Martin Hinton (00:00)
This is the Cyber Insurance News and Information Podcast. I'm Martin Hinton Executive Editor. Every week we talk to the underwriters, brokers, and security leaders shaping the market.

Martin Hinton (00:11)
Whether you're new or back for more, if you haven't hit follower yet, do it now so you don't miss an episode, and thank you.

Martin Hinton (00:18)
Welcome to the Cyber Insurance News and Information Podcast. I'm the executive editor and your host today, Martin Hinton My guest today is Kimber Spradlin, Chief Marketing Officer at Graylog. Kimber first joined us in December of 2025 to talk about explaining cybersecurity to real people. She came to marketing the long way around. She started an accounting and information security consulting at Ernst & Young. Product roles followed at NetIQ, Embarcadero Technologies, and IBM, where she focused on endpoint security.

She later founded her own firm, Engineered Marketing,

and has led marketing at Graylog since twenty eighteen. Kimber, welcome back.

Kimber (00:55)
Thank you for having me, appreciate being back here again.

Martin Hinton (00:59)
in the first show, as I just discussed, we just talked about how to explain this to everyday folks because it's an everyday person problem. Today we we wanted to talk about the marketing department, which most people associate with driving revenue. But there's an enormous amount of very sensitive data collected in the process of that. And that makes you important safeguards of any company's cybersecurity. So tell me a little bit of that just broadly.

Kimber (01:25)
Yeah,

I mean, I don't think it's a a big surprise to anyone, but marketing holds a lot of non-employee data, a lot of customer data. and that that data can reside in a lot of different systems. And so we're often focused on, you know, building pipeline, helping generate revenue. we're we're all used to privacy notices on our website, but there's a lot of complexity and a lot of systems that sit underneath.

Martin Hinton (01:55)
I mean, from the from the human perspective, you you touched on the the primary responsibility and goal of marketing. There are secondary goals. And as we know, when people get busy and stress and deadlines arrive, they can become secondary. Does does the cybersecurity get pushed down the list of priorities? And how do you how do you avoid that happening to make sure people, you know, take that extra second, add that friction to maintain the security so that, you know, you you don't run into a situation where you're apologizing, if you will.

Kimber (02:24)
Yeah, I mean it's a tough one for marketers because at the end of the day we're responsible for the brand. And marketers, you know, care a lot about protecting the brand and keeping it there from being harm. And so of course, any kind of data breach that involves customer sharing, come customer information sharing out of a marketing system would be very bad, right? And and so that's always in the back of our minds. But at the same time,

There's a lot of complexity. And so depending on your background as a marketer, you may not have the technical knowledge necessary to really understand the implications of all the decisions that you're making on a day-to-day basis. We all go through our cybersecurity awareness training, right? Don't click on the links in the emails. When you see something that, you know, looks too good to be true, forward it over to the to the security team to take a look at.

But that's that's just the very surface level of of getting into, you know, some pretty technical systems behind today's marketing tech stack.

Martin Hinton (03:33)
I mean you t you touched on awareness. I you know, I mean I I I I've done a bunch of reporting lately, as you can imagine, in Cybersecurity

Kimber (03:39)
yeah.

Martin Hinton (03:39)
Awareness Month, about CISOs and the role of CISOs and the integration they have looking up or maybe horizontally across, say, the C Suite, but but typically the CFO, the board, people they're asking for money is the sort of, you know, at least a consistent friction point in that relationship.

What about your experiences or you know, what do you hear about CISOs and and chief marketing officers and and the relationship that exists there around maintaining, you know, good practices, the right concerns. And also, you know, we know these threats are dynamic and and changing rapidly and there's AI. What about that relationship?

