CyberLive: Honeypot Billboards

Read the campaign story

Hiscox launched CyberLive on 19 February 2018. Three purpose-built honeypot servers supplied data to digital outdoor advertising, where detected activity triggered red pulses and changes to the creative. The insurer described the aim as challenging the assumption that small businesses were unlikely cyber targets. AMV BBDO created the campaign with Goodstuff, Talon and Grand Visual; the production account identifies the dynamic content delivery system.

The posters made normally unseen network activity visible in public locations. However, the source language alternates between attacks, hacks and breaches, terms that should not be treated as equivalent. This case describes detected activity and attempted access to campaign test systems. It does not convert that activity into a count of businesses harmed, successful compromises, insured losses or attacks prevented by buying insurance.

Editorial interpretation: live information gives a warning a different texture from a static statistic. A changing display can show that an issue continues while the audience is looking at it. The creative opportunity is to make the signal understandable without requiring technical expertise. Its credibility depends on explaining what is being counted, where the data comes from and why that particular observation is relevant to the audience’s decisions.

Editorial interpretation: a dramatic signal can also produce an exaggerated risk impression. A test system designed to attract attention from scanners may generate activity that differs from a properly maintained business environment. The campaign’s educational value is stronger when it leads to proportionate protective steps rather than fear alone. A responsible adaptation would distinguish detection, attempted intrusion, successful compromise and damage, then explain which practical actions address each stage.

Define the event before visualising it

Write a plain-language definition of the event your display represents. Have a qualified specialist check whether the label matches the data. Avoid words such as breach when the system only records an attempt. Show the observation period and any resets. A visual counter can appear authoritative even when its units are ambiguous, so the explanation is part of the creative work.

Use a safe dataset for a small adaptation

Do not create exposed infrastructure merely to obtain dramatic content. A small team can work with an approved historical dataset, an expert-reviewed simulation or aggregate information from an existing authorised system. Protect identifiers and operational details. Clearly label delayed or simulated data rather than implying that every animation corresponds to a live event occurring at that moment.

Offer a proportionate next step

Pair the attention device with a short, practical explanation of what the audience can do. Avoid implying that one product removes all risk or that insurance replaces basic security practice. Let readers distinguish prevention, response and financial protection. A useful communication should leave people better able to ask an informed question, not simply more anxious about an invisible threat.

A small test for another brief

Proposed test: a local business association could create an expert-reviewed display using a small historical sample of benign security-event categories, alongside a plain-language checklist for discussing protection with qualified advisers.

Measure correct risk comprehension, confidence in asking an appropriate question and recognition of the data’s limits. Record fear separately and do not treat increased alarm as successful education.

Stop if the display exposes technical details, encourages unsafe experimentation, exaggerates the meaning of events or implies guaranteed protection from any product.

• Use only authorised, de-identified data or an explicitly labelled simulation.
• Compare the visual explanation with a conventional paragraph containing the same facts.
• Ask readers to distinguish attempts, incidents and damage before showing a next-step resource.