By: Sarah Graham
I posted a quick version of this list on LinkedIn a couple of weeks ago, and the response told me it was worth doing properly. So here it is, expanded, with a little context on why each of these people earned a spot in my feed.
A quick note on why this matters, especially if you do PR or comms in this space. The cyber news cycle is brutally short. A breaking story has a two to four hour lifespan unless the news is truly major. If you want to be useful to a reporter inside that window, you have to already know who covers your category, how they think, and what they tend to write. You can’t build that relationship at minute zero of a breach. Following the right people, reading what they publish, understanding their beat before you ever pitch them is the homework. It’s also just a great way to stay smart on where cyber and AI are heading.
Credentials and reputation matter a lot in this industry, on both sides of the byline. The folks below have earned theirs. Here is who I keep up with, grouped roughly by what they do.
The breaking-news machines
These are the reporters and outlets that move fastest on threat intel, breaches, and vulnerabilities. If something is on fire, they are usually first to it.
🔸 Brian Krebs, KrebsOnSecurity. One of the most influential independent cybercrime investigators working today. Sixteen-plus years of agenda-setting investigative work.
🔸 Catalin Cimpanu, Risky Business Media. His Risky Business News newsletter is required reading. One of the best high-volume curators of global cyber news anywhere, and a great signal for what matters versus what is just loud.
🔸 Bill Toulas, BleepingComputer. BleepingComputer breaks an enormous volume of fast, technical security news, and Bill is one of its most active reporters. Malware, breaches, exploits, open-source security, he is on all of it.
🔸 Matt Kapko, CyberScoop. Deep, technical coverage of ransomware, vulnerability management, and software defects at a respected pure-play security outlet.
🔸 AJ Vicens, Reuters. Cybercrime, nation-state hacking, ransomware, threat intelligence. He recently jumped to the wire, so his bylines now reach a huge mainstream audience.
🔸 Kevin Poireault, Infosecurity Magazine. Steady, technical coverage out of the UK, with strong attention to stories beyond the usual Western lens. Great for European reach.
The mainstream cyber reporters
These reporters take cyber to audiences well outside Dark Reading. Their stories break through, which is exactly the goal when you’re trying to make cyber matter to a general reader.
🔸 Sean Lyngaas, CNN. One of few dedicated cyber reporters at a major broadcast outlet. Nation-state threats, government defense, corporate breaches. Mainstream reach with real subject-matter depth.
🔸 James Rundle, WSJ Pro Cybersecurity. WSJ Pro is the premium outlet for CISO and board-level coverage.
🔸 Sam Sabin, Axios. Her cybersecurity newsletter is a real executive read, written for security leaders and the people who fund them. Policy, nation-state threats, election security, AI security.
The AI and enterprise crossover
Cyber doesn’t live in a silo anymore, and the AI conversation is eating everything. These are the people I follow for where security, enterprise tech, and AI collide.
🔸 Louis Columbus, VentureBeat. One of the most prolific writers on the AI-meets-cybersecurity beat. Agentic AI in the SOC, AI-native security operations, adversarial AI.
🔸 Aaron Holmes, The Information. The premium subscription outlet for tech-insider scoops. He is strong on Microsoft and the big enterprise AI developments.
🔸 Anissa Gardizy, now covering AI infrastructure and the compute behind the boom (data centers, cloud, Nvidia).
🔸 Ron Miller, FastForward. A veteran enterprise-tech voice who spent over a decade at TechCrunch and now runs his own thing. Deep founder and VC relationships, great on enterprise AI and infrastructure.
🔸 Ashley Capoot, CNBC. AI and health-tech coverage at a major business-news outlet.
🔸 Billy Hurley, IT Brew. The Morning Brew format reaches practitioners daily in a refreshingly readable way, and he covers the AI-security crossover heavily.
🔸 Megan Poinski, Forbes. She writes for a C-suite audience on business and AI themes (tariffs, taxes, workforce, AI in the enterprise).
The channel and B2B editors
These are the editors who own stories on products, partners, or the vendor ecosystem.
🔸 Kyle Alspach, CRN. The channel and vendor voice. Often covers security companies with partner stories or product launches.
🔸 Sharon Florentine, CyberRisk Alliance (ChannelE2E, MSSP Alert, and more). A senior editor steering several channel and MSSP outlets, with 25-plus years in tech media.
🔸 Edward Targett, The Stack. Co-founder of a sharp B2B-tech outlet with strong enterprise and CISO readership. Cloud, infrastructure, security.
🔸 Tony Bradley, TechSpective and Forbes. He wears the journalist and the analyst hat at once, with multiple bylines plus a podcast platform. Enterprise IT, security, emerging tech.
The industry voices (not reporters, but follow them anyway)
These are experts, executives, and conveners whose takes shape the conversation. Following them keeps you smart, and they are often the amplifiers and sources that make a story credible.
🔸 Jen Easterly, now CEO of RSA Conference after leading CISA. A major industry figure and convener on national cyber policy, public-private defense, and secure-by-design.
🔸 Roger Grimes, KnowBe4. Data-driven defense evangelist, longtime columnist, author of 15-plus books.
🔸 Dr. Chase Cunningham, “Dr. Zero Trust.” Creator of the Zero Trust Extended framework and the most recognizable Zero Trust evangelist out there. A great source on security strategy.
🔸 Chris Hickman, CSO at Keyfactor. A leading voice on PKI, digital identity, and post-quantum cryptography, which, if you have read anything else I have written, you know I think is the bigger structural story most boardrooms are not tracking yet.
A few honest caveats
This list reflects who I personally follow and find useful. A couple of these folks lean more AI-and-business than pure cyber, and I’ve flagged those. Roles change fast in this industry, so titles and outlets are accurate as of writing, but reporters move.
And to be so frank, this is not exhaustive. There are many more people I am surely forgetting, which means there will likely be a part 2.
If you are in cyber or AI comms and you’re not already keeping up with most of these voices, that is the easiest fix in your whole program. Start there.
Kickstand helps cybersecurity and tech brands build the kind of influence that earns coverage in 2026. If your earned-media program could use a hand, come say hi.