Kimber (04:14)
Yeah, I think it's a really important one and probably the one that gets the least amount of attention. certainly as CMOs, you know, we work very closely with our CEOs, our heads of sales, our CFOs, where you know our budget comes from. And it's it's not that we ignore the CISOs, but they do end up a little bit on the bottom of the list. Now I'm fortunate enough to work in a a little bit of a smaller company, and so

so I and and with my background have a very close relationship with my CISO. But I think on average that is not as true as it as it should be. And marketers sit, you know, with with the data privacy laws kind of at the intersection of a a really interesting IT, cybersecurity, and legal intersection between the website and

marketing automation platform and and all of the Martech stack. And AI is just making it worse in many ways. We're, there is so much unstructured of data available to us now that we're analyzing for all of these insights, for understanding how customers and prospects came to our businesses, what caused them to, to engage with us as a, as a business or an organization.

But that's just making the problem worse, right? As we begin to have access to call logs and and mass amounts of other unstructured data. Now we can begin to build profiles around those that are visiting our website and engaging with us in other ways that may not technically run afoul of PII laws, but wouldn't necessarily make our prospects happy.

If

they

if they came acr you know, if if they were to learn that that that you had all that information and that you didn't protect it properly.

Martin Hinton (06:21)
You I mean you you you i the MAR tech stack is the marketing tech stack you touched on, and I mean that's you know, what, Hubspot Salesforce, you know, the the th those are sort of external tools that the marketing department will use, you know, maybe not outside obviously the awareness of an IT or cybersecurity team, but what kind of customer data sits on those platforms? you know, I one of the things that's still very abstract is how any of my personal information can be all that valuable. And we know that's not true, but it's still

kind of weird.

Kimber (06:52)
Mm-hmm.

Martin Hinton (06:52)
We accumulate an enormous footprint when we travel this world, particularly if we live in a digital space, and that's most of us. We leave a lot of marks, if you will, to play on the marketing word across

Kimber (07:03)
Yeah.

Martin Hinton (07:03)
our the spectrum of our lives that is useful to marketers when it comes to helping reach them with your company's information and and seek new customers and that sort of thing. What kind of what kind of data is is useful there?

Kimber (07:15)
Yeah, I think it it varies a lot depending on whether the company is in the the B2B space serving other enterprise businesses or in the B2C space. So I know the B2B space a a lot more. That's just where I've spent my whole career. It's going to be things usually like your work email, but I can't guarantee it because people do submit their Gmail addresses to me. where you work, it may include an address, especially.

in this world of remote working, we do things to send out thank you gifts to our customers and our prospects. And so they may give us a a home address as part of that, maybe a phone number through data enrichment or or in other ways we might have collected that. Their job titles, and then we purchase information from from data enrichment vendors that give us

Firmographic and demographic and technographic data. and yes, that is more for me, that is more on your work side for for a consumer oriented business. That would include a lot of personal information and would probably include purchasing a lot of your data about about things that you've purchased and looked at and and all those kinds of things. So as I said before, it's it's not necessarily any one piece of data.

It may not be, you know, a credit card or banking number or or social security number in the US. It may not be anything that is so obviously dangerous or needing to be protected. But at the same time, when it when you get that whole profile together, if a bad actor were to acquire all of that, it could be very damaging to that individual, not just to the company they work for.

Martin Hinton (09:07)
Yeah, one of the things I I say to people in this context is that there this is a s space or an idea in cybersecurity where quantity has a quality all its own, where the individual

Kimber (09:16)
Mm-hmm.

Martin Hinton (09:16)
pieces may, as you note, be not particularly useful. But when you particularly with the aid of AI now, you can, you know, align these pieces and s sort of put them together like a puzzle pieces, maybe. And and then you realize, look, I now don't just have a piece of, you know, 16 pieces. I have real information that I can act on.

I just wanted to touch on, you know, w w when it comes to best practices for a chief marketing officer, you want to bring in a new tool, you want to bring in an an a a new platform or whatever it might be that is maybe third party or it's it's an add on to people's personal devices or work devices, mobile devices, I should say. what what's the the approach there with the cybersecurity side of things, the IT part of the the company? How how would you suggest people approach sort of thing?

