The Cybersecurity Cult Products Awards report
Phill Keaney-Bolland· Co-founder and Designer, Yaya7 min readKey takeaways
- Almost 70% of the 77 startups use blue as their primary brand color.
- The genuine outliers show that taking brand risks can increase trustworthiness.
- The majority of the websites require a post-graduate reading level, while real users skim and scroll at speed.
- Only 42% of the startups offer something of genuine value before asking for contact details.
- Token, Aim Security, and Seal Security scored highest overall.
Table of contents
We scored the 77 startups exhibiting at RSA's Early Stage Expo and Next Stage on proposition, brand and marketing. Fifty-five of them lead with blue. The median website reads at a postgraduate level. Here is the rest of it.
Over the past few months, our judges assessed the 77 startups exhibiting at RSA in San Francisco this year, across the Early Stage Expo and the Next Stage. We were looking for the next big things: the businesses that have nailed their proposition, brand, website, and marketing. In this report we reveal the top startups in each of the major cyber verticals, along with the trends our research unearthed across the industry.
Industry trends#
Branding#
Only a few genuine outliers are nailing their brand visual identity. The brands that have dared to tell a different story to the rest of the pack, and to create something truly memorable, stand out immediately. The top brands, like Token, Aim Security, and Reality Defender, show that you can actually increase trustworthiness by taking risks.
Three categories became apparent:
- The outlier top brands. A clear story, told beautifully, with the confidence to stand out. The common thread is a big idea executed well. They zig while everyone else zags.
- The crowded middle. Generally well executed but lacking differentiation. Modern design principles are in place, but the big idea is missing.
- Clear underinvestment. Funds are tight and investment in brand has clearly been minimal. These brands look like a less premium, less trustworthy offering because they do not quite make the right impression, often despite a brilliant proposition. They have a huge opportunity to accelerate their growth by making brand a priority.
Source: Yaya analysis of all 77 startups exhibiting at RSA 2025. Base: 75 of 77 startups.
| Category | Number of startups | Share |
|---|---|---|
| 0 to 39 | 19 | 25% |
| 40 to 59 | 26 | 35% |
| 60 to 79 | 26 | 35% |
| 80 to 100 | 4 | 5% |
Brand colors#
By far the most popular brand color for cybersecurity startups this year was blue, with almost 70% of the businesses we analyzed using it as their primary brand color. Simply put: if you want to look like everyone else, be blue.
Source: Yaya analysis of all 77 startups exhibiting at RSA 2025. Base: 77 of 77 startups.
| Category | Number of startups | Share |
|---|---|---|
| Blue | 55 | 71% |
| Purple | 9 | 12% |
| Orange | 5 | 6% |
| Pink | 4 | 5% |
| Red | 2 | 3% |
| Unknown | 1 | 1% |
| Green | 1 | 1% |
When you look the same as all your competitors, it becomes very hard for customers to distinguish between you. You become forgettable and, worse, homogenous. When customers see every option in front of them as more or less the same, the only thing left to differentiate on is cost. Cue commoditization, a race to the bottom, and eroded profit margins.
There is a little more diversity when you factor in secondary colors and look at every individual shade, but not much.
Source: Yaya analysis of all 77 startups exhibiting at RSA 2025. Base: 149 primary and secondary colors across the 77 startups.
