Loading
Loading
Phill Keaney-Bolland· Co-founder and Designer, Yaya7 min readWe scored the 77 startups exhibiting at RSA’s Early Stage Expo and Next Stage on proposition, brand and marketing. Fifty-five of them lead with blue. The median website reads at a postgraduate level. Here is the rest of it.
Over the past few months, our judges assessed the 77 startups exhibiting at RSA in San Francisco this year, across the Early Stage Expo and the Next Stage. We were looking for the next big things: the businesses that have nailed their proposition, brand, website, and marketing. In this report we reveal the top startups in each of the major cyber verticals, along with the trends our research unearthed across the industry.
Only a few genuine outliers are nailing their brand visual identity. The brands that have dared to tell a different story to the rest of the pack, and to create something truly memorable, stand out immediately. The top brands, like Token, Aim Security, and Reality Defender, show that you can actually increase trustworthiness by taking risks.
Three categories became apparent:
Source: Yaya analysis of all 77 startups exhibiting at RSA 2025. Base: 75 of 77 startups.
| Category | Number of startups | Share |
|---|---|---|
| 0 to 39 | 19 | 25% |
| 40 to 59 | 26 | 35% |
| 60 to 79 | 26 | 35% |
| 80 to 100 | 4 | 5% |
By far the most popular brand color for cybersecurity startups this year was blue, with almost 70% of the businesses we analyzed using it as their primary brand color. Simply put: if you want to look like everyone else, be blue.
Source: Yaya analysis of all 77 startups exhibiting at RSA 2025. Base: 77 of 77 startups.
| Category | Number of startups | Share |
|---|---|---|
| Blue | 55 | 71% |
| Purple | 9 | 12% |
| Orange | 5 | 6% |
| Pink | 4 | 5% |
| Red | 2 | 3% |
| Unknown | 1 | 1% |
| Green | 1 | 1% |
When you look the same as all your competitors, it becomes very hard for customers to distinguish between you. You become forgettable and, worse, homogenous. When customers see every option in front of them as more or less the same, the only thing left to differentiate on is cost. Cue commoditization, a race to the bottom, and eroded profit margins.
There is a little more diversity when you factor in secondary colors and look at every individual shade, but not much.
Source: Yaya analysis of all 77 startups exhibiting at RSA 2025. Base: 149 primary and secondary colors across the 77 startups.
| Category | Number of swatches | Share |
|---|---|---|
| #d30404 | 1 | 1% |
| #cc1818 | 1 | 1% |
| #e03939 | 1 | 1% |
| #e36159 | 1 | 1% |
| #f0523d | 1 | 1% |
| #ef6b51 | 1 | 1% |
| #ef6b51 | 1 | 1% |
| #ff7a59 | 1 | 1% |
| #ff7a53 | 1 | 1% |
| #ff3d00 | 1 | 1% |
| #d46844 | 1 | 1% |
| #fe5b17 | 1 | 1% |
| #ff763b | 1 | 1% |
| #fe802e | 1 | 1% |
| #eef1d5 | 1 | 1% |
| #96ff4d | 1 | 1% |
| #4ebf22 | 1 | 1% |
