Marketing for cybersecurity products often leaves consumers less secure

You have likely seen multiple ads for products and services designed to make you more secure online. When you turn on your television, see online ads, or even when you get in-app notifications, you are likely to encounter cybersecurity technology marketed as the ultimate solution and the last line of defense against digital threats.

Cybersecurity is big business^[1], and tech companies often sell their products based on fear^[2]. These campaigns are often rooted in what I call the technology vs. user cycle, a feedback loop that creates more problems than it solves.

It works like this: Cybersecurity companies often market their products using tactics that emphasize fear (“Hackers are coming for your data!”), blame (“It’s your fault if something happens!”) and complexity (“Only our advanced solution can protect you”). They perpetuate the idea that users are inherently not savvy enough to manage security independently and that the solution is to adopt the latest product or service^[3].

As a cybersecurity researcher^[4], I find that this approach often has unintended, harmful consequences for people^[5]. Rather than feeling empowered, users feel helpless, convinced that cybersecurity is beyond their understanding. They may even develop techno-stress^[6], overwhelmed by the need to keep up with constant updates, new tools and never-ending warnings about threats.

Over time, this can breed apathy and resentment. Users might disengage, believing that no matter what they do, they’ll always be at risk. Ironically, this mindset makes them more vulnerable as they begin to overlook simple, practical steps they could take to protect themselves^[7].

The cycle is self-perpetuating. As users feel less secure, they are more likely to demand new technology to solve their problem, further fueling the very marketing tactics that created their insecurity in the first place. Security providers, in turn, double down on promises of fix-all solutions, reinforcing the narrative that people can’t manage security without their products.

Ironically, as people grow dependent on security products, they can become less secure. They start ignoring basic practices, become apathetic to constant warnings, and put blind trust in solutions they don’t understand.

The result is users remain stuck in a loop where they depend on technology but lack the confidence to use it safely, creating even more opportunities for people with malicious intent to exploit them.

Cybercrime evolution

I’ve worked in cybersecurity since the early 1990s and witnessed the field evolve over the decades. I’ve seen how adversaries adapt to new defenses and exploit people’s growing reliance on the internet. Two key shifts, in particular, stand out as pivotal moments in the evolution of cybercrime.

The first shift came with the realization that cybercrime could be immensely profitable. As society moved from paper checks and cash transactions to digital payments, criminals found that accessing and stealing money electronically was relatively easy. This transition to digital finance created opportunities for criminals to scale up their attacks^[8], bypassing physical barriers and targeting the systems that underpin modern payment methods.

The second shift emerged over a decade ago as criminals targeted individuals directly rather than just going after businesses or governments. While attacks on companies, ransomware campaigns and critical infrastructure breaches still make headlines, there has also been a rise in attacks^[9] on everyday users. Cybercriminals have learned that people are often less prepared and more trusting than organizations, and so present lucrative opportunities.

This combination of digital financial systems and direct user targeting has redefined cybersecurity. It’s no longer just about protecting companies or critical infrastructure; it’s about ensuring the average person isn’t left defenseless. Yet, how cybersecurity technology is marketed and deployed often leaves users confused and feeling helpless.

References

1. ^{^} is big business (www.gartner.com)
2. ^{^} based on fear (doi.org)
3. ^{^} adopt the latest product or service (www.antwerpmanagementschool.be)
4. ^{^} cybersecurity researcher (scholar.google.com)
5. ^{^} harmful consequences for people (doi.org)
6. ^{^} techno-stress (doi.org)
7. ^{^} to protect themselves (www.nist.gov)
8. ^{^} scale up their attacks (doi.org)
9. ^{^} rise in attacks (www.ic3.gov)
10. ^{^} Luis Alvarez/DigitalVision via Getty Images (www.gettyimages.com)
11. ^{^} shared responsibility and empowerment (www.nist.gov)