The short answer
Which security blogs accept guest posts, and how do software teams get published on them?
Several well-known security publications take outside contributions, and their own guidelines are strict about vendors. Of the seven we read on 20 October 2026, all seven ban or restrict promotion, one excludes contributors associated with solution vendors outright, and one refuses articles from marketers, ghost writers, SEO specialists and PR executives. Where the pages mention links, they restrict them: bio links as text only, product-page links removed, or no product pages as link targets. Treat guest posting in security as a route to credibility with practitioners, and do not budget it as a source of links to product pages.
What do these publications actually say?
The table below is built only from guideline pages we fetched and read. “Not stated” means the page did not say, not that the answer is no. Sort and filter it with the tool, and the full text version follows.
What security publications say in their own guidelines
Read on 20 October 2026. "Not stated" means the page text did not say. Re-check before relying on any row.
| Publication | Vendors and promotion | Links | Exclusivity | Length | Payment and paid options |
|---|
Text version of the audit (as read on 20 October 2026).
| Publication | Vendors and promotion | Links | Exclusivity | Length | Payment and paid options | Page date |
|---|---|---|---|---|---|---|
| Cyber Security Hub (n.d.) | No content from contributors associated with solution providers or vendors. No individual sponsored articles. No product or service case studies, including pitches from company personnel. Separate marketing programmes are offered to vendors | Social media and personal website references in the author bio, as text, not a do-follow link | Original, unpublished, from a neutral source | 800 to 1,200 words (ideal) | No compensation for contributed content. Vendor marketing programmes sold separately | No page date shown |
| Dark Reading (2026) | Contributed Commentary. Columns must be objective with no agenda. Do not promote products or trends tied to your company’s business interests. Vendor experts’ unique insights on new attack trends may suit. Promotional opportunities go through the sales team | Not stated | All copy must be exclusive. After publication you may summarise it in one or two paragraphs on your own blog with a link back | Roughly 700 to 800 words (maximum 1,000 in certain cases) | Commentary pieces are unpaid. The page says not to use AI to write the column | Updated 1 May 2026 |
| Infosecurity Magazine (n.d.) | Sales pitches, marketing materials and product promotions are rejected | Not stated | Must be exclusive to Infosecurity | 800 to 1,000 words | Sponsored content packages (newsletter and social promotion) sold separately. Reviewed within a week | No page date shown |
| Information Security Buzz (2024) | All articles must be vendor-neutral. Thought leadership and blogs must not promote products, services or topics tied to your company’s business interests. Marketing pieces promoting companies, products or services accepted only as press releases (breaking, hard news) | Blogs: include hyperlinks and declare all author affiliations. Link attributes not stated | Must be exclusive, checked with a plagiarism program | Thought leadership 1,000 to 2,500 words. Blogs: 800 minimum in the page’s list, no longer than 1,000 in its blog section | A $100 charge applies to take an article down after publication (the page says it covers editing, publishing and distribution costs) | Last modified 24 September 2024 |
| The Cyber Express (n.d.) | Articles cannot be self-promotional | Not stated | Not stated | Not less than 1,500 words. A 250-word summary is required first | Featured or sponsored articles go through a separate content marketing and sales contact | No page date shown |
| LinuxSecurity (2025) | Marketing pieces promoting specific companies, products or services not accepted. Digital marketing agencies and link building services are welcome to contribute | The link back must relate to Linux, open source or cybersecurity. The backlink page cannot be promotional: informative only, no product pages | Not stated | At least 1,200 words, at least three original images, no simple checklist (‘5 ways to’) pieces | Not stated | Last modified 17 January 2025 |
| CISO MAG (2020) | Does not accept articles from casual bloggers, marketers, ghost writers, SEO specialists or PR executives. Articles must be neutral, with no direct pitches or plugs. Prefers certified security professionals and practising CISOs and other senior leaders | External links to product promotional pages (and malicious sites) are removed | Exclusive and never published before | 800 to 1,000 words (website). 1,500 to 2,500 (e-magazine) | Not stated | Document dated 2020 (upload path) |
Claim strength: reported by each publication’s own page, all fetched and read in full on 20 October 2026. Page dates are as the pages show them.
What does this mean for a software company?
A link to a product page is the thing most guidelines prevent. Cyber Security Hub gives bio references as text, not followed links (Cyber Security Hub, n.d.). CISO MAG removes external links to product promotional pages (CISO MAG, 2020). LinuxSecurity bans promotional backlink pages and product pages (LinuxSecurity, 2025). If your goal is a followed link to a product page, these publications are not a dependable route and their guidelines say so. Link to research, documentation or a technical guide instead.
Vendor affiliation can disqualify you. Cyber Security Hub excludes contributors associated with vendors, and CISO MAG does not accept marketers, ghost writers, SEO specialists or PR executives (Cyber Security Hub, n.d.) (CISO MAG, 2020). A practitioner on your team may write under their own expertise, but the policy is the publication’s to apply, not yours to work around.