| #04a600 | 1 | 1% |
| #3adb76 | 1 | 1% |
| #3cc982 | 1 | 1% |
| #1cb797 | 1 | 1% |
| #bae8e8 | 1 | 1% |
| #078586 | 1 | 1% |
| #064c59 | 1 | 1% |
| #06b4e0 | 1 | 1% |
| #5bc0de | 1 | 1% |
| #00aef0 | 1 | 1% |
| #0085ba | 1 | 1% |
| #0085ba | 1 | 1% |
| #6ec1e4 | 1 | 1% |
| #6ec1e4 | 1 | 1% |
| #6ec1e4 | 1 | 1% |
| #6ec1e4 | 1 | 1% |
| #6ec1e4 | 1 | 1% |
| #68d2ff | 1 | 1% |
| #285d75 | 1 | 1% |
| #007cc3 | 1 | 1% |
| #123346 | 1 | 1% |
| #0095eb | 1 | 1% |
| #1d2e38 | 1 | 1% |
| #eaeff2 | 1 | 1% |
| #59abe3 | 1 | 1% |
| #91d0ff | 1 | 1% |
| #0b64ae | 1 | 1% |
| #006ac3 | 1 | 1% |
| #3276b1 | 1 | 1% |
| #3898ec | 1 | 1% |
| #3898ec | 1 | 1% |
| #3898ec | 1 | 1% |
| #3898ec | 1 | 1% |
| #3898ec | 1 | 1% |
| #3898ec | 1 | 1% |
| #3898ec | 1 | 1% |
| #3898ec | 1 | 1% |
| #3898ec | 1 | 1% |
| #3898ec | 1 | 1% |
| #3898ec | 1 | 1% |
| #3898ec | 1 | 1% |
| #3898ec | 1 | 1% |
| #3898ec | 1 | 1% |
| #3898ec | 1 | 1% |
| #293a4a | 1 | 1% |
| #2875c1 | 1 | 1% |
| #186fce | 1 | 1% |
| #e4ebf3 | 1 | 1% |
| #025dcc | 1 | 1% |
| #0068e7 | 1 | 1% |
| #4b99ff | 1 | 1% |
| #1a73e8 | 1 | 1% |
| #1d2939 | 1 | 1% |
| #003681 | 1 | 1% |
| #4693ff | 1 | 1% |
| #536b8d | 1 | 1% |
| #0b5ed7 | 1 | 1% |
| #052c65 | 1 | 1% |
| #052c65 | 1 | 1% |
| #052c65 | 1 | 1% |
| #0a53be | 1 | 1% |
| #e2e6ec | 1 | 1% |
| #1b5cbf | 1 | 1% |
| #cfe2ff | 1 | 1% |
| #cfe2ff | 1 | 1% |
| #cfe2ff | 1 | 1% |
| #2871e6 | 1 | 1% |
| #377ef0 | 1 | 1% |
| #4081ea | 1 | 1% |
| #0b68ff | 1 | 1% |
| #3578e5 | 1 | 1% |
| #3b82f6 | 1 | 1% |
| #1e293b | 1 | 1% |
| #4285f4 | 1 | 1% |
| #4285f4 | 1 | 1% |
| #2360d9 | 1 | 1% |
| #516ead | 1 | 1% |
| #2563eb | 1 | 1% |
| #3775ff | 1 | 1% |
| #2663ff | 1 | 1% |
| #3866de | 1 | 1% |
| #001857 | 1 | 1% |
| #2759dd | 1 | 1% |
| #012591 | 1 | 1% |
| #7383b4 | 1 | 1% |
| #265aff | 1 | 1% |
| #344681 | 1 | 1% |
| #1c49ea | 1 | 1% |
| #a7b0de | 1 | 1% |
| #dee2f7 | 1 | 1% |
| #3b5afd | 1 | 1% |
| #586fe9 | 1 | 1% |
| #1d2030 | 1 | 1% |
| #cbd0eb | 1 | 1% |
| #7a89e1 | 1 | 1% |
| #353c69 | 1 | 1% |
| #5167f6 | 1 | 1% |
| #1a2256 | 1 | 1% |
| #5b6cff | 1 | 1% |
| #606eea | 1 | 1% |
| #171c4d | 1 | 1% |
| #0000f5 | 1 | 1% |
| #514df6 | 1 | 1% |
| #3e3bb4 | 1 | 1% |
| #4f46e5 | 1 | 1% |
| #4a3aff | 1 | 1% |
| #afa7ff | 1 | 1% |
| #7b6dff | 1 | 1% |
| #392396 | 1 | 1% |
| #9478e6 | 1 | 1% |
| #642eff | 1 | 1% |
| #53389e | 1 | 1% |
| #6941c6 | 1 | 1% |
| #9c7edf | 1 | 1% |
| #1d054f | 1 | 1% |
| #d2bdf5 | 1 | 1% |
| #af89ee | 1 | 1% |
| #7f54b3 | 1 | 1% |
| #e9d7fe | 1 | 1% |
| #7304e2 | 1 | 1% |
| #ded1e8 | 1 | 1% |
| #7d5b94 | 1 | 1% |
| #ddcee2 | 1 | 1% |
| #ff4895 | 1 | 1% |
| #ff6795 | 1 | 1% |
| #dd3c69 | 1 | 1% |
| #ffe0e8 | 1 | 1% |
| #ff3458 | 1 | 1% |
| #f43f59 | 1 | 1% |
| #fd5861 | 1 | 1% |
| #ce2c30 | 1 | 1% |
| #ff0006 | 1 | 1% |
Our advice: stand out, give your customers something to remember you by, and be brave with your color choices.
