OWASP Marketing Plan
20 January 2022

Process

Staff 1:1
Interviews

Included Board
StrategicPrioritization
Exercise

SituationalAnalysis

October – November 2021

2Stakeholder
SurveyMarketingPlan

December 2021 – January 2022

Strategic Priorities

Marketing Objectives

As identified by current and past OWASP Board members

Organizational priorities over the next five years?

STRENGTHEN THEOWASP BRAND

••
••

4

Leader in dev &security community
Stronger marketing
More developer
outreachThought leadership

GROW
MEMBERSHIP••••

Grow in size
Grow in sphere ofinfluence
Engage a larger
constituency
Grow events••••

EDUCATION

REINFORCE THE
COMMUNITY

Current trends &vulnerabilities
More tools, morestandards
AI & machine learning
Certification?

••••

Activate knowledge
network
Partnership projects
Entry-level resources(“gateway drug for newdevelopers”)
Strengthen tie w/vendors & integrators

EXPLORE &INNOVATE

Board
ExerciseDec. 2022

What specific project would you like to see OWASP pursue?
• ZAP (mentioned 4x)• OWASP Top 10 (mentioned 2x)• JuiceShop (mentioned 2x)• Security w/ AI & machine learning

Board
ExerciseDec. 2022• Dependency check• DevSecOps Guidelines• Standards and policies that can be implemented in applications, especially after Log4J,• Securing the supply chain by collaborating with frameworks, modules, and libraries to secure the Top 10frameworks, libraries, or modules in use on each major platform• A real DevSecOps project that is as transformational to security as DevOps was to software. Not shoving
traditional security into DevOps or mindless shift left. But a real rethinking of the *purpose* of all thisstuff and better ways to deliver that value

5How would you divide $100 among strategic priorities?
$25.00You spent$118$22.86$20.00$18.07$15.00$16.38$14.28$13.62$11.29$10.90$10.90

EducationalProjectOWAS
New
Membership Growth in
Chapter
Programming Development Awareness Resources for Growth
Key Areas of Cultivation
amongDevelopers
WorldDevelopers

OWASP
Awarenessamong
Executives$10.00
$5.00

$0.00

Board
ExerciseDec. 2022
6

Staff Interviews & Situational Analysis

Overview of Interviews

Five interviews

8Growth seen as
important, but hasn’t
been a priority

Members tend to be
more pragmatic aboutproblems OWASP cansolve; staff more
aspirational about
what OWASP can beConsensus that much
more can beaccomplished via
marketing/communications

Clearly there is apowerful, fascinatingstory for OWASP totell

Describe OWASPCollection of developers andapp sec professionals who
get together to make web
applications secure

Exists to educate theindividuals in the industry

We make the world’s
software more secure

Best way to network in theindustry (meet people you’ll
never otherwise meet)

Disseminates app sec
knowledge and skills toprofessionals and developers
worldwide

Community of chapters, lotsof different communities (notcolored by corporaterealities)

Key Audiences

Developers
Web App Developers
MobileNetwork-Aware Applications
Front-End Apps & APIs

App Sec Leadership

C SuiteUniversities

Software Architects

Limitations

NOT ENOUGH
GENERAL
MARKETING OR
ENOUGH MONEY
SPENT

FOCUS OF BOARD

USED TO HAVESOCIAL MEDIACALENDAR, DON’TNOWTIME AND MONEY

11MORE INTERESTEDIN MANAGINGOWASP THAN
BRINGING IN $25M
GRANTSTOXIC YEAR TWOYEARS AGO (LOTS“UNCLICKED US”)

Assets

12Meetings & events

Amazing projects thateveryone in the world
uses

Buddy Club

350 people come toevery monthly meeting

4,000 members

172K Twitter Followers,
142K LinkedIn
Followers; 22K
Facebook, Etc.