The commercial route exists and is labelled. Infosecurity Magazine, The Cyber Express and Cyber Security Hub each point vendors to separate sponsored or marketing programmes, and Information Security Buzz accepts company marketing only as press releases (Cyber Security Hub, n.d.) (Infosecurity Magazine, n.d.) (Information Security Buzz, 2024) (The Cyber Express, n.d.). Google’s spam policies (2026b) say links bought for advertising or sponsorship are acceptable when they carry rel=“nofollow” or rel=“sponsored”, and list paid articles carrying links that pass ranking credit as link spam.
Link-friendly sites are a different category. LinuxSecurity states that marketing agencies and link building services are welcome (LinuxSecurity, 2025). That is a commercial outlet with its own rules (1,200 words, three original images, an informative link target). Qualify it with the same checks as any other, and read our publisher vetting guide.
Be cautious with takedown fees. Information Security Buzz charges $100 to take a published article down, and says it covers editing, publishing and distribution (Information Security Buzz, 2024). A publisher that charges for removal raises a durability question. Ask about removal terms, and track the placement at 90, 180 and 365 days (see our cohort method).
AI-written drafts are a risk. Dark Reading’s page says not to use AI to write the column, and Information Security Buzz points to its own AI policy (Dark Reading, 2026) (Information Security Buzz, 2024). Have a named practitioner write and own the piece.
How do you secure a place?
- Read the current guidelines and check the date. Our audit is a snapshot.
- Write it yourself. A practitioner’s name and experience are the point, and Dark Reading says not to use AI to write the column (Dark Reading, 2026).
- Pitch a practitioner’s finding, not a product. A named engineer with a technical result fits every “no promotion” rule we read.
- Offer exclusivity if the publication asks for it, and mean it. Most of them require it.
- State your relationship to any vendor in the pitch. Do not let the editor discover it.
- Send a short synopsis first where the publication asks for one (The Cyber Express asks for a 250-word summary, Infosecurity Magazine a synopsis and title) (Infosecurity Magazine, n.d.) (The Cyber Express, n.d.).
- Follow the editor’s format, including length and any image requirement.
- Check the placement afterwards for indexation, link attributes and stability.
What are the common mistakes?
- Submitting a product-led article to a publication that bans it.
- Pitching the same piece to several outlets that require exclusivity.
- Treating a “write for us” page as a promise of a followed link, or as permission to link to a product page.
- Sending a simple checklist piece to LinuxSecurity, which rejects them, or a “back to basics” pitch to Infosecurity Magazine, which says its readers already know the basics (Infosecurity Magazine, n.d.) (LinuxSecurity, 2025).
Key takeaways
- Read the publication's current guidelines before you pitch. They change, and one of the seven documents we read is dated 2020.
- Cyber Security Hub accepts no content from contributors associated with solution providers or vendors, and no individual sponsored articles (Cyber Security Hub, n.d.).
- CISO MAG does not accept articles from casual bloggers, marketers, ghost writers, SEO specialists or PR executives, and it removes external links to product promotional pages (CISO MAG, 2020).
- LinuxSecurity welcomes digital marketing agencies and link building services, and then requires the link target to be informative, with no product pages (LinuxSecurity, 2025).
- Four pages require exclusive content and Cyber Security Hub asks for original, unpublished content (Cyber Security Hub, n.d.). Where payment is mentioned, contributed pieces are unpaid, and several publications sell sponsored or marketing packages separately.
- All seven state a length, from roughly 700 words up to a 1,500-word or 2,500-word range. LinuxSecurity also requires at least three original images (LinuxSecurity, 2025).
- Google lists paid articles carrying links that pass ranking credit as link spam, and allows sponsorship links that carry rel="sponsored" or rel="nofollow" (Google, 2026b).
References
- CISO MAG (2020) Editorial guidelines for website [PDF]. Available at: https://www.cisomag.com/wp-content/uploads/2020/05/Editorial-Guidelines-for-Website.pdf (Accessed: 20 October 2026).
- Cyber Security Hub (n.d.) Cyber Security Hub contributor guidelines. Available at: https://www.cshub.com/become-a-contributor (Accessed: 20 October 2026).
- Dark Reading (2026) 'How to submit a column to Dark Reading', Dark Reading, updated 1 May. Available at: https://www.darkreading.com/cyberattacks-data-breaches/how-to-submit-a-column-to-dark-reading (Accessed: 20 October 2026).
- Google (2026b) 'Spam policies for Google web search', Google Search Central, last updated 28 August. Available at: https://developers.google.com/search/docs/essentials/spam-policies (Accessed: 20 October 2026).
- Information Security Buzz (2024) 'Write for Information Security Buzz', Information Security Buzz, last modified 24 September. Available at: https://informationsecuritybuzz.com/write-for-information-security-buzz/ (Accessed: 20 October 2026).
- Infosecurity Magazine (n.d.) Infosecurity welcomes op-ed pitches. Available at: https://www.infosecurity-magazine.com/op-ed/ (Accessed: 20 October 2026).
- LinuxSecurity (2025) Contribute your article, last modified 17 January. Available at: https://linuxsecurity.com/contribute-your-article (Accessed: 20 October 2026).
- The Cyber Express (n.d.) Write for us. Available at: https://thecyberexpress.com/write-for-us/ (Accessed: 20 October 2026).
