Why Your Content Strategy Isn't Building the Influence You Expected

Most security professionals who tell me they want to build influence through thought leadership are doing punditry instead. Unfortunately, the difference between those two things can make any content strategy feel like running on a treadmill because contrary to what people often assume, the problem isn’t effort or visibility. The issue is that they’re confusing punditry tactics for thought leadership, and not getting the results they expected. So, what’s the difference? 

Punditry tactics don't produce thought leadership results

Thought leadership and punditry aren’t synonyms or even two sides of the same coin. They’re different strategies with different mechanics, different audiences, and thus, fundamentally different outcomes.

Punditry’s primary goal is to generate attention. It’s reactive, timely, and, when done well, it’s optimized for the moment. When something happens such as a major incident, a regulatory announcement, or a high-profile industry debate, the pundits move fast. They get impressions, shares, and sometimes, a short spike in followers. Although that attention is real (meaning, we can measure it), it’s also shallow and temporary, because it’s not attached to anything original. It’s a hijacking of someone else’s moment.

Conversely, the reason to invest in thought leadership is to build credibility. It’s slower and harder, but its value compounds over time because it’s attached to your ideas, your frameworks, and your track record of being right about things that matter to you and your industry. The practitioners and executives who read/listen/watch your work come back not because something happened in the news but because they trust that you have something worth hearing.

When you use punditry tactics and expect thought leadership results, you get neither. Instead, you end up with a content hamster wheel that demands constant output to maintain even modest visibility, with no accumulated credibility to show for it.

Punditry Tactics 

• Reacting to incidents or industry moments you have no direct knowledge of. 
• Summarizing what other respected voices said and adding light commentary. 
• Publishing takes timed to news cycles rather than to the maturity of your own thinking. 
• Framing opinions as analysis without acknowledging the limits of what you actually know.

To be clear, none of this is inherently malicious. Most people doing it genuinely believe they’re contributing something and sometimes they truly are. Explanation and context have real value, especially for less technical audiences trying to make sense of a complex situation. But the explanation isn’t the same as the original thought nor is visibility the same as influence.

In my experience, punditry tactics are a primary driver of what Bob Lord calls "hacklore" — the cybersecurity equivalent of urban legends, where confident but inaccurate advice gets repeated so often it takes on the appearance of established wisdom. When practitioners optimize for timely reactions over original analysis, they don't just fail to build their own credibility. They actively degrade the quality of information circulating in the industry.

Thought Leadership Tactics 

• Publishing something before the industry has fully formed a consensus on it. 
• Naming a problem that practitioners recognize but haven’t seen articulated. 
• Sharing a framework you developed from your own work, including what failed before you got it right. 
• Taking a position that could be wrong and defending it with evidence and reasoning.

The common thread here is originality. You are starting something rather than responding and that’s a fundamentally different posture from punditry, producing fundamentally different results.

Talking head vs. being in the room

Why does this distinction even matter? Well, as someone who spent the first half of my career working in corporate communication and public relations functions, I often think about the difference between the TV talking head and the person in the room where decisions are made. The talking head is visible, trying to get quoted or secure airtime while sounding authoritative. But they’re on the outside, narrating their best guess at what’s happening inside. 

In my experience, someone doing genuine thought leadership gets called before the story even exists – when a policy decision is still being shaped, an industry working group is forming, or the people who will eventually make a public statement are still figuring out what they think. That’s the critical difference punditry vs. thought leadership produces over time. It’s not about more or less visibility, but a fundamentally different kind of access. One can put you in front of an audience, while the other puts you in the room.

For example, when Anthropic launched Project Glasswing (a restricted initiative giving select organizations access to Claude Mythos Preview, an unreleased frontier model with significant cybersecurity capabilities) access wasn't distributed by popularity contest or follower count. The organizations that got early access had invested in the right relationships over time, relationships built on demonstrated expertise, credibility, and trust. The loudest voices in the industry weren't necessarily the ones invited to be in the room, and many of them seemed surprised. 

Why the confusion is so persistent

Primarily because punditry gets faster, easier-to-measure feedback than thought leadership does. Impressions, likes, and follower counts tick up quickly when you’re riding a news cycle while the rewards for thought leadership are slower and harder to attribute, e.g. a speaking invitation, a board-level introduction, a peer who puts your name forward for a new opportunity, or an invitation to a working group that never gets announced publicly. Those outcomes don’t show up in a dashboard, so many practitioners optimize for what they can immediately see and end up with a content strategy that keeps them visible but never actually builds the influence they need for future advancement.

I have to note that there’s also a risk dynamic at play. Punditry is safer because commenting on someone else’s situation carries far less professional exposure than staking a position about your own work, your own field, or the direction the industry should be going. Original thought leadership requires owning something that could be wrong and that can be genuinely uncomfortable for people.

In my work with clients, sometimes they’re worried about who might disagree with them regardless of whether they’re right or not. When that comes up, we take a step back and focus on the stakeholders that actually matter to them. If there are genuine concerns about how a specific audience will react, we adjust the content accordingly. But if the fear is really about trolls or pundits (AKA people who will react loudly regardless of what you say), I remind them that not everyone's opinion matters on everything. Credibility doesn't come from being unassailable, but from learning, changing your mind when evidence warrants it, and being willing to share that journey publicly. That's what makes someone a respected thought leader over time, not the mere absence of critics.

The question to ask yourself

If you’ve been publishing consistently and you’re not seeing the influence results you expected, the answer probably isn’t more content, but different content.

In the last six months, how many things have you published that originated from your own experience or analysis? Something that would still exist and matter regardless of what happened in the news or industry rumor mills. If the honest answer is not many or none, you have a tactics problem.

Thought leadership is a long game that requires original thinking, the willingness to be wrong in public, and the communication skills to make complex ideas land with the specific audiences that matter to you. It doesn’t reward you on the same timeline as punditry, but it builds something punditry never can: credibility that holds when the news cycle moves on.

That’s what creates influence.