Our tone of voice analysis revealed a category communicating in a highly technical, professional, and informative register. Security is a serious subject, and it is critical to build trust while demonstrating expertise.
Source: Yaya analysis of all 77 startups exhibiting at RSA 2025. Base: 77 of 77 startups.
| Category | Number of startups | Share |
|---|---|---|
| Informative | 53 | 69% |
| Authoritative | 12 | 16% |
| Friendly | 9 | 12% |
| Formal | 2 | 3% |
| Informal | 1 | 1% |
As with color, this creates a high level of similarity between the businesses in the space. During our research we struggled to find many distinct tones of voice or personalities. It is a difficult balancing act, and nobody wants a wacky cybersecurity startup that reduces trust. But consider Wiz, the largest acquisition in Google’s history, and their tone of voice: little touches of personality like “Shift happens” sit alongside bold headlines that echo Apple’s approach to copywriting. Wiz is extremely credible, and there is something else there too: the confidence to have fun, inject character, and stand out. It is entirely possible to have character and build trust at the same time.
Our advice: treat tone of voice as another opportunity to put daylight between you and your competitors. The best copy explains and engages in the same breath.
One of the biggest challenges the industry faces is taking highly complex, technical products and making them easy for customers to wrap their heads around. We analyzed the Home, About, Product, and Blog pages of all 77 startups’ websites.
Source: Yaya analysis of all 77 startups exhibiting at RSA 2025. Base: 72 of 77 startups. Median grade 16.2.
| Category | Number of startups | Share |
|---|---|---|
| Grade 10 to 12 | 6 | 8% |
| Grade 13 to 15 | 27 | 38% |
| Grade 16 to 18 | 28 | 39% |
| Grade 19 and above | 11 | 15% |
Using the leading measure of readability, the Flesch-Kincaid grade level, we learned that the majority of cybersecurity startup websites are pitched at an extraordinarily high level. They often require a post-graduate degree to be understood. Put simply, they are typically as hard to read as an academic paper.
Nobody is suggesting cybersecurity is not a complex topic, or that the audience is not highly educated. The challenge is that we are talking about a website. People do not browse websites in a linear fashion. When we analyze user behavior with screen recordings, eye tracking, and heatmaps, we see a strong tendency to skim, scroll at speed, and click through pages at a rate of knots. Users act much more like flies trying to find a way out of a room than PhD students in a library. Complex, challenging language is out of step with how people actually use websites, and it makes those websites far less effective. We explore this finding further in your website reads like an academic paper.
Webflow is the single most common platform, running 30 of the 77 sites, with WordPress close behind on 25. Between them they account for seven in ten. Whatever else that says, it says most of these companies do not own the codebase behind their most important sales asset.
Source: Yaya analysis of all 77 startups exhibiting at RSA 2025. Base: 77 of 77 startups.
| Category | Number of startups | Share |
|---|---|---|
| Webflow | 30 | 39% |
| WordPress | 25 | 32% |
| Other | 19 | 25% |
| Squarespace | 1 | 1% |
| Wix | 1 | 1% |
| Shopify | 1 | 1% |
Half the cohort runs no marketing automation at all. Among the 39 that do, HubSpot is close to universal: 38 of them.