Vendor neutral

An engaged
community

Meaningful content(app sec tools, available
code, documentation
projects)

Prospect list of 46,000

Marketing Channels
WebsiteLinkedInTwitterReddit

Meetup (252 groups)

Slack

Mail Chimp

WoM from members

Chapters

13

Paid Digital

Venues & Publications(websites) thatprovide app security(Stack Exchange)

Emerging Priorities

Grow••••

Increase membership (community is100-200K; OWASP has 5,000members)
Increase awareness & attendance atevents (1000s register, only 25%attend)
Increase sponsorships
Expand influence

14Connect•••

Find a different pool ofpeople (more developers)
Connect w/ companies tounderstand theirperspectives and needs
Push diversity

Tell the OWASP story
better•••••New mission statement
Better marketing copy (doesn’t pop)
Build more value into membership(“everything is free, so no one joins”)
Leverage connected stakeholders tofacilitate WoM referrals
Lay the groundwork for certification ofapp sec professionals

Stakeholder Survey

OWASP Survey Methodology
Distributed to approximately 10,000 individuals (members & non-members)
12.3% response (1,231 responses: 722 members, 467 non-members)
Responses cross-tabulated to analyze member vs. non-member responses
Results are statistically significant
Goal was to gather intel for marketing
Board of Directors exercise to establish strategic priorities

16How would members encourage friends/colleagues tojoin OWASP?
• Keywords: Security, Community, Projects, Application
Security• “One of the best resources for learning - lots of appsec
content, and an awesome community of practitioners”• “One stop shop for App Sec”
• “Get access to body of knowledge and like-minded
professionals by engaging with OWASP”• “The work conducted by OWASP helps us to keep ourplatforms safe and to improve the security of systems
across the world, improving other systems we use. It's
important for us to help with funding via membershipfees.”
17

Awareness of OWASP among Non-members
What is OWASP?, 1%
Not soFamiliar,
9%

Extremely
Familiar,
12%•••
Somewhat Familiar,
46%

18

Very Familiar, 32%

Awareness not a significant problem
Logical that few would have little
familiarity since names are in theOWASP database to start
Goal should be to move large
percentage (46%) from “Somewhat
Familiar” to “Very Familiar”

Why are you NOT an OWASP member?
•Cost of dues

45%

Get what I need w/o being amember40%

I haven't been invited

•

24%

•

Other organizations better fit
my needs

9%

No niche or project thatmatches what I do

7%

Content & programming notrelevant

1%
0%19•

•

10%

20%

30%

40%

50%

This is about cost, giving away the milk for
free, and being deliberate about sustained
recruitment campaigns
The content is relevant (just 1% sayotherwise)
There are niches and projects for most (just7% of non-members say otherwise)
Other organizations are not the reason (just9% of non-members say other orgs are abetter fit)
Large pct said “other” (36%)•No significant findings, other than “time”
and reiterating cost•Some thought they already weremembers (though they had justindicated they were not)

Why are you NOT an OWASP member? (other)• A handful pointed to inactivity of local chapter• Many cite time (suggest highlighting “saving time” asa member benefit)•”I haven't had a specific reason to join.”• “Because (they) kicked me off since I did not pay anannual membership fee, thus I am no longer
admitted any longer to be an OWASP volunteer.”• “I had my company ready to sign up for corporate
membership, but wanted 5 individuals to havemembership under that. Your team said, ‘no.’”20

What, if anything, would convince you to join OWASP?
• Convince employers to cover costs• Reasonable pct intend to do so, justhaven’t• Need to articulate the value• “That me being a member would make adifference for the organization”• “Tiered membership with some freecontent and then more access depending
on membership tier”

21“I pay my dues with a reason why it
is important. I donate to Wikipedia
because Jimmy Wales reminds me,and says it is important. Note that mycompany matches donations toWikipedia, but not membership fees.”At what price would you be willing to join OWASP?
64 people said zero; 85 said <$10
Removing outliers, average is $41, median is $50
Overall range is 0 - $100 (not one person said >$100)$50 is clearly the sweet spot
Cost in developing markets is an issue22

Subjects of relevance/interest

STRONG
INTERESTSTRONGRELEVANCE

Non-members, asked in 2 separate questions

23

Attack vectors

Threat modeling

66%

51%

Top Ten
Vulnerabilities
83%

Enterprise appsec,
architecture, orrisk management
59%

CI/CD system
breaches
41%

Building security
champions49%

Thwartingmalicious
automation
41%

Automatedserver-lessautomation
46%

These topics
should be
showcased inmessaging:“Demonstrate
Member Value”

Where non-members access info & services
Websites, publications,
resources accessed for work

Developer communities
accessed (at least monthly)Social platforms used forwork (at least weekly)

1.

