# Yaya - full corpus > Yaya is a brand and website studio for cybersecurity companies. It builds positioning, messaging, visual identity and agent-native websites using the Cult Products Framework, and the two founders deliver the work themselves. Founded 2019, based in London, working across North America, Europe, the Middle East and Asia. This file is the long-form companion to /llms.txt, which indexes the same site. # Who this is for - The Cybersecurity Founder (Founder or co-founder of a cybersecurity startup): Three to eighteen months past a seed round of roughly six to twelve million dollars, with a team of eight to twenty five that is almost all engineers and no marketing hire. Usually a second-time founder or a deeply credentialed operator. Approaching a launch, a stealth exit or a conference deadline, and needing positioning, brand and a website that match the quality of what they have built. - The Marketing Leader (First or only senior marketer at a cybersecurity company): The first marketing hire at a late-seed to Series B cybersecurity company of thirty to a hundred and twenty people, often with a team of nought to three. Frequently inherited a founder-built brand and a website that reads as a brochure rather than a funnel. Needs a system they can run in-house without queueing behind product for every change. - The VC Platform Partner (Platform or portfolio lead at a cybersecurity venture fund): Runs the vendor bench for a specialist cybersecurity fund and refers portfolio companies to people they trust. Every referral stakes their own credibility, so they want a structured process, an end-to-end scope, and a vendor who can manage a founder rather than the other way around. # Research ## The Cybersecurity Cult Products Awards report URL: https://yaya.co/resources/whitepapers/cult-products-awards-report Published: 2025-05-05 We scored the 77 startups exhibiting at RSA’s Early Stage Expo and Next Stage on the three Cult Products pillars. Almost 70% lead with blue, most websites read like academic papers, and just 42% give value before asking for contact details. Token, Aim Security, and Seal Security topped the rankings. Key points: - Almost 70% of the 77 startups use blue as their primary brand color. - The genuine outliers show that taking brand risks can increase trustworthiness. - The majority of the websites require a post-graduate reading level, while real users skim and scroll at speed. - Only 42% of the startups offer something of genuine value before asking for contact details. - Token, Aim Security, and Seal Security scored highest overall. We scored the 77 startups exhibiting at RSA’s Early Stage Expo and Next Stage on proposition, brand and marketing. Fifty-five of them lead with blue. The median website reads at a postgraduate level. Here is the rest of it. Over the past few months, our judges assessed the 77 startups exhibiting at RSA in San Francisco this year, across the Early Stage Expo and the Next Stage. We were looking for the next big things: the businesses that have nailed their proposition, brand, website, and marketing. In this report we reveal the top startups in each of the major cyber verticals, along with the trends our research unearthed across the industry. ### Industry trends #### Branding Only a few genuine outliers are nailing their brand visual identity. The brands that have dared to tell a different story to the rest of the pack, and to create something truly memorable, stand out immediately. The top brands, like Token, Aim Security, and Reality Defender, show that you can actually increase trustworthiness by taking risks. Three categories became apparent: - **The outlier top brands.** A clear story, told beautifully, with the confidence to stand out. The common thread is a big idea executed well. They zig while everyone else zags. - **The crowded middle.** Generally well executed but lacking differentiation. Modern design principles are in place, but the big idea is missing. - **Clear underinvestment.** Funds are tight and investment in brand has clearly been minimal. These brands look like a less premium, less trustworthy offering because they do not quite make the right impression, often despite a brilliant proposition. They have a huge opportunity to accelerate their growth by making brand a priority. #### Brand colors By far the most popular brand color for cybersecurity startups this year was blue, with almost 70% of the businesses we analyzed using it as their primary brand color. Simply put: if you want to look like everyone else, be blue. When you look the same as all your competitors, it becomes very hard for customers to distinguish between you. You become forgettable and, worse, homogenous. When customers see every option in front of them as more or less the same, the only thing left to differentiate on is cost. Cue commoditization, a race to the bottom, and eroded profit margins. There is a little more diversity when you factor in secondary colors and look at every individual shade, but not much. Our advice: stand out, give your customers something to remember you by, and be brave with your color choices. #### Tone of voice Our tone of voice analysis revealed a category communicating in a highly