People tend to think they “get” why SEO is important. This leads them to believe that if they want to be first in the Google results for “security awareness training”, they should write lots of pages that use the phrase “security awareness training” all the time. But this isn’t quite right. Most serious cybersecurity SEO marketing work involves providing useful content focused on “long-tail” keywords.

One thing that really threw me when I was first forced to learn about SEO was the idea that only some words were Google keywords.  I thought to myself: Google indexes everything, and if I search for a phrase that I know is on a certain page, that page will come up in the search results. But a keyword in the SEO sense is a phrase that real people out on the web actually search for on a regular basis.

Take for instance this page from Dragos Security, of which I am showing the top of the article (there is a headline and a big image above this that makes the article start only “below the fold,” that is, you have to scroll down before you can read this page. (You probably guessed this, but that’s not ideal. There does seem to be a trend in the past few years to design web sites with huge amounts of whitespace and big “hero images” that push the text far down the page. People who are searching for the information found in an article aren’t necessarily going to love these kinds of designs.)

The title of this page is: Examining the SymCrypt DoS Vulnerability. Here’s where the article actually begins:

A content marketing page from the Dragos Security blog, this one focused on a SymCrypt library vulnerability.

It looks like the sort of thing that would interest anyone who was trying to deal with the SymCrypt DoS threat. Indeed, if you Google SymCrypt DoS, it’s the first thing that comes up:

A Google search of symcrypt DoS puts the Dragos page at the top of the heap -- that's how cybersecurity seo marketing works.

To be clear, this is a good thing. But here’s the point I’m trying to make: No one is searching for “SymCrypt DoS”.

Or to be more precise, according to the tools SEO folks use to monitor such things, there are, on average, no searches for this keyword phrase in any given month.

Does that mean no one has ever searched for this term? Almost certainly not (heck, I just searched for it myself). News of this DoS vulnerability emerged midway through 2019 and it’s reasonable to assume that there was a spike in searches for SymCrypt-releated searches at that time. It was still probably a fairly low volume, but I’ll bet you’d have seen some activity in the search volume tools.

But the fact is, “SymCrypt DoS” isn’t a keyword that draws anybody in. In fact, there is no keyword in the title of this piece that will draw anyone in from Google search results. Now, let’s dig into that a little bit. There is, to be sure, the keyword “vulnerability” and the keyword “DoS vulnerability”. These are terms that get some monthly search volume.

The keyword “vulnerability” gets 165,000 searches per month. Of course, the top results when you search for it are about how relationships are enhanced when you share your vulnerability. Nothing to do with cybersecurity, in other words. It’s page three of the results before you get to vulnerabilities of the sort that Dark Reading or Threatpost might write about.

“DoS Vulnerability” gets an average of 10 searches a month. This is clearly better than getting no searches. But there were almost certainly better primary keywords (as we call the main keyword that we’re targeting in a piece of content) in terms of search volume. The Dragos page we were looking at shows up on page four (as I write this) of a search for “DoS Vulnerability”. What runs at the top of the search results are pages that answer the question “What Is DoS”.

I would venture to say that at this point in time, with Google having decided that a person searching for “DoS vulnerability” is asking what the thing is, that no page about a specific DoS vulnerability could make it’s way to the first page. Google does its best to guess the most likely “searcher intent.” You’re not going to get around that decision very easily.

I will mention in passing that the vast majority of Dragos’s pages have what appear to be very carefully selected primary keywords. They’ve done their basic on-page SEO homework. Also, this Symcrypt page may have been worth producing for a whole host of other reasons. SEO is never the only game in town.

Long-tail opportunities

If we ask ourselves what kind of target keyword should be chosen for a page of content that we’re creating with cybersecurity SEO marketing in mind, one thing that may be clear from the example we just looked at is that a term with a very high monthly search volume may not actually be a very good choice. For one thing, the search intent that Google is focusing on may not have anything to do with security.

Equally worth considering is that other websites with much more Google “juice” may have already filled the top slots in a way that will be very difficult for you to compete with. It would be great to have the top entry for “Cybersecurity”, for instance, but most vendors don’t have websites with enough clout to pull it off. For a highly contested “head” term, it almost doesn’t matter how good your cybersecurity SEO marketing mojo is. Of course we also shouldn’t forget that this Symcrypt page may have been worth producing for a whole host of other reasons. SEO is never the only game in town.

You need to find a search that you can win. The searches you can win, assuming you aren’t Cisco or TechTarget, are searches with smaller search volume. Start thinking in terms of keywords that get searched a couple hundred times a month.

We’ll talk about the details of this and how it translates into the content you produce in the next chapter (or you can skip the next chapter if you already know your way around basic on-page SEO), but here’s the big-picture view:

You want low search volume keywords (which tend to be multi-word, or “long-tail” keywords) and then, given a choice of keywords that have more or less the same search volume, you want the one with the least competition.

This is the part of the book you should circle with your highlighter: getting as many “little” keyword victories as you can will add up over time. Getting buried in the results for your “high volume” keyword attempts will get you nothing whatsoever (at least in SEO terms). This is cybersecurity SEO marketing at its best.