Estimated reading time: 9 minutes
If you run marketing, you hold much of your company’s customer data. Graylog CMO Kimber Spradlin returns to the CINI podcast to explain why that puts you in the security business. She covers cheap plugins, AI tools, the CISO relationship, and the cyber insurance application.
You probably measure marketing in pipeline and revenue. Getting there means collecting customer data, adding third-party tools, and sharing information with vendors. Each of those steps adds risk to the business and the brand. That makes marketing data security a CMO’s problem too.
“Marketing holds a lot of non-employee data, a lot of customer data,” said Kimber Spradlin, chief marketing officer at Graylog. “That data can reside in a lot of different systems.” Graylog sells log management and security analytics software.
Spradlin came to marketing from security. She started in accounting and information security consulting at Ernst & Young. Product roles followed at NetIQ, Embarcadero Technologies and IBM, where she focused on endpoint security. She founded her own firm, Engineered Marketing, and has led marketing at Graylog since 2018.
She first joined the podcast in December 2025 to explain cybersecurity to everyday people. This time the subject is her own department.
Marketing Data Security Starts With What You Collect
In B2B marketing, the data looks ordinary. A work email, or sometimes a Gmail address. A job title and an employer. A home address, given for a thank-you gift. Phone numbers often arrive through data enrichment. Marketers also buy firmographic, demographic, and technographic data from enrichment vendors. Consumer brands hold far more, including purchase history.
“It’s not necessarily any one piece of data,” Spradlin said. “When you get that whole profile together, if a bad actor were to acquire all of that, it could be very damaging to that individual, not just to the company they work for.”
AI raises the stakes. Marketers now mine call logs and other unstructured data to learn how prospects found them. Teams can build visitor profiles “that may not technically run afoul of PII laws, but wouldn’t necessarily make our prospects happy,” she said. Prospects would be less happy still to learn that data went unprotected.
The $15 Plugin Problem In The Martech Stack
The big platforms get scrutiny. HubSpot, Salesforce and Marketo go through procurement, Spradlin said. They come with SOC 2 reports, single sign-on and multi-factor authentication.
The risk hides in smaller purchases. “Where marketing can introduce a lot of risk unintentionally are these smaller tools, these hundred-dollar-a-month tools,” she said. She listed WordPress plugins, some free and some $15 a month, along with tracking pixels and form builders. Teams often buy those on expenses and skip full procurement.
“The totality of those, I think, can definitely introduce some risk,” she said.
Vendors also bring their own vendors. “You’ve got kind of pass-through situations where I’m working directly with one vendor, but that vendor has a relationship with another vendor,” Spradlin said. A tracking pixel that enriches visitor data is one example.
That kind of chain has failed before. In August 2025, attackers stole OAuth tokens from Salesloft’s Drift chat integration. They used them to pull data from Salesforce instances at many companies, Google’s threat intelligence team reported. Nudge Security CEO Russell Spitler told CINI he has yet to see an insurer ask which SaaS apps a company uses.
Marketers now write code too. AI tools let teams build their own websites and are “vibe coding our own little ROI calculators and analysis tools,” Spradlin said. That raises a new question for marketing: are there flaws in that code that an attacker could exploit?
Size offers no cover
“A lot of these attacks are fully automated. They don’t know who you are. They don’t know how big you are,” she said.
Her method starts with what could go wrong. “The right way to really approach it is to think about the risks first,” Spradlin said. Graylog’s website is informational, so the main risk is reputation. “If somebody were to deface my website, that would make me look very bad to my customers,” she said. Forms that feed the CRM and marketing automation platform are another possible way in. From there, she traces every system the data touches.
Marketing Data Security Needs The CISO
CMOs work closely with the CEO, the head of sales and the CFO. The CISO gets less time. “It’s not that we ignore the CISOs, but they do end up a little bit on the bottom of the list,” Spradlin said. She called it the relationship that “gets the least amount of attention.”
Marketers sit where IT, cybersecurity, and legal meet, she said. The website, the marketing automation platform and the rest of the martech stack all fall under data privacy law.
For a CMO who doesn’t know the CISO, her advice is short. “Find out for sure. That’s step one,” she said. Then talk at least once a month. Before any new build, data source, tracking pixel, or AI analysis, ask whether it introduces a security risk.
“If the answer is I don’t know, and that is a valid answer and probably a very common one, just go ask,” Spradlin said.
