How can a security company build trust through community?
Security practitioners trust each other far more than they trust vendors. Community work puts your engineers and researchers among those practitioners as useful peers. It is slow and hard to measure, and it is one of the few ways a small Canadian security company can earn a reputation that outlasts any campaign.
How can a security company build trust through community?
By contributing to the places practitioners already meet, without pitching: talks at chapter meetings and BSides events, open-source tools and detection rules, honest answers in online groups, and help running events. Done for a year or more, this makes your people known and trusted before a buyer ever opens your website.
ShoutEx view: community is the right investment when your buyers are practitioners, when your team includes people who enjoy teaching, and when you can commit time for at least a year. It is a poor fit if leadership expects a lead report next month. Pair it with conference talks and published research so the same expertise reaches people in several places.
Where do Canadian security practitioners gather?
Professional association chapters, volunteer-run conferences and online groups are the main venues. ISC2 says it has more than 160 chapters in over 50 countries with over 40,000 members, and chapters offer CPE credit for meetings; Toronto and Atlantic Canada chapters exist. The ISACA Toronto Chapter reports more than 4,900 members and calls itself the largest chapter in Canada and the fourth largest in the world, running seminars, workshops and chapter meetings. ISACA also has an Ottawa Valley chapter.
BSides events are volunteer-organized and practitioner-led. BSides Toronto 2026 ran October 3 to 4, 2026 in person, with a community-based audience and an open call for papers. Smaller online groups on Discord, Slack and similar platforms carry much of the daily conversation; each has its own rules on vendors.
| Venue | Audience | What a vendor can offer | Effort |
|---|---|---|---|
| ISC2 chapter | Security practitioners keeping certifications current | A talk that earns members CPE credit | Medium |
| ISACA chapter | Audit, risk, governance and security professionals | Workshops on controls, audits and frameworks | Medium |
| BSides conference | Hands-on practitioners and students | Technical talks, volunteers, modest sponsorship | Medium to high |
| Online groups | Practitioners asking day-to-day questions | Specific answers from named engineers | Low per week, constant |
| Open-source projects | Engineers who use and improve tools | Code, detection rules, documentation | High |
Turn field lessons into talks for regional conferences.
TalksRead the guide Release a free toolShare a small, useful tool practitioners can run themselves.
Open sourceRead the guide Publish researchWrite up techniques and findings the community can reuse.
ResearchRead the guide Be citedPublic answers and research become sources AI assistants point to.
VisibilityRead the guideWhat can a security company give before asking for anything?
Give the community things it uses. The more practical the contribution, the longer it is remembered.
- Chapter talks on how something works in practice: an incident your team handled (anonymised and approved), a control you tested, a framework mapping you built.
- Detection rules and queries shared openly, with notes on false positives.
- Small open-source tools that solve one annoying task. The free tools guide covers how to build and share them responsibly.
- Research write-ups mapped to adversary techniques, published after any coordinated disclosure is done; see threat research content.
- Venue, food or volunteer time for volunteer-run events, with a logo on a thank-you slide and nothing more.
- Mentoring students and career changers, which many practitioners remember for years.
How do you take part in a community without pitching?
Most communities tolerate vendors who help and ban vendors who sell. Write these rules down for your team before anyone posts.
- Read the group's own rules and follow them, including any vendor or self-promotion rules.
- Use your real name and say where you work when it is relevant to the answer.
- Answer the question asked, even when the honest answer is a competitor's tool or a free option.
- Never send direct messages to sell to people you met in a community space.
- Do not post product announcements outside channels set aside for them.
- Credit others' work and fix your mistakes publicly.
These rules protect the company as well as the community. A single screenshot of a vendor pitching in a practitioner channel can undo a year of goodwill.
Teach in public, sell in private.
In community spaces, answer the question that was asked, share the tool, give the talk. If someone wants to buy, they will ask, and the conversation moves somewhere private.
Who should represent your company in the community?
Engineers, researchers and consultants who enjoy explaining things. Practitioners judge vendors by the people they meet, and a curious engineer who answers questions honestly does more for your reputation than any marketer.
Make the work part of the job. Give people a few hours a month, help with slides and travel, and clear legal review for anything touching customer data. Marketing's role is support: finding calls for papers, editing talks into posts, and noticing which topics people keep asking about so they can feed search content too.
Plan for people leaving. If one engineer holds every community relationship, the goodwill walks out with them. Pair a newer colleague with each regular contributor so the company stays known in the room after a job change.
How do you know community work is paying off?
Use leading signals for the first year and pipeline signals after that. Ask every new opportunity how they first heard of you, and record the answer in the CRM in their own words.
| Activity | Effort per month | Signal to watch |
|---|---|---|
| One chapter attended monthly | 4 hours | People greeting your engineers by name |
| Two talks a year | 10 hours each, spread out | Requests for slides, follow-up questions, invitations to speak again |
| Weekly answers in one online group | 4 hours | Direct questions addressed to your people |
| One maintained open-source tool | 8 hours | Stars, forks, issues and pull requests from outside the company |
| Self-reported "heard of you via" in new opportunities | Sales logging | Community named as first touch |
Community mentions also travel. Public talks, repositories and forum answers are the kind of third-party pages that search engines and AI assistants pick up, which is why community work supports AI search visibility as well.
Frequently asked questions
Is community marketing worth it for a small security company?
Yes if your buyers are practitioners and you can commit people's time for a year or more. It builds familiarity that makes later sales conversations easier, but it does not produce leads on a fixed schedule.
How many ISC2 chapters are there?
ISC2 says it has more than 160 chapters in over 50 countries, with over 40,000 members. Chapters offer CPE credit for meetings.
How big is the ISACA Toronto Chapter?
It reports more than 4,900 members and describes itself as the largest ISACA chapter in Canada and the fourth largest in the world.
When was BSides Toronto 2026?
BSides Toronto 2026 ran October 3 to 4, 2026, in person.
Can a vendor speak at a chapter meeting or BSides?
Usually yes, if the talk teaches something and does not pitch. Submit through the event's call for papers or contact the chapter's programme lead.
Can we add community members to our email list?
Not without consent. Do not scrape names or handles from community spaces; Canada's anti-spam law requires consent for commercial email.
Who should represent the company in community spaces?
Engineers, researchers and consultants who enjoy teaching. Practitioners trust peers who answer questions honestly more than marketers.
How do we measure community work?
Track leading signals such as talk follow-ups and direct questions, and ask every new opportunity how they first heard of you.
Sources & further reading
Regulations, platform policies and market data change. These sources let you check the facts on this page, last checked October 7, 2026.