Thoughts on GRC Content Marketing

One of the essential steps in starting any business is creating awareness for your brand. You can have the greatest product in the world, but if your target group doesn't know about it, you will never make a sale.

For me, marketing is also not at all about this traditional advertising pushing, which many people associate with the topic. It starts much earlier in identifying promising market potential, shaping a product to fit this demand, and then telling people about it in the least annoying way possible.

Traditional GRC software marketing

I strongly believe that enterprise software vendors (and most established GRC players fall into this category) are facing big challenges in this last point and are getting active resistance from potential customers for this very reason. Certainly in my own past experience as a buyer for such GRC solutions, I have stopped answering the phone when there is an unknown number, as the likelihood was very high of having a pushy sales person on the other end. 

This approach of distraction rather than creating value extends clearly into the content marketing arena. What you can often find is low relevance blog postings not written by the thought leaders in those companies or whitepapers which are essentially product brochures.

At Alyne, we wanted to do this differently. In line with one of our most important core values, every interaction should leave the counterpart in a better place than before, no matter if this is a customer, a lead, an employee, or just some random stranger passing by virtually or in the real world. We strongly believe that this will ultimately create benefits and value for everyone involved. Call it Karma, if you want.

Bringing 21st century content marketing to GRC

These core principles translate into distinct and specific elements of our content marketing strategy:

  • Respect your Buyer Personas - Don't annoy them with communications irrelevant to them
  • Create high quality content that can stand on its own and is not just pushing your product - It's absolutely fair if that is one of your core objectives, as long as it's not the only one
  • Make it easy for your Buyer Personas to discover and consume your content - Timing and accessibility is key here (e.g. reading news while commuting on public transport)
  • Be opinionated and show your personal viewpoint - Granted, this can be a fine line sometimes, but overall, readers usually get more value out of content, if they can somehow emotionally relate to your own subjective assessment of a particular topic
  • Connect to actionable conversion goals - Give your readers an opportunity to take a next step and get closer to becoming a customer. But remember: Don't be annoying! This is easiest, if the action goal is something the reader actually wants.
  • Constantly measure - Put an emphasis on the analytics for your content (e.g. Google Analytics, reach on the various social media platforms, conversion rates to your actionable goals) to identify well performing content based on buyer persona segments

These are all well established techniques in highly digital sales driven companies, but many software vendors seem to be stuck in 20th century sales and marketing approaches.

Proven content marketing examples for GRC

Let me give you some examples from our own marketing execution over the last months based on the above points, how well they are performing, and what insights we gleaned from them

Buyer Personas and high quality content

From our combined 40+ year experience in the GRC space, we already had a pretty good understanding of the various roles, positions, and personalities, which form our different Buyer Personas (I even was one or two of them for the last 3.5 years). However, through observing engagement and conversions of particularly well performing content, we have been able to significantly refine them. For example, our coverage about the German IT-Security Law has highlighted that hospitals seem to be a quite interesting area as they are now clearly considered to be Critical Infrastructure, but might have neglected Information Security as IT has become more and more critical to their daily operations over the last 10-20 years.

Easy and non-annoying content discovery

One of the reasons that the IT-Security Law content is performing sometimes in the range of 1000s of views per day lies in targeted postings to relevant discussion groups in Xing, the premier German-language professional social network. Obviously, this doesn't work as well on primarily English-language platforms, such as LinkedIn Pulse or Medium, but the lesson here lies in the use of promotion channels relevant to the Buyer Personas, who you are trying to reach.

Keep in mind that we have not yet spent a single Euro on paid postings, staying true to the Lean Startup method, which strongly guides our strategic decisions.

SEO is dead, but not really

Digital marketers are religious about Search Engine Optimisation, but let me tell you: Your grandmother's SEO doesn't work anymore (mainly due to various animals such as Penguin and Panda) but also because people now use the Internet differently than in the past. 

Nowadays, you should no longer optimise for traditional keywords (say "GRC" for example), as they are highly contested and can only be won with high capital investment for paid search. The new hot stuff lies in so-called long tail keywords, which also match much more closely with people's actual search behaviour (e.g. "What is GRC" - Alyne is on page 2 at the time of writing).

In addition, you want high quality backlinks to your content. You can partly achieve this, by creating topic-specific landing pages, which serve the additional purpose of speaking directly to specific Buyer Personas. For example, we created these pages using the great Instapage service:

ADV Prüfungen


UK Cyber Essentials

OpRisk Management

IT-Sicherheitsgesetz umsetzen

Manage Business Continuity

Maximising reach through Influencer outreach

In addition, an extremely high ROI activity is investing time in something called Influencer Marketing. Mainly, this involves identifying Influencers (or the amazing German word "Zielgruppenbesitzer" as someone mentioned at a Munich Chamber of Commerce event) and finding ways to create value and win-win situations for them. This can be achieved by:

  • Cold social network connection request (if you actually have valuable experience to them)
  • Quoting and linking their content in yours
  • Offering your content as guest posting or, if you developed already good reach, guest posting from them on your channels (our IT-Security Law content is running on
  • Engaging with their content in a value-adding way (re-tweets, shares, commenting)
  • Letting them know that you gave them a shoutout (If you have the money, I would definitely recommend the tool to make this more efficient)

Again, if done in a non-annoying and value creating fashion, this will result in Influencers engaging with your own content and raising awareness in their audience. If you have been particularly nice, this will result also in those valuable SEO Backlinks.

Let me stress here, that the goal here is not a sprint of meaningless one-time interactions but building sustainable relationships, which are valuable for all involved.

Now despite not yet having invested any cash in this so far (only our still very valuable time), we have gotten some impressive results with this approach. For example, if you search for "GRC Blog", Alyned Thinking is on 4th or 5th place at the time of writing, having displaced all major GRC tool vendors and reaching top influencers in this area, such as Michael Rasmussen's GRC2020, Norman Marks, or Gartner GRC thought leaders such as Paul Proctor.

Stefan Sulistyo

Related Posts

Real-Time Operational Risk Management in Financial Institutions (Part 1)

With this new article series, we explore and provide insights into Real-Time Operational Risk Management. In this first article, we deep dive into the many challenges of Operational Risk Management in many financial institutions and the goal of achieving an Integrated Risk Management approach that enables the organisation to make risk aware decisions that efficiently focus its resources and increase efficiency.
Read more

2021 Recap: Celebrating a Groundbreaking Year

2021 marks an incredible year for Alyne, now part of the Mitratech portfolio. The team invested a tremendous amount of effort and hard work to drive new growth, nurture opportunities, spark meaningful conversations, and incorporate powerful functionality into the platform. Take a look at our work, achievements and snapshots from the year.
Read more

Alyne's Assessments: Measuring Compliance Against Multiple Maturity Models

Assessments are an essential tool for measuring compliance. Recently within Alyne, we have improved our capabilities to cover Multiple Maturity Models, which enables users to configure more than one maturity model in their organisation and measure compliance in the levels of their choice. Using this feature, teams can create and customise levels to their Controls, assess compliance across multiple maturity models, create Reports and leverage this functionality in Alyne's Continuous Controls.
Read more