Source: Yaya analysis of all 77 startups exhibiting at RSA 2025. Base: 77 of 77 startups.
| Category | Number of startups | Share |
|---|---|---|
| None | 38 | 49% |
| HubSpot | 36 | 47% |
| HubSpot, Salesforce | 2 | 3% |
| Salesforce | 1 | 1% |
Taken together, the picture is of a category that has standardized on rented, closed platforms for its most important sales asset.
Just over half of the startups we analyzed use paid advertising to attract customers.
Source: Yaya analysis of all 77 startups exhibiting at RSA 2025. Base: 43 startups running paid advertising; companies may run more than one channel.
| Category | Number of startups | Share |
|---|---|---|
| Running paid ads | 43 | 56% |
| No paid ads | 34 | 44% |
The most popular advertising channel was LinkedIn, by some distance. Meta and Google, channels that typically enjoy a lower cost per impression, are largely untapped. Most of the businesses that advertise do not send that traffic to a conversion-optimized landing page: 23 of the 43 advertisers point their ads at a general page instead, against 18 that built one. Paying for the click and then dropping the visitor on a homepage is the most expensive way to lose them.
Source: Yaya analysis of all 77 startups exhibiting at RSA 2025. Base: 43 of the 77 startups that run paid advertising.
| Category | Number of startups | Share |
|---|---|---|
| 39 | 85% | |
| 6 | 13% | |
| Meta | 1 | 2% |
Source: Yaya analysis of all 77 startups exhibiting at RSA 2025. Base: 43 of the 77 startups that run paid advertising.
| Category | Number of advertisers | Share |
|---|---|---|
| Unknown | 26 | 60% |
| Medium | 13 | 30% |
| High | 3 | 7% |
| Low | 1 | 2% |
Source: Yaya analysis of all 77 startups exhibiting at RSA 2025. Base: 43 of the 77 startups that run paid advertising.
| Category | Number of advertisers | Share |
|---|---|---|
| Not Landing Page | 23 | 53% |
| Landing Page | 18 | 42% |
| None | 1 | 2% |
| Unknown | 1 | 2% |
Only 42% of the startups offer a genuine piece of value, tied to their value proposition, in exchange for contact details. We counted anything a buyer could use on their own: a scan, a trial, a tool, a report, a calculator. Gated demo requests did not count.
Twine and Aryon are not scored anywhere in this report. We built both, so ranking them would not have been fair to anyone else in the cohort. Their scores are excluded from every chart here.
We used our Cult Products Framework to score each brand on three areas:
Congratulations to every winner.
Read the findings side by side and one theme dominates: convergence. The category has converged on one color, one register, one reading level, one set of rented platforms, and one destination for its marketing. Against that backdrop, the outliers did not sacrifice credibility by breaking convention. They gained it. The startups at the top of these rankings paired a big idea with disciplined execution, and the data suggests the rest of the field has more to fear from blending in than from standing out.
Yaya is a brand and digital design studio working exclusively with cybersecurity startups. Since 2019 we have helped more than 50 businesses across North America, Europe, the Middle East, and Asia create Cult Products: propositions, brands, and websites that make selling to enterprise CISOs easier. We take one project a month, and the founders you meet do the work. We helped both Twine and Geordie reach the RSA Innovation Sandbox final, with Geordie taking the win.
Phill Keaney-Bolland
Co-founder and Designer, Yaya
Co-founder and designer at Yaya, and host of the Cult Products podcast. Fifteen years designing products, brands and UX across multiple industries before narrowing to cybersecurity, and lectures on design at Imperial. Works with cybersecurity founders on positioning, strategy and the website that has to carry a launch, across identity, cloud security, AI agents and software supply chain, including Twine out of stealth and Geordie AI, which won the RSA Innovation Sandbox in 2026.
Occasional, evidence-led notes on brand, messaging and websites for security startups. No spam. Unsubscribe any time.