Most conversations with a creator start with a PDF. A headshot, a follower count in large type, a chart of monthly impressions, a list of past brand partners, and a rate card at the back. The media kit is the standard artifact of the influencer industry, and it was designed for a market that looks almost nothing like cybersecurity.
That does not make media kits useless. It makes them a document you have to read against the grain. Here is what the usual numbers mean, what they quietly leave out, and what we would ask for instead.
Follower count is the weakest number in the document
Follower count measures attention accumulated over years. It includes people who followed after one viral thread about a breach in 2023 and have not read a word since. It includes recruiters, vendors, and a long tail of accounts that no longer log in. What it does not measure is who will be reading on the day your campaign runs.
In a field as narrow as security, a creator with 8,000 followers who are mostly detection engineers can be a far better buy than one with 200,000 general tech followers. The number printed largest on page one has the weakest connection to campaign outcome of anything in the file.
Impressions are a ceiling, not a result
An impression records what a platform served, not what a human read. A card that passed through a viewport during a fast scroll counts the same as a post someone stopped on, expanded, and argued with in the replies. Treat the impression figure as the outer limit of what was possible, then look for evidence of what actually happened inside it.
Ask what window the number covers. Kits often report the best month of the last year, which usually means the creator caught a news cycle. That is a real skill, but it is not a baseline. Monthly figures for the last six months tell you far more than one headline total.
Engagement rate hides the part you care about
Engagement rate is interactions divided by followers, or by impressions, depending on which produces the friendlier number. Both denominators flatten the thing that matters in security, which is not how many people reacted but who. Forty comments from named practitioners who run the tooling you sell into is a stronger signal than nine hundred emoji replies.
The check costs about fifteen minutes. Open the creator’s last five posts and read the comments yourself:
- Do commenters name specific tools, techniques, or failure modes, or is it generic praise
- Does anyone disagree, and does the creator answer them properly
- Are the same twenty accounts under every post, which usually means an engagement pod
- Do the people commenting actually hold the roles you sell to
- Does the creator stay in the thread after publishing, or leave it to run
The rate card is a package, not a price
A number on a rate card is meaningless until you know what sits inside it. How many revision rounds. Whether you may reuse the post in paid social, on a landing page, or in a sales deck, and for how long. Whether any exclusivity applies, and across what product category. Whether the creator will be present in the comments for the first day.
A cheaper rate that excludes all four is not cheaper. It is a different product with the same name.
What we would ask for instead
If you are allowed to replace the media kit with five requests, ask for these:
- Three recent posts the creator considers representative, plus one that underperformed and their read on why
- Audience composition by role and seniority, if the platform gives them anything usable
- Verifiable proof of expertise: conference talks, CVE credits, maintained repositories, published research
- Their current employer, and any conflicts that come with it
- What they will not accept, by product category and by claim type
That last one is more informative than any chart. A creator with clear limits has thought about what their credibility is worth. A creator with no limits is selling something other than judgement.
When there is no media kit at all
Many of the strongest technical voices in security have never produced one. No rate card, no PDF, no partnerships page. That is not a warning sign. It usually means they have never needed to sell attention, because the research, the talks, and the tooling did the selling.
When the document does not exist, vetting has to do the work the document would have done: verify identity and employment, confirm the published work is theirs, read the audience directly. This is the position we designed Influous around, because it describes most of the people worth working with.
Read it as a claim, not a record
A media kit is a self reported document prepared by the person being paid. That is not an accusation, it is just what the format is. Publishers issue rate cards too, and nobody treats those as audited accounts either.
So read it for what it claims, then verify the two or three claims your campaign actually depends on. In security, those are almost never the follower count. They are the audience, the expertise, and what the creator is willing to say no to.
Influous is pre-launch. We are building a marketplace where brands can see verified expertise instead of a self reported PDF. If you publish technical work in security, you can apply as a creator. If you are planning a campaign and want to talk it through first, email info@influous.io.