Kimber (10:00)
Yeah, I mean the the big platforms are gonna go through their processes, right? A HubSpot, a Salesforce, a Marketo, you know, in anything where you're spending a decent amount of the company's money, that's usually the threshold. they're gonna have SOC 2, they're gonna have single sign on, you're gonna partner with your IT department to to get that single sign on and multifactor authentication set up. And so

Those are kind of known quantities and they exist. I think where marketing can introduce a lot of risk unintentionally are these smaller tools, these hundred dollar a month tools. It's not WordPress itself, although dealing with a lovely little little is situation this morning on that. So WordPress all by itself can be an issue. but it's it's WordPress plugins, some of which might be free or they might be.

$15 a month, and tracking pixels on the website, form builders, all those kinds of things that that go through more of an expense system than a full-up procurement system. And the totality of those I think can definitely introduce some risk. So the right way to really approach it is is to think about the risks first. So I think about my website and what are the major risks that my website could introduce.

It's not an e-commerce website. It's a very informational website. And so it certainly has brand reputation risk because I am in the cybersecurity space. If somebody were to deface my website, that would make me look very bad to my customers, right? If there we do have you know, forms that lead to our back office automation platforms. So if they were somehow to use that form to

gain access or corrupt our our CRM and our automation platform, that might be another vector. I don't have a login like from my website into a SaaS product. So that's you know one way that that I don't have some of the challenges that others might have. But I think that gives you an idea of how to think about it is to start there through what could go wrong.

And then track through the full flow of all the information and all the systems that touch those those risks.

Martin Hinton (12:30)
I mean it i i I mean, part of what you were just saying reminded me of the the the broad vulnerability across the third party vendors, the supply chain, that every one of these things that you, you know, connect to you yourself or your your your network in some fashion becomes a vulnerability that you need to be sure about. Not unlike, say, you know, people you might let in your home for any number of reasons. You know, do you leave them there alone, that sort of thing. Th this this is the sort of, you know, broad problem we hear about.

with regard to what the interconnectedness of you know economies and tools and devices and that sort of thing. it sort of stands to reason and it and it scales, right? So you can have it at a high level, big companies. But if you're a small, you know, I don't know, I I always say mom and pop florist or something like that, you can you still have to utilize these tools if you're running a business with marketing and they create vulnerability for you. And you are potentially, because of that, subject to some

victimization as a result of, you know, the way cybercrime works. Do you think that's oversimplifying it, or is you think that's that's fair to say?

Kimber (13:30)
No, not at all. and and if I would go even a little bit further, right? You've got you've got kind of pass-through situations where I'm working directly with one vendor, but that vendor has a relationship with another vendor. And so they provide me access to that third vendor indirectly. it includes a tracking pixel on the website to help us with data enrichment to know who's visiting, what kinds of companies are visiting our website and and engaging with our AI superhuman.

And then, you know, now the marketers were we're making life even harder. we, you know, all of these AI tools enable us to begin coding our websites. So we're no longer locked into a templatized WordPress world or a web flow world, right? And so as we begin to really expand our capabilities, then again that knowledge of what

could go wrong? Are there insecurities in that code that could be exploited? What kinds of ways could our website be exploited? Whether maybe it's just capturing it as part of an attack on someone else, right? So really thinking through all of that. But but every organization of every size is at risk. a lot of these attacks are fully automated. They don't know who you are. They don't know how big you are. they're just going to go

you know, spam the whole whole internet as much as they can and find weaknesses.

Martin Hinton (15:07)
You you touched on this a little bit, but the consequence of a breach is complex. I I I I guess I would wonder with you know, when it comes to customers, obviously the marketing department wants to present the company well, what does a data breach do to to the your the the customers? How I mean, how does it make them feel? W w what do you have to deal with in in that respect before getting to any kind of money, I guess if you will.