| Category | Number of swatches | Share |
|---|---|---|
| #d30404 | 1 | 1% |
| #cc1818 | 1 | 1% |
| #e03939 | 1 | 1% |
| #e36159 | 1 | 1% |
| #f0523d | 1 | 1% |
| #ef6b51 | 1 | 1% |
| #ef6b51 | 1 | 1% |
| #ff7a59 | 1 | 1% |
| #ff7a53 | 1 | 1% |
| #ff3d00 | 1 | 1% |
| #d46844 | 1 | 1% |
| #fe5b17 | 1 | 1% |
| #ff763b | 1 | 1% |
| #fe802e | 1 | 1% |
| #eef1d5 | 1 | 1% |
| #96ff4d | 1 | 1% |
| #4ebf22 | 1 | 1% |
| #04a600 | 1 | 1% |
| #3adb76 | 1 | 1% |
| #3cc982 | 1 | 1% |
| #1cb797 | 1 | 1% |
| #bae8e8 | 1 | 1% |
| #078586 | 1 | 1% |
| #064c59 | 1 | 1% |
| #06b4e0 | 1 | 1% |
| #5bc0de | 1 | 1% |
| #00aef0 | 1 | 1% |
| #0085ba | 1 | 1% |
| #0085ba | 1 | 1% |
| #6ec1e4 | 1 | 1% |
| #6ec1e4 | 1 | 1% |
| #6ec1e4 | 1 | 1% |
| #6ec1e4 | 1 | 1% |
| #6ec1e4 | 1 | 1% |
| #68d2ff | 1 | 1% |
| #285d75 | 1 | 1% |
| #007cc3 | 1 | 1% |
| #123346 | 1 | 1% |
| #0095eb | 1 | 1% |
| #1d2e38 | 1 | 1% |
| #eaeff2 | 1 | 1% |
| #59abe3 | 1 | 1% |
| #91d0ff | 1 | 1% |
| #0b64ae | 1 | 1% |
| #006ac3 | 1 | 1% |
| #3276b1 | 1 | 1% |
| #3898ec | 1 | 1% |
| #3898ec | 1 | 1% |
| #3898ec | 1 | 1% |
| #3898ec | 1 | 1% |
| #3898ec | 1 | 1% |
| #3898ec | 1 | 1% |
| #3898ec | 1 | 1% |
| #3898ec | 1 | 1% |
| #3898ec | 1 | 1% |
| #3898ec | 1 | 1% |
| #3898ec | 1 | 1% |
| #3898ec | 1 | 1% |
| #3898ec | 1 | 1% |
| #3898ec | 1 | 1% |
| #3898ec | 1 | 1% |
| #293a4a | 1 | 1% |
| #2875c1 | 1 | 1% |
| #186fce | 1 | 1% |
| #e4ebf3 | 1 | 1% |
| #025dcc | 1 | 1% |
| #0068e7 | 1 | 1% |
| #4b99ff | 1 | 1% |
| #1a73e8 | 1 | 1% |
| #1d2939 | 1 | 1% |
| #003681 | 1 | 1% |
| #4693ff | 1 | 1% |
| #536b8d | 1 | 1% |
| #0b5ed7 | 1 | 1% |
| #052c65 | 1 | 1% |
| #052c65 | 1 | 1% |
| #052c65 | 1 | 1% |
| #0a53be | 1 | 1% |
| #e2e6ec | 1 | 1% |
| #1b5cbf | 1 | 1% |
| #cfe2ff | 1 | 1% |
| #cfe2ff | 1 | 1% |
| #cfe2ff | 1 | 1% |
| #2871e6 | 1 | 1% |
| #377ef0 | 1 | 1% |
| #4081ea | 1 | 1% |
| #0b68ff | 1 | 1% |
| #3578e5 | 1 | 1% |
| #3b82f6 | 1 | 1% |
| #1e293b | 1 | 1% |
| #4285f4 | 1 | 1% |
| #4285f4 | 1 | 1% |
| #2360d9 | 1 | 1% |
| #516ead | 1 | 1% |
| #2563eb | 1 | 1% |
| #3775ff | 1 | 1% |
| #2663ff | 1 | 1% |
| #3866de | 1 | 1% |
| #001857 | 1 | 1% |
| #2759dd | 1 | 1% |
| #012591 | 1 | 1% |
| #7383b4 | 1 | 1% |
| #265aff | 1 | 1% |
| #344681 | 1 | 1% |
| #1c49ea | 1 | 1% |
| #a7b0de | 1 | 1% |
| #dee2f7 | 1 | 1% |
| #3b5afd | 1 | 1% |
| #586fe9 | 1 | 1% |
| #1d2030 | 1 | 1% |
| #cbd0eb | 1 | 1% |
| #7a89e1 | 1 | 1% |
| #353c69 | 1 | 1% |
| #5167f6 | 1 | 1% |
| #1a2256 | 1 | 1% |
| #5b6cff | 1 | 1% |
| #606eea | 1 | 1% |
| #171c4d | 1 | 1% |
| #0000f5 | 1 | 1% |
| #514df6 | 1 | 1% |
| #3e3bb4 | 1 | 1% |
| #4f46e5 | 1 | 1% |
| #4a3aff | 1 | 1% |
| #afa7ff | 1 | 1% |
| #7b6dff | 1 | 1% |
| #392396 | 1 | 1% |
| #9478e6 | 1 | 1% |
| #642eff | 1 | 1% |
| #53389e | 1 | 1% |
| #6941c6 | 1 | 1% |
| #9c7edf | 1 | 1% |
| #1d054f | 1 | 1% |
| #d2bdf5 | 1 | 1% |
| #af89ee | 1 | 1% |
| #7f54b3 | 1 | 1% |
| #e9d7fe | 1 | 1% |
| #7304e2 | 1 | 1% |
| #ded1e8 | 1 | 1% |
| #7d5b94 | 1 | 1% |
| #ddcee2 | 1 | 1% |
| #ff4895 | 1 | 1% |
| #ff6795 | 1 | 1% |
| #dd3c69 | 1 | 1% |
| #ffe0e8 | 1 | 1% |
| #ff3458 | 1 | 1% |
| #f43f59 | 1 | 1% |
| #fd5861 | 1 | 1% |
| #ce2c30 | 1 | 1% |
| #ff0006 | 1 | 1% |
Our advice: stand out, give your customers something to remember you by, and be brave with your color choices.
