Home / Programmes / Content Strategy

Threat Narrative Cohort

Eight-week cohort for security marketers who need to write about real adversary behaviour without sliding into FUD.

  • Duration8 weeks
  • FormatCohort live + async
  • CohortSeptember 2026
  • Team size1–4 marketers
  • GTM stageSeed to growth
  • Content goalAuthority signal
About the programme

The Threat Narrative Cohort is for content teams who write about ransomware, supply-chain attacks, identity abuse, or adversary tradecraft without becoming part of the noise. The program treats threat content as editorial work first and growth content second. Each week introduces a different narrative form, from incident timelines to detection storylines, and you ship a short artefact in cohort that your peers tear apart with kindness. By the end you have a usable threat-narrative library aligned to your detection capability and a pattern for refreshing it quarterly.

What you work on

  • Eight weekly editorial workshops with cohort critique
  • Threat narrative library template tuned to your stack
  • Detection-to-storyline mapping exercise
  • Two analyst-style review notes per participant
  • Asynchronous Slack channel with editorial moderation
  • A quarterly refresh blueprint to keep the library current

Take-home outcomes

  1. 01A reusable narrative library across blog, webinar, and pitch surfaces
  2. 02Less reactive ransomware-news content
  3. 03Better practitioner reception in social signals
Programme lead

Adam Whittaker

Cybersecurity Content Strategist who has written for SOC teams, CISOs, and skeptical board members.

Common questions

No, but you do need access to one detection engineer or threat researcher willing to answer questions for two hours a week. Without that practitioner thread the narrative library will read like marketing.

Reader notes from past cohorts

  • “The session on incident timelines reframed how we plan our quarterly threat report.”

    Donghyun

  • “Dense, but the cohort was the value. Three peers I now message before publishing anything heavy.”

    Reader · enterprise security vendor

  • “Direct feedback without the marketing-conference flattery. I used my first draft from week four three weeks later.”

    Petra, Senior Content Strategist