LinkedIn

1.

Stack Overflow (80%)

1.

LinkedIn (64%)

2.

NIST

2.

Hacker News (66%)

2.

YouTube (61%)

3.

SANS

3.

Reddit (63%)

3.

Twitter (48%)

4.

IEEE

4.

MSDN/Microsoft (45%)

4.

Slack (45%)

5.

ISC2

5.

What’s App (38%)

Tactics & messaging should cross theseplatforms to reach high concentrationsof your target market
24

Demographics of your target audience
Most Common Titles
1.

Security analyst, 26%2.

Software engineer,14%• 6-10 – 22%

3.

CISO, 9%• 3-5 – 17%

4.

Director or VP ofEngineering, 9%

5.

Other title keywords:
architect, consultant,appsec

25• > 10 – 44%• 1-2 – 7%

Geography

Type of Employer

Years of Experience1.

Large Co. – 46%

1.

N. America – 43%

2.

Medium Co. – 18%

2.

W. Europe – 30%

3.

Small Co. – 13%3.

E. Asia – 10%

4.

Consultant/IC – 14%4.

E. Europe – 6%

5.

Academic – 3%

5.

Middle East – 5%

6.

Student – 5%

6.

S. America – 3%

7.

W. Asia – 2%

8.

Africa – 1%

9.

C. America – <1%

Use this intel to create profiles &target prospects on social
platforms and otherwise

Profiles

•

•

•

•

Mid-Career Security Analyst• Works for large company• Resides in North America• Visits LinkedIn, YouTube &Twitter frequently for work
• Uses NIST as a resource

26

Wants to makea difference
Interested inattack vectors &vulnerabilities

European Software Engineer• Works for medium-sizedcompany• Resides in Western Europe• Visits LinkedIn & Slack• Uses Stack Overflow &Hacker News••Needs to see explicit value
for paying what they
already get for free
Currency exchange makes
US$50 a stretch

Wants to contribute, butdoesn’t know how
Employer won’t cover costof dues

East Asian Engineering Director• Works for small company• Resides in Kuala Lumpur• Uses LinkedIn & Slack• Often on Reddit

Emerging Marketing Objectives

Strongerawareness andappreciation ofOWASP among
key audiences••

Build awareness &•visibility among larger
groups of developers •Showcase membership& specific projects

Wider and deeper
engagement withOWASP bysubject-matter
experts

Tactical support ofkey programs andinitiatives

More developers • Drive event
participating
participation
Awareness ofresources & projects•••

Membership
growth in the rightplacesExpandopportunities toexercise thought
leadership andcollaboration on
solutions

Systematic &sustained
campaigns
Tell OWASP story
betterBuild geographic
diversity

Seize opportunities forexposure
Showcaseorganizational
accomplishments••

Wider geographicfootprint

Recommendations

MINE & LEVERAGE
EXISTING CONTENTTELL THE OWASPSTORY IN NEW WAYS

MEMBER SPOTLIGHTSERIESNEW COLLATERAL28

DIGITAL
ADVERTISING &SOCIAL GRAPHICSSEIZE
OPPORTUNITIES FORVISIBILITY

LEVERAGE OWASPCHAPTERS

Recommendation 1: Mine & Leverage Existing Content•••

29

OWASP owns extensive content
that can be reposted & releveraged
All of it delivers the OWASP story
the way you want it told
Repurpose content and share it
across social media channels tobuild visibility

Recommendation 2: Tell the OWASP Story in New Ways• Communicate through the lens ofyour members & prospects• Integrate what they care bout into
your messaging (threat modeling,vulnerabilities, attack vectors, etc.)• Find new platforms• Leverage events & opportunities

30

Recommendation 3:
Member Spotlight• Let your members tell theOWASP story on your behalf• They’ll connect w/ theirnetworks• They’ll demonstrate value &credibility that you couldn’t on
your own• They’ll put names and faces w/OWASP

31

Showcasing Your Members
OWASP asks thequestions••••

What do you value
about OWASP?
Why is OWASP
important to you?
Where is OWASP
headed?
Etc.