Tone of voice#
Our tone of voice analysis revealed a category communicating in a highly technical, professional, and informative register. Security is a serious subject, and it is critical to build trust while demonstrating expertise.
Source: Yaya analysis of all 77 startups exhibiting at RSA 2025. Base: 77 of 77 startups.
| Category | Number of startups | Share |
|---|---|---|
| Informative | 53 | 69% |
| Authoritative | 12 | 16% |
| Friendly | 9 | 12% |
| Formal | 2 | 3% |
| Informal | 1 | 1% |
As with color, this creates a high level of similarity between the businesses in the space. During our research we struggled to find many distinct tones of voice or personalities. It is a difficult balancing act, and nobody wants a wacky cybersecurity startup that reduces trust. But consider Wiz, the largest acquisition in Google's history, and their tone of voice: little touches of personality like "Shift happens" sit alongside bold headlines that echo Apple's approach to copywriting. Wiz is extremely credible, and there is something else there too: the confidence to have fun, inject character, and stand out. It is entirely possible to have character and build trust at the same time.
Our advice: treat tone of voice as another opportunity to put daylight between you and your competitors. The best copy explains and engages in the same breath.
Readability#
One of the biggest challenges the industry faces is taking highly complex, technical products and making them easy for customers to wrap their heads around. We analyzed the Home, About, Product, and Blog pages of all 77 startups' websites.
Source: Yaya analysis of all 77 startups exhibiting at RSA 2025. Base: 72 of 77 startups. Median grade 16.2.
| Category | Number of startups | Share |
|---|---|---|
| Grade 10 to 12 | 6 | 8% |
| Grade 13 to 15 | 27 | 38% |
| Grade 16 to 18 | 28 | 39% |
| Grade 19 and above | 11 | 15% |
Using the leading measure of readability, the Flesch-Kincaid grade level, we learned that the majority of cybersecurity startup websites are pitched at an extraordinarily high level. They often require a post-graduate degree to be understood. Put simply, they are typically as hard to read as an academic paper.
Nobody is suggesting cybersecurity is not a complex topic, or that the audience is not highly educated. The challenge is that we are talking about a website. People do not browse websites in a linear fashion. When we analyze user behavior with screen recordings, eye tracking, and heatmaps, we see a strong tendency to skim, scroll at speed, and click through pages at a rate of knots. Users act much more like flies trying to find a way out of a room than PhD students in a library. Complex, challenging language is out of step with how people actually use websites, and it makes those websites far less effective. We explore this finding further in your website reads like an academic paper.
See it in action.
Technology#
Webflow is the single most common platform, running 30 of the 77 sites, with WordPress close behind on 25. Between them they account for seven in ten. Whatever else that says, it says most of these companies do not own the codebase behind their most important sales asset.
Source: Yaya analysis of all 77 startups exhibiting at RSA 2025. Base: 77 of 77 startups.
| Category | Number of startups | Share |
|---|---|---|
| Webflow | 30 | 39% |
| WordPress | 25 | 32% |
| Other | 19 | 25% |
| Squarespace | 1 | 1% |
| Wix | 1 | 1% |
| Shopify | 1 | 1% |
Half the cohort runs no marketing automation at all. Among the 39 that do, HubSpot is close to universal: 38 of them.
Source: Yaya analysis of all 77 startups exhibiting at RSA 2025. Base: 77 of 77 startups.
| Category | Number of startups | Share |
|---|---|---|
| None | 38 | 49% |
| HubSpot | 36 | 47% |
| HubSpot, Salesforce | 2 | 3% |
| Salesforce | 1 | 1% |
Taken together, the picture is of a category that has standardized on rented, closed platforms for its most important sales asset.
Marketing#
Just over half of the startups we analyzed use paid advertising to attract customers.