Get The Cyber Insurance News Upload Delivered
Subscribe to our weekly newsletter!
What A Breach Does To The Brand
Breach fatigue has made customers more forgiving, Spradlin said. Nearly every major brand and government agency has suffered a breach. Most of those breaches made the news. Even security vendors get some slack, she said. How much depends on whether the company was negligent or faced a hard attack.
“So that lets us off the hook a little bit. Kind of wish it didn’t in a way,” she said.
The damage is still real. “You will definitely have decreases in revenue; you will have increases in customer churn after a major data breach,” she said. “And it can take three to five years to recover a brand’s reputation.”
Hard costs such as forensics, cleanup, and credit monitoring are easier to count, Spradlin said. She uses IBM’s Cost of a Data Breach study as the benchmark. Brand harm is harder to trace, because markets and competitors change over those years too.
A vendor’s leak lands on you as well. If a tool on your website leaks visitor data, “they’re still going to attribute that to me because I’m the one that introduced that tool into their world,” Spradlin said.
Marketing And The Cyber Insurance Application
Few CMOs talk to underwriters. “I don’t know too many CMOs that have had direct conversations with their cyber insurance underwriters,” Spradlin said. The questions usually go through IT or security, and sometimes legal or compliance.
She sees value in bringing marketing in. “It’s not a terrible idea to do some verification, to sit down with the marketing team, at least the CMO, and make sure that they understand what is and is not covered by that policy,” she said. She would focus on the website and on any part of the product that marketing controls. “In a SaaS world, marketing can be fairly deeply embedded in the product itself,” she said.
Insurers can deny claims over incomplete or misleading application answers, Spradlin said. Her first check is basic. “Is the inventory of the systems complete? Did marketing contribute to that?” she said. The person filling in the form “may not know everything that the web team is using,” she said. That gap can include pass-through tools, account-based marketing platforms, and intent-data systems.
How CMOs Can Lower Cyber Risk
Spradlin likes turning the question around. “This flips it around from where do we introduce risk to where can we help lower risk and maybe even lower the premiums that we’re paying on our policy,” she said.
“It’s really a matter of keeping your house clean,” she said. Her checklist for marketing teams:
- Have you really turned off retired tools and removed every account?
- Did you clean your data out before leaving a vendor?
- Did you remove former agencies and contractors, including from Slack channels?
- How long do you keep old customer data?
- Do you need thousands of event attendee records when you spoke to 50 or 100 of them?
Marketing and security pull in different directions, Spradlin said. “We’re connectors,” she said. Marketers want to link data, prospects and customers. Security wants systems kept apart, so one breach does not expose everything about a person.
Her advice to fellow marketers is to make time for marketing data security every week, “especially as fast as we’re moving with AI.” Start by finding out who your CISO is.
FAQ – Marketing Data Security
Why is marketing a cybersecurity risk?
Marketing holds large amounts of customer data across many systems, and it adds third-party tools quickly. Graylog CMO Kimber Spradlin says each tool and data source can add risk.
What customer data does a B2B marketing team hold?
Work and sometimes personal emails, job titles, employers, phone numbers, home addresses for gifts, and firmographic, demographic and technographic data bought from enrichment vendors.
Which marketing tools carry the most risk?
Spradlin points to small tools bought on expenses: WordPress plugins, tracking pixels and form builders. Large platforms usually go through procurement and security review.
Should CMOs talk to cyber insurance underwriters?
Few do. Spradlin says the CMO should help check the application’s system inventory and understand what the policy covers.
How can a CMO lower cyber risk?
Turn off unused tools and remove their accounts, clean data out before leaving a vendor, remove former agencies’ access, and delete customer data you no longer need.
How long does a brand take to recover from a breach?
Spradlin says brand surveys put it at about three to five years.
Download the full transcript:
The transcript is machine-generated and lightly edited. It may contain errors. Please check the audio before quoting.
Related Cyber Insurance Posts
- Insurers Made MFA Standard. Now They Need To Ask Which Kind.
- Cybersecurity Starts With Understanding: Graylog’s Kimber Spradlin on Data Clarity, AI Limits, Cyber Hygiene and Mom(Opens in a new browser tab)
- Silent Push Says Impersonation Monitoring Belongs In Underwriting. The Loss Data Does Not Exist Yet.(Opens in a new browser tab)
- Cybersecurity Incidents Surge As Identity Attacks Dominate 2026 – Sophos Report(Opens in a new browser tab)