Kimber (15:32)
Yeah,

I mean, in some ways the world's a little more forgiving than it was because pretty much, you know, every major brand name and government agency you can think of has experienced a data breach and that's all been in the media. And so you'll you'll note that that even cybersecurity vendors are are given a fair amount of forgiveness when it when it happens. although that somewhat depends on, you know, just how badly you messed up and were negligent versus

you know, the the difficulty of of what happened. So that lets us off the hook a little bit. Kind of wish it didn't in a way. but at the same time, you know, there's lots of data out there that will show, you know, you will definitely have decreases in revenue, you will have increases in customer churn after a major data breach. And it can take, you know, three to five years to recover a brand's reputation.

So it is not something we want to mess with lightly. It is something where, you know, we need to take it very seriously and work with those inside of our organizations that have the knowledge to help us protect our systems, protect our customers' data.

Martin Hinton (16:48)
I mean you you you touch on the the the the cost there, three to five years and it's not just time, it's you have to double your efforts from prior marketing campaigns and y you have to compensate for, you know, a a a problem, if you will. And

Kimber (17:03)
Mm-hmm.

Martin Hinton (17:04)
it takes time to change people's minds or address their concerns. And those are the the time is money. I mean, is that the most basic thing to think about? Is that you know making sure that you secure data?

And you move data effectively and that the the platforms you use or the plugins you use or whatever it might be are secure to the standard you're obliged to maintain for, say, your cyber insurance policy, is is is there, you know, I mean, there's a real hard dollar figure to to not doing this properly and then also becoming the victim of some sort of breach.

Kimber (17:38)
Right, exactly. So yeah, so you've you've got your IBM study is always a good benchmark for the cost of a data breach, right? And and that will take on, you know, your hard costs, your your forensics, you know, the things that a cyber insurance policy would likely cover. the all of the cleanup work, finding out who who was impacted, who wasn't impacted, possibly providing them credit monitoring services, for example.

And all of those kinds of things. But that brand reputation harm is much more difficult to calculate because of course during that three to five years, lots of other things are happening, right? The macroeconomic conditions are changing, what markets you pr you participate are changing, what your competitors are doing is changing. And so really identifying that harm to the brand and tracing it back to that breach is is nearly impossible.

and yet, you know, through brand surveys and brand analysis, you know, we it it holds pretty steady that it takes about three to five years to rehabilitate a a damaged brand.

Martin Hinton (18:50)
You y y we we've sort of moved into the cyber insurance world and I guess I'm curious about the the relationship you have with the I don't know, underwriters or anything like that, but most cyber insurance applications focus on things like IT and cybersecurity controls. Sho should underwriters be focusing on the marketing stack or the Mar stack as as you call it?

Kimber (19:10)
Yeah. I mean it it depends on how in depth and detailed you go when you're writing your policies for sure. I would say a vast majority of the time it's proxied through through the IT, the the information security department. if you're a much larger organization, possibly through legal or compliance, but somewhere in that zone. I don't know too many CMOs that have had direct conversations with their cyber insurance underwriters.

but it's not a terrible idea to to do some verification, to sit down with the the marketing team, at least the the CMO, and make sure that they understand what is and is not covered by that policy, and do some validation, asking some more detailed questions to to uncover some some additional risk. And and I would mostly I would focus on the website.

and any aspect of the the product that marketing controls. Where, you know, in a a strange in a SaaS world, marketing can be fairly deeply embedded in the product itself, not just in the marketing of the product. And so really going through that and understanding where though those risks come from and what kinds of tools and third party providers sit underneath that.

Martin Hinton (20:35)
You you sort of touched on my next question. What kinds of questions would you wanna be asked or wanna ask? you know, like I bothered to to to to run through any of the ones you just touched on or any that maybe you didn't, that that if you're a chief marketing officer, you know, one of the things you you you enjoy w as a result of experience, I should say, is that you get asked a question and you realize, I don't know the answer to that and I sure now suddenly feel like I I should know the answer to that.

Kimber (20:59)
yeah.

Martin Hinton (20:59)
I mean, w i the aha moments like, we do that. I didn't realize that was, you know, like

that big a deal or that dangerous or that risky. W what are some questions that CMOs should be you know, ready to field or or or, you know, maybe after hearing this, go find the answer to?