Source: Yaya analysis of all 77 startups exhibiting at RSA 2025. Base: 43 startups running paid advertising; companies may run more than one channel.
| Category | Number of startups | Share |
|---|---|---|
| Running paid ads | 43 | 56% |
| No paid ads | 34 | 44% |
The most popular advertising channel was LinkedIn, by some distance. Meta and Google, channels that typically enjoy a lower cost per impression, are largely untapped. Most of the businesses that advertise do not send that traffic to a conversion-optimized landing page: 23 of the 43 advertisers point their ads at a general page instead, against 18 that built one. Paying for the click and then dropping the visitor on a homepage is the most expensive way to lose them.
Source: Yaya analysis of all 77 startups exhibiting at RSA 2025. Base: 43 of the 77 startups that run paid advertising.
| Category | Number of startups | Share |
|---|---|---|
| 39 | 85% | |
| 6 | 13% | |
| Meta | 1 | 2% |
Source: Yaya analysis of all 77 startups exhibiting at RSA 2025. Base: 43 of the 77 startups that run paid advertising.
| Category | Number of advertisers | Share |
|---|---|---|
| Unknown | 26 | 60% |
| Medium | 13 | 30% |
| High | 3 | 7% |
| Low | 1 | 2% |
Source: Yaya analysis of all 77 startups exhibiting at RSA 2025. Base: 43 of the 77 startups that run paid advertising.
| Category | Number of advertisers | Share |
|---|---|---|
| Not Landing Page | 23 | 53% |
| Landing Page | 18 | 42% |
| None | 1 | 2% |
| Unknown | 1 | 2% |
Only 42% of the startups offer a genuine piece of value, tied to their value proposition, in exchange for contact details. We counted anything a buyer could use on their own: a scan, a trial, a tool, a report, a calculator. Gated demo requests did not count.
Two brands are missing from these rankings#
Twine and Aryon are not scored anywhere in this report. We built both, so ranking them would not have been fair to anyone else in the cohort. Their scores are excluded from every chart here.
The winners#
How scoring works#
We used our Cult Products Framework to score each brand on three areas:
- Revolutionary Vision. How differentiated the value proposition is and how effectively it targets growth. Is the niche one where a monopoly is realistic? Is the differentiation clear? Are tangible customer problems communicated through that lens?
- Radical Story. How effectively the brand, visual identity, and copy set the business apart and create a Blue Ocean. Is the identity effective? Have the common tropes been avoided? Is the tone of voice distinct and aligned?
- Fanatical Followers. How effectively the business generates leads with digital marketing and an effective website. Is there an SEO strategy? An advertising strategy? A nurture strategy?
Overall winners#
- Token, 73 points
- Aim Security, 69
- Seal Security, 69
Category winners#
- Application Security: Seal Security 69, Backslash Security 68, Akto.io 65
- Cloud Security: Vorlon 66, AccuKnox 63, CloudQuery 62
- Data Security: Aim Security 69, DataKrypto 60, Surf Security 59
- Identity and Access Management: Token 73, Andromeda 65, Resemble AI 62
- Risk Management and Compliance: Enkrypt AI 64, CovertSwarm 63, Sprinto 61
- Security Operations and Incident Response: Qevlar AI 61, Dropzone AI 60, Prelude Research 58
- Other: Reality Defender 67, Nagomi Security 64, Morado 64
Congratulations to every winner.
The pattern across the first year#
Read the findings side by side and one theme dominates: convergence. The category has converged on one color, one register, one reading level, one set of rented platforms, and one destination for its marketing. Against that backdrop, the outliers did not sacrifice credibility by breaking convention. They gained it. The startups at the top of these rankings paired a big idea with disciplined execution, and the data suggests the rest of the field has more to fear from blending in than from standing out.
About Yaya#
Yaya is a brand and digital design studio working exclusively with cybersecurity startups. Since 2019 we have helped more than 50 businesses across North America, Europe, the Middle East, and Asia create Cult Products: propositions, brands, and websites that make selling to enterprise CISOs easier. We take one project a month, and the founders you meet do the work. We helped both Twine and Geordie reach the RSA Innovation Sandbox final, with Geordie taking the win.
Phill Keaney-Bolland
Co-founder and Designer, Yaya
Co-founder and designer at Yaya, and host of the Cult Products podcast. Fifteen years designing products, brands and UX across multiple industries before narrowing to cybersecurity, and lectures on design at Imperial. Works with cybersecurity founders on positioning, strategy and the website that has to carry a launch, across identity, cloud security, AI agents and software supply chain, including Twine out of stealth and Geordie AI, which won the RSA Innovation Sandbox in 2026.