After a breach, stop advertising your security

Three months after our security incident in May 2023, I was shown a campaign I had not asked for. It was well made. Its headline told payroll managers that Yarrowby was now among the most secure payroll platforms in Australia, and the copy described the multi-factor sign-in we had just made compulsory on every employee account. Our sales leaders wanted it running before the quarter ended. Several customers had told them they were reconsidering, and rivals' representatives were mentioning our incident in their own meetings. I declined to run it, and I declined again when a revised version arrived in November. We ran no advertising about security for twelve months.

It was not a popular decision, and I want to explain why I still think it was right, because the instinct behind that campaign is common and understandable. When a company's reputation is damaged, marketing is the part of the organisation built to repair reputations. Asking it to be quiet feels like asking a fire crew to stay at the station.

The campaign that was ready to run

The incident was limited but serious. Attackers took email addresses and passwords leaked from unrelated websites and tried them against our employee app, which at the time let employees sign in with a password alone. Where people had reused passwords, the attackers got in. They viewed payslips for 2,140 employees at 58 customers and changed the bank details of 23 people. Nine of them had a pay deposited into an account the attacker controlled before our fraud rules and an alert payroll officer stopped it. We repaid those nine within two days, notified Australia's privacy regulator and the affected individuals under the Notifiable Data Breaches scheme, and gave our British customers, who control their employees' data, what they needed for their own reports to Britain's Information Commissioner's Office.

None of our core payroll systems was breached. The attackers came through a door we had left with a single lock. Saying so publicly mattered, but it was not a defence. A customer does not distinguish between a breach of the database and a breach of the front door; what she knows is that her employee was not paid.

That is the first reason the campaign was wrong. A claim to be among the most secure platforms invited a comparison we could not support, three months after showing that our own controls had a gap. Every affected customer would read it as a company congratulating itself, and every competitor would be handed a fair rebuttal.

The second reason is less obvious. Advertising security tells customers that security is something we sell, a feature to be weighed against price. In payroll it is a condition of being in the market at all. When we market it, we invite customers to treat it as an extra, and we invite our own organisation to treat it as a message rather than a discipline.

Evidence a customer can check

What we did instead was publish evidence on a schedule, in places customers already looked. From August 2023 every customer administrator received a quarterly trust report. It showed the share of employee accounts enrolled in multi-factor sign-in, which had been 31 per cent before the incident and became 100 per cent once enrolment was compulsory. It reported how many bank-detail changes our new controls had held for an employer's approval and how quickly they were resolved. It summarised the findings of the external penetration tests we commission, including those not yet fixed, with dates for fixing them. And it said when our ISO/IEC 27001 certification was next due for its surveillance audit.

None of these figures was chosen to impress, and several were awkward. The first report showed that compulsory enrolment had tripled our support calls, and that employees at aged-care and hospitality customers, who often share devices at work, were struggling with it. Publishing that alongside what we were doing about it did more for our credibility than any headline could have done.

We also changed what our salespeople said. Each was given a single page describing the incident in plain terms and asked to raise it themselves rather than wait to be asked. Our win rate in deals where a rival had raised the incident first was markedly worse than where we had raised it ourselves. Customers forgive an incident more readily than the sense that a supplier hoped they would not find out.

The cost was real. New-customer pipeline fell by 21 per cent for two quarters, and gross revenue retention fell from 95.1 per cent to 92.6 per cent in the following financial year. I cannot prove that a campaign would have done worse. I can say that by June 2026 retention had recovered to 95.4 per cent, and that in our surveys of payroll managers the share who name security as a reason to reject us has fallen below its level before the incident.

When to speak again

Silence in advertising cannot last forever, and I do not argue that it should. From mid-2024 we began describing our sign-in and bank-detail controls in product marketing, as features with specific descriptions and never as a ranking. We still use no superlatives about security, and I hope we never will.

My test for when a company may speak about its security again is whether a customer could verify the claim without taking our word for it. If the claim rests on a certification, the customer should be able to see its scope. If it rests on a control, the customer should be able to watch it working in their own account. If it rests on a comparison with competitors, it should not be made at all.

For directors, the practical point is that the marketing response to an incident deserves as much board attention as the technical one. Ask what the company intends to say, to whom and when, and ask what evidence each statement rests on. A board that approves a reassurance campaign before that evidence exists is spending the company's credibility at the moment it has least to spare.