Kimber (21:16)
Yeah,

so you know, claims get denied over incomplete or mis leading application answers. So for one, you know, one of the very key parts, and this this is gonna be very, very fundamental and rudimentary, is just is the inventory of the systems complete? did marketing contribute to that? Double checking it, or did IT fill it in on behalf of marketing? how much

Time and headspace did they devote to giving that inventory? Did they really dig in with all the people on their team? Some marketing teams are quite large. And the person who's asked to fill out that inventory form may not know everything that the web team is using or various other pass-through systems, ABM systems, intent systems. Do we really understand who is giving up?

us information and therefore is not actually you know part of the inventory and who are we sending information to or even through there's a lot of things where it what might pass through it doesn't live in somebody else's system but it it does get processed by someone else or passing through someone else and so those are all I think very critical questions to ask and I think I think you will

Uncover some insights with with a direct conversation.

Martin Hinton (22:45)
I mean, it sounds to me, obviously sc scale matters, but it seems s

Kimber (22:48)
Yes.

Martin Hinton (22:49)
seems to me that a chief marketing officer could a chief marketing officer could could lower a company's cyber risk by perhaps being proactive. For example, if they learn that the cyber insurance renewal is coming due or it tends to happen the same time every year, the idea could be that they might go to the IT department or the CISO and say, hey, you know what? Let would it be okay to just make sure that we're on the right side of the policy and also the right side

Kimber (23:13)
Mm-hmm.

Martin Hinton (23:13)
of good practices.

particularly in this day and age where, as you know, the ability to recover from the reputational damage of a cyber attack is ironically aided by the volume of cyberattacks and not just how many they seem to happen at places that you would think were impregnable to that sort of thing. Is that, you know, the kind of good practice a CMO should be considering, that that they've got this valuable bucket of data and that they want to make sure it's protected? Because that does come back to the core of the

Responsibility of a CMO.

Kimber (23:45)
Right. Well, and I love the question because this flips it around to from where do we introduce risk to where can we help lower risk and maybe even, you know, lower the premiums that we're paying on our policy. and it's really a matter of having keeping your house clean, right? Being very communicative of what tools are we no longer using and are they really turned off? Is everything are all the accounts, you know, out of there? Nobody has access to them anymore.

Did we clean data out of those systems before we exited that vendor relationship? what are we doing with agencies and contractors? What are we doing with old customer data? How long do we keep it? If it's an event list and an I don't know, you go to an event and and you get the list of attendees and it's thousands of attendees, but you only talk to 50 or 100 of them, right? Do you really need to keep all of those

those contact records? What tools have have we retired? What agencies are we no longer working with? Did we make sure that when we quit working with that agency, that we took them out of our Slack channels, for example, and just demonstrating that you keep a clean house, I think, overall, goes a long way to to improving that relationship and ensuring

that we have a very clear picture of what our risk profile looks like, and that that we're not tracking things that we no longer need to track.

Martin Hinton (25:20)
I mean in a microcosm, it's sort of like the data sprawl within a company and the the authorized access and that that sort of thing that exists for both humans and non-humans, you know, identity and all that sort of thing. You have a sort of a layer within the layer of of maintaining

Kimber (25:35)
Mm-hmm.

Martin Hinton (25:35)
best practices. And you know, one of the things you talk about is that and this happens all the time, is that data gets kept and there's maybe a backup of the backup and nobody knew that was saved on this place or that place and and

that that sort of thing's easy to find when it's what you're looking for. If you don't know it's there, it's hard to find. I mean, is is that sort of, you know, kind of thing we hear about at in a larger scale what you're talking about?

Kimber (25:59)
Definitely. and I and there's I don't know that this really goes to your cyber insurance policy and and what would happen in in the event of a breach, but in a larger picture, it doesn't always matter who is at fault and where that data lives. If if I have a relationship with a vendor, if I have some of their software embedded in my Martex stack and it it's being used to provide a service to my

my customers to my website visitors and and their information gets leaked, they're still going to attribute that to me because I'm the one that introduced that tool into their world, right? I'm the one that that put it on the website. And so we have to think a bit more holistically than just what is immediately within the walls of our organization.