Member Company
or individualanswers•••

They articulate theOWASP story on
your behalf
Generally, aboutOWASPNarrowly, about aprogram, standard,or project

OWASP packages
the answer(s)•••••GraphicBlog
Video
Press releaseBy-lined article

Mix of members by size& geography
32

OWASP posts on
its site & social
platforms••

Great content
for OWASP toshare on itschannels
Can bedelivered inlong form andin sound bite

Member shareswith the world••

Member benefits
from visibility
OWASP gains
visibility acrosswider channels,
among perfecttarget audiences

Recommendation 4: Digital Advertising & Social Graphics• Social media graphics• Paid digital• Videos• Blog posts• Feed the channels and letthem do the work for you• Leverage intel gathered in
Stakeholder Survey
•
••

33

Whom to target
What they value
Where they gather & consume
information

Recommendation 5: Leverage Chapters• With all tactics, consider how
chapters can play a role
• Design marketing elements toallow for distribution viachapters• Use chapters to identify
subjects for content34

Recommendation 6: New Collateral

Differentiate OWASP
programs and services

35

Fill gaps in support ofstrategic priorities

Infographics, flyers,brochures to seize
opportunities for thought
leadership

Recommendation 7: Seize Opportunities for Visibility• OWASP has outsized opportunity to generate
positive visibility from work on Projects•••

Announcements from working groups
Accomplishments
Meetings & events• A blend of P.R. & social media••••

Podcasts
VideosBlog posts
Press releases• Tell and show the OWSP story … don’t be shy36

Hub & Spokes of the OWASP Marketing Eco-System
A blend of content,
advertising & social
media to drive
engagement,
website visits, andacquisition ofcontact information

Digital & Social
Advertising
MessagingCampaign refined
Basedto tell
story
onOWASP
Personas
Metrics analyzed, tactics
Personas Refinedadjustedfor Prospect
TargetingEngage chapters

At any point,
learning caninform & adjust
the approach

37

Content Shared via
Social Channels
New graphics,
content & collateral

LES Website
Equipped w/ PopMembers
Up Prospectapproached
for &Capture
memberRemarketingspotlights

Intel Gathered onTarget Audiencesin Reporting
Tactical P.R. forGraphics, content,
events, newsworthy
spotlights
sharedDigital & Social
accomplishments
Number of Social
onsocialmedia
Advertising MicroChannel Followers
Targets Prospects
Content Shared via
Increases
Social Channels
Members share
Cont'd Digital & Social
graphics & content
Advertising Campaign
on social
Employed

Mine & leverage existing content
What existing content has use for building visibilityof OWASP and/or its strategic priorities? (videos,blog posts, white papers, research)Content distributed via social media channels,
targeting key audiences

February
January

March & Beyond
Content distilled into soundbites & synchronizedwith social media calendar

38

Member Spotlight series
February

April & Beyond

Identify three to five member
companies worthy of spotlightContinue the series

Draft series of interview
questions about OWASP’s value
to members

Expand into video and/or
podcasts if concept gets sometraction

Conduct interviews w/ members –via email, phone call or Zoom
Assemble content & distribute on
OWASP website & social channels

Provide to member for additional
distributionMarch39

New collateral
February - March

June & beyond

Establish hierarchy of need

Gauge reaction- Membership growthMove on to additional needs- Chapter engagement
Create templates

Develop in sequence with need
Tell the general OWASP story…
…along w/ needs of other areasof organization

April - May40

Seize opportunities for visibility
Quarter 1

Quarter 2 & Beyond

Establish hierarchy of need.
Establish a master calendar of
touchpoints w/ OWASP’s key
audiences

Synchronize events & P.R. withsocial media, newsletter, andother touchpoints w/ members
and prospects

Seize unique opportunities to tellthe OWASP story via events andP.R.
• Where are OWASP leaders speaking?
• Where are OWASP target audiences
gathering in large numbers?
• What OWASP moments are worthy ofnews coverage?

Quarter 241

Metrics

Membershipengagement

Projects
completedWebsite traffic

Dashboard42

Social media
followers

New members