In November 2022, Medibank told its extortionists no. The criminals held personal records belonging to 9.7 million Australians, and the insurer announced it would not pay a cent for them. The data hit the dark web. The headlines ran for weeks. Three years later, that refusal is still the first thing most Australians can tell you about any cyber attack in this country's history.
Hold that thought, because it explains more about security marketing than any funnel diagram. A nation forgot tens of thousands of incidents and remembered one decision. That is what a story does, and it is the thing most cyber security marketing never builds.
The statistics wash over everyone
The Australian Signals Directorate logged 84,700 cybercrime reports in 2024–25, roughly one every six minutes, and the average incident cost the business that reported it $80,850. Those numbers come from the ASD's Annual Cyber Threat Report, they are accurate, and they are almost perfectly forgettable. Quote them to a board in March and nobody will produce them in April.
Security vendors keep marketing as if the opposite were true. The pitch opens with threat figures, moves to a feature grid and closes on a compliance checklist — material a buyer cannot repeat an hour later, let alone defend in front of a chief financial officer.
And a buying decision has to be repeated. The CISO who likes you must convince a CFO who has never met you, who answers to a board that will never read your white paper. Whatever you handed the CISO is not what moves up the chain. Stories travel. Feature lists don't.
Why stories stick when facts slide off
Chip and Dan Heath spent years at Stanford working out why some ideas survive retelling while most die on contact. Their answer, in Made to Stick (2007), is that sticky ideas share six traits: they are simple, unexpected, concrete, credible, emotional, and they come wrapped in a story. The last trait does the heavy lifting, because a story carries the other five inside it.
A story compresses an abstract risk into a particular afternoon. The invoice that looked right. The contractor password nobody rotated after the project ended. The backup that had not been restored since the office moved, discovered on the one morning it mattered. A buyer who hears a story like that does not file it under marketing. They go and check their own invoices.
That suggests a test worth running on your own message. Could the CISO who champions you retell it, in their own words, to a board member in a lift? If what they would retell is a feature list, the answer is no, and the deal is travelling on someone else's story.
The sticky version is already inside your company
The strongest security stories are usually sitting unused in the places vendors least want to look. The 2am call a client actually made, and what happened in the following hour. The audit that failed, and what fixing it cost. The incident your team caught at the third step of a kill chain that had seven.
Vendors bury these stories because they feel unpolished, and polish is the problem. A story with friction in it reads as true. A story in which everything works reads as an advertisement, and buyers who are sceptical for a living discount it on sight. Sharing how an incident actually unfolded, including the part that went wrong, builds more trust than any certification badge, because it is the one thing a competitor cannot copy.
The working rule we give clients is narrow on purpose. One idea, told as a story a buyer can carry into a room you will never enter. Then measure what comes back: meetings with the people you named, not applause from strangers.
Medibank never planned its refusal as marketing, and it would be obscene to call it that. But three years on, the company's no is still doing work no campaign could do. It is the story strangers tell about the business, unprompted, with the ending attached. Your buyers are already carrying a story about your category into every budget meeting. The only question is who wrote it.