Martin Hinton (26:55)
So I I don't have terribly many more questions. Is there anything that before I last my ask my last question or two, anything we didn't touch on or anything else you'd like to say something more about?

Kimber (27:05)
I

I mean there's plenty, but

Martin Hinton (27:07)
Ha ha ha.

Kimber (27:09)
but we can just always have another conversation.

Martin Hinton (27:11)
We we we

certainly can. I mean, I you know, the the the interesting thing for me is that, you know, within the this the the the executive layer there's really interesting ways that you touch cybersecurity that you may not think and and this exists particularly 'cause marketing is, in my opinion, essential to virtually every company that I can think of off the top of my head.

Kimber (27:31)
Mm-hmm.

Martin Hinton (27:32)
This idea that that not unlike individuals sort of sometimes see their vulnerability or their value as a as a target within the

marketing world, you might not realize it as well. And and the idea that this attitude towards protecting your customers, the ones you have, and being respectful of the ones you're seeking, seems core to the sort of attitude good marketing arrives with. Am I am I wrong? I'm not a marketer. I I you know th this idea is that there's a real trust and a reputational value to be able to say, you know, we take care of your data. If you give us your personal information for whatever reason

We're we're not cavalier about how it's stored or how it's shared or who we give it to. This is almost I mean, I dare say it it could be an element of the marketing for particularly companies in in in Graylog space.

Kimber (28:19)
Yeah. And and it it is a true true point of friction, right? Because in marketing, we're trying to connect. We're connectors, right? We're trying to connect data, we're trying to connect prospects with the the product that we're offering, we're trying to connect customers with other customers so that they can learn from each other. And so in that desire to to analyze our data, to understand our customers better,

There is real friction between that and you know keeping things siloed, not not allowing, you know, a breach of one system to compromise other systems, you know, not having a breach of a of a particularly sensitive system really expose a lot of information about a a particular individual. So

it it's not it's a balance for sure. And I I think what I would say to my fellow marketers out there would be to set a t time aside, even if it's not a lot of time, but set time aside every week to really, you know, spend a little time with your security team, to be thinking about these problems, to be addressing these problems, especially as fast as we're moving with AI in terms of

vibe coding our own little ROI calculators and analysis tools and tracking how well we're doing on the LLMs and listings and all those sorts of things. it it just becomes more and more important to really understand where we could accidentally introduce risk and create harm for our business.

Martin Hinton (30:03)
So I y you you I think you anticipated my last question there, what what's one thing a CMO should do this week? And it sounds like your answer is they should do this every week. Or is there another singular piece of advice? What if a a chief marketing officer is watching this and they think, I don't even know who the CISO is? What should they do?

Kimber (30:21)
find out for sure. That's step one. and and I'm not suggesting that you need a weekly one-on-one. God knows we all have plenty of one-on-one calls on our on our calendars. but but make sure, you know, once a month you're having that conversation. Make sure that your very first thought when you're

When your team is building something new, building something from scratch, connecting a new data source, adding a tracking pixel, doing some AI data analytics, right? that that your first thought is does this introduce a security risk? if if the answer is I don't know, and that is a valid answer and probably a very common one.

just just go ask, go find your internal expert to help walk you through what those issues could be and where we can mitigate those issues.

Martin Hinton (31:17)
Lovely, lovely. anything else before we wrap up?

Kimber (31:20)
I think that's good for today.

Martin Hinton (31:23)
All right. Well, there'll be links to Kimber and Graylog in the show notes wherever you might be watching this or listening. So you can find her there if you want to follow up. If you've got questions or comments, please

include them and we'll do our best to answer or we'll circle back with Kimber. thank you very much for watching. I'm Martin Hinton This is a Cyber Insurance News and Information Podcast. Enjoy the rest of your day.

Martin Hinton (31:46)
If you're getting something out of the show, follow or subscribe wherever you listen, and leave a rating or review. It helps more people find us. Thank you.