to have that human in the loop no matter what.

Christine Blake: Yeah, well said. And to your point, I think a lot of people are becoming better at detecting what's written by AI, like even I can be like, oh, that LinkedIn post is written by AI, like. So I think we're getting better at that as a whole too, which furthers your point of we can't replace it. So not a listener question, but you mentioned Beyoncé tickets, so I need to ask, what is your favorite Beyoncé song?

Ken Underhill: Oh gosh, I I don't know. I I couldn't tell you. I don't have a favorite. I joke about Beyoncé. My wife's more of a Beyoncé fan, so she could probably name a favorite song. I do know that I think she's going on tour next year, or at least that was alluded to. So I already know. I've already been told by the boss that I need to make sure we have good seats for the show if it comes out.

Christine Blake: Definitely. Well, Ken, thank you so much. It has been a pleasure talking to you and hearing more about your role and what you're covering. We really appreciate your time today.

Ken Underhill: Yeah, thanks for having me. I appreciate it.

Christine Blake: Thank you for listening to today's episode of Inside the Media Minds. To learn more about our podcast and to hear from some of our past guests, please visit us at W2comm.com.

Madison Farabaugh:  You can also subscribe anywhere podcasts are found.