technical, professional, and informative register. Security is a serious subject, and it is critical to build trust while demonstrating expertise. As with color, this creates a high level of similarity between the businesses in the space. During our research we struggled to find many distinct tones of voice or personalities. It is a difficult balancing act, and nobody wants a wacky cybersecurity startup that reduces trust. But consider Wiz, the largest acquisition in Google’s history, and their tone of voice: little touches of personality like “Shift happens” sit alongside bold headlines that echo Apple’s approach to copywriting. Wiz is extremely credible, and there is something else there too: the confidence to have fun, inject character, and stand out. It is entirely possible to have character and build trust at the same time. Our advice: treat tone of voice as another opportunity to put daylight between you and your competitors. The best copy explains and engages in the same breath. #### Readability One of the biggest challenges the industry faces is taking highly complex, technical products and making them easy for customers to wrap their heads around. We analyzed the Home, About, Product, and Blog pages of all 77 startups’ websites. Using the leading measure of readability, the Flesch-Kincaid grade level, we learned that the majority of cybersecurity startup websites are pitched at an extraordinarily high level. They often require a post-graduate degree to be understood. Put simply, they are typically as hard to read as an academic paper. Nobody is suggesting cybersecurity is not a complex topic, or that the audience is not highly educated. The challenge is that we are talking about a website. People do not browse websites in a linear fashion. When we analyze user behavior with screen recordings, eye tracking, and heatmaps, we see a strong tendency to skim, scroll at speed, and click through pages at a rate of knots. Users act much more like flies trying to find a way out of a room than PhD students in a library. Complex, challenging language is out of step with how people actually use websites, and it makes those websites far less effective. We explore this finding further in your website reads like an academic paper. #### Technology Webflow is the single most common platform, running 30 of the 77 sites, with WordPress close behind on 25. Between them they account for seven in ten. Whatever else that says, it says most of these companies do not own the codebase behind their most important sales asset. Half the cohort runs no marketing automation at all. Among the 39 that do, HubSpot is close to universal: 38 of them. Taken together, the picture is of a category that has standardized on rented, closed platforms for its most important sales asset. #### Marketing Just over half of the startups we analyzed use paid advertising to attract customers. The most popular advertising channel was LinkedIn, by some distance. Meta and Google, channels that typically enjoy a lower cost per impression, are largely untapped. Most of the businesses that advertise do not send that traffic to a conversion-optimized landing page: 23 of the 43 advertisers point their ads at a general page instead, against 18 that built one. Paying for the click and then dropping the visitor on a homepage is the most expensive way to lose them. Only 42% of the startups offer a genuine piece of value, tied to their value proposition, in exchange for contact details. We counted anything a buyer could use on their own: a scan, a trial, a tool, a report, a calculator. Gated demo requests did not count. ### Two brands are missing from these rankings Twine and Aryon are not scored anywhere in this report. We built both, so ranking them would not have been fair to anyone else in the cohort. Their scores are excluded from every chart here. ### The winners #### How scoring works We used our Cult Products Framework to score each brand on three areas: 1. **Revolutionary Vision.** How differentiated the value proposition is and how effectively it targets growth. Is the niche one where a monopoly is realistic? Is the differentiation clear? Are tangible customer problems communicated through that lens? 1. **Radical Story.** How effectively the brand, visual identity, and copy set the business apart and create a Blue Ocean. Is the identity effective? Have the common tropes been avoided? Is the tone of voice distinct and aligned? 1. **Fanatical Followers.** How effectively the business generates leads with digital marketing and an effective website. Is there an SEO strategy? An advertising strategy? A nurture strategy? #### Overall winners 1. Token, 73 points 1. Aim Security, 69 1. Seal Security, 69 #### Category winners - **Application Security:** Seal Security 69, Backslash Security 68, Akto.io 65 - **Cloud Security:** Vorlon 66, AccuKnox 63, CloudQuery 62 - **Data Security:** Aim Security 69, DataKrypto 60, Surf Security 59 - **Identity and Access Management:** Token 73, Andromeda 65, Resemble AI 62 - **Risk Management and Compliance:** Enkrypt AI 64, CovertSwarm 63, Sprinto 61 - **Security Operations and Incident Response:** Qevlar AI 61, Dropzone AI 60, Prelude Research 58 - **Other:** Reality Defender 