If you want to find security creators worth sponsoring, searching a social platform by follower count is the wrong place to start. It ranks people by reach, and reach is the one number a technical audience trusts least. This is a practical route for a brand that has a budget and no names yet.
Influous is pre-launch, so this is how we think about the problem and how we would do it by hand, not a report on a finished product.
Where do you find security creators who are not on a lead list?
Start with the work, not the profile. People who do real security work leave public traces, and those traces are easier to check than any bio. Anyone who appears in three of the places below has an audience that came to them for substance.
- Conference and BSides programmes from the last two years, which show who their peers invited to teach.
- Maintainer and contributor pages for the open source tools your buyers already run.
- Advisory credits and CVE records, which are public and can be verified without asking anyone.
- Podcast and newsletter guest lists, where an editor picked the guest, not an algorithm.
A shortlist built this way is smaller than a database export. That is the point. Each name comes with a reason you can write down.
Which signals show that a creator’s audience is the right one?
Read the comments before you read the counts. Look for replies from people who name their job, correct the author, or ask a follow up about implementation. A handful of those tells you more than a thousand reactions, because they are expensive to fake and nobody posts them out of politeness.
Numbers still matter, but as a second pass. Ask which figures are self reported and which they can prove. Do the reading first, then ask for the media kit.
How do you check that a creator is real before you reach out?
Do a light check before the first message and a full one before any money moves. The light check is ten minutes: does the name match the work, do the repositories belong to the account, does the claimed employer appear anywhere independent. Our walkthrough on how to vet a security creator on GitHub shows what a profile proves and what it does not.
The full check is slower. At Influous we do it manually, covering identity, employment, published work, and whether the engagement comes from real people. We set out the steps in how we vet security creators. A brand running its own search can copy the order, even if it cannot copy the depth.
Why do the best candidates never fill in a sponsorship form?
Many of the practitioners with the most credibility do not publish rates, keep a media kit, or advertise that they take sponsors at all. We wrote about that in why the best security creators are usually not looking for sponsorships. If your plan depends on them applying, you will only ever meet the ones who were looking.
So approach them as a peer. Name one specific piece of their work, say what you would like to fund, and make it easy to decline. The structure is covered in how to email a security creator. A message that could have gone to anyone will be treated as if it had.
How many creators should a first shortlist hold?
Five to eight names, ranked by fit. A spreadsheet of two hundred is a sign the search has turned into a volume exercise, and a volume exercise produces form letters.
Contact two or three first. Check whether their audiences overlap before you sign more than one, because security is a small field and the same people often follow the same voices. Keep a short note on why each name is on the list, so that a colleague can challenge the reasoning later.
Expect the first round to be slow. Some will not reply, some will decline, and one or two will ask questions about your product that are better than the ones your own team asked. That is a good sign, not a delay.
What should you do once you have a name?
Decide what you are actually buying, agree disclosure in advance, and keep the brief to facts the creator can verify. Do not ask for a script. If the first conversation goes well, the second campaign is usually where it pays off.
If you are a creator reading this, you can apply to be vetted and we will review your work on its merits. If you are a brand starting a first search, you can start a campaign with us or email info@influous.io and we will tell you honestly whether we can help yet.