Joe Scotto Made Invisible Cyber Risks Impossible to Ignore

A factory is full of objects that do not look like computers. A pump minds its pressure. A controller opens a valve. A conveyor belt behaves like a conveyor belt, which is precisely how it avoids attracting the attention reserved for laptops and servers. Then a cyber incident interrupts production, and the harmless-looking machinery acquires a second identity: it is part of the attack surface.

Joe Scotto has spent much of his career working in that moment of recognition. His specialty is not the code that protects a device. It is the language that helps a buyer understand why the device belongs in the security conversation at all. In a sector fond of acronyms and catastrophe, he has repeatedly turned technical abstractions into business consequences: downtime, exposure, responsibility, value.

That instinct carried him from telecom and defense into two young cybersecurity companies addressing physical systems. At Indegy, the subject was operational technology, the controllers and networks behind manufacturing, energy and water. At CyberMDX, it was the connected equipment inside hospitals. Indegy was acquired by Tenable in December 2019. CyberMDX was acquired by Forescout in February 2022. Scotto led marketing at both.

First, learn to sell the switchboard

Scotto's long apprenticeship came in communications. Public career records place him at Nokia from 1997 to 2000, then at Avaya for more than a decade. At Avaya he moved through unified communications, enterprise solutions and global small-business product marketing. The titles trace a useful education: product, vertical market, solution, customer size. Each asks for a different translation of the same underlying technology.

In 2013, he joined BAE Systems Applied Intelligence to lead Americas field and demand-generation marketing. The environment changed from business communications to cyber and intelligence. So did the stakes. A campaign credited to his team, Ogilvy and BAE leadership carried the line “It's not just security. It's defense.” Its reported media budget was $20 million, and the work received an internal Business Leader Award for building awareness in commercial markets.

The line is an economical bit of positioning. Security can sound procedural, another department keeping the lights green. Defense gives it an adversary and a consequence. Scotto's later startup work would keep using that move: shift the discussion from a product category toward the costly event the category exists to prevent.

“What we kinda looked at was the learning, and then try to create some meaning out of it.”Joe Scotto, discussing hospital cybersecurity research

The machines get a story

After a short consulting assignment at KPMG, Scotto joined Indegy as chief marketing officer in 2018. The company protected industrial control systems. Its challenge was partly technical and partly theatrical: operational technology had long been managed apart from ordinary information technology, and many business leaders lacked a clear view into the equipment quietly running their operations.

Scotto's remit was described as defining the industrial-control-systems market category and building awareness around it. The output ranged from sober education to deliberate drama. Indegy's “Cyber War Game” video received a Summit award for innovation in emerging media. Its brand redesign, website and interactive work collected three Silver American Advertising Awards in 2019.

Behind the campaigns sat a fairly unglamorous discipline: deciding what a pilot should prove. In his public writing, Scotto separated proof of concept from proof of value. A concept asks whether something can work. Value asks what happens when it operates in the actual business. His advice began with success criteria, not a demo. It is difficult to imagine a more marketerly demand dressed in less marketerly clothing.

On December 2, 2019, Tenable bought Indegy for about $80.1 million. Scotto moved into a divisional marketing role focused on operational-technology security. The acquisition joined an established vulnerability-management company with the industrial visibility Indegy had been explaining to the market.

A hospital is not an office with beds

CyberMDX gave Scotto a harder translation problem. A connected medical device can be a patient monitor, an imaging system, a clinical workstation or something that resists a tidy category. Responsibility sits across biomedical teams, security leaders, device manufacturers and hospital IT. Each understands its own kingdom. The attackers, rather discourteously, observe no departmental boundaries.

In 2021, CyberMDX and Philips commissioned a survey of 130 hospital professionals in IT, information security and biomedical roles. During a public discussion of the results, Scotto kept returning to the “disconnects.” Respondents expressed high concern about attacks, yet their spending priorities and assessments of staffing did not always fit that anxiety. A risk can be acknowledged and still remain organizationally homeless.

His answer was collaboration with ownership. Biomedical teams know the devices. Security teams know the networks and threats. “It really does need to be a collaboration,” he said, while noting that the security responsibility appeared to be moving toward CIO and security organizations. This was not a shiny prediction. It was closer to drawing a seating chart before the emergency.

The marketing mixed research with reach. A CyberMDX campaign using Microsoft's Marketplace Rewards combined press, social material, listing optimization and a webinar for Microsoft sellers. The company reported a 116 percent rise in visits to its marketplace listing over six months and a 103 percent increase in unique visitors. The figures make a neat miniature of Scotto's method: define the risk, borrow a credible distribution channel, and measure whether the story traveled.

That preference for evidence matters in a market where alarm is abundant. Fear can win a glance, but it is poor architecture for a long sales cycle. A buyer still has to explain the purchase to finance, operations and colleagues who own the equipment. Research gives each of them something sturdier than atmosphere: a cost, a gap, a disputed responsibility. Scotto's hospital work did not pretend the contradictions had vanished. It put those contradictions on the table, where a commercial conversation could finally begin.

CyberMDX's brand and website won two Gold American Advertising Awards in 2022. Its “How Hospital Hacks Happen” awareness series also received a Summit Emerging Media Innovator award. The videos made the threat concrete by showing routes into a hospital network rather than merely declaring the network threatened. Forescout acquired the company on February 1, 2022, adding medical-device expertise to its coverage of IT, internet-of-things and operational-technology assets. Scotto stayed through September as a Forescout vice president of marketing.

After two exits, the category keeps moving

His next chapter widened the lens. Scotto established Volt Marketing in 2022, a Flemington, New Jersey consultancy where he is publicly identified as proprietor and consultant. He also joined nSure.ai as chief marketing officer, moving from protecting machinery and medical devices to preventing fraud in purchases of digital goods. The surface changed. The familiar issue remained trust in a system whose risk appears only when something goes wrong.

By 2024 he had returned to cybersecurity at CybSafe, working in human risk management. Announcing the move, he wrote about being energized by the company's thinking, then more energized after meeting his team in London. He named the sales-development group individually. It was a small public gesture, but it matches colleague descriptions that recur around him: thoughtful, proactive, strategic, generous with instruction.

The phrase “human risk” also completes an elegant career arc. Scotto began around communication systems, moved through institutional defense, then marketed protection for factories, hospital equipment, digital transactions and finally behavior itself. The protected asset kept getting closer to the person.

There is a temptation to tell this story as a sequence of acquisitions, because exits provide clean punctuation. But the more revealing achievement is sustained attention to the murky middle, where a specialist knows the danger and a buyer has not yet found the budget, owner or words for it. Scotto's work lives in that gap. His campaigns give the invisible a shape. His research looks for contradictions. His writing insists that a test should prove business value, not simply technical possibility.

Cybersecurity marketing can easily become a parade of dark rooms, red alerts and hooded silhouettes. Scotto's better idea is less cinematic and more useful: show the organization to itself. Point to the controller, the scanner, the buyer, the employee. Explain what connects them. Then make responsibility difficult to dodge. The machines were always part of the story. Somebody merely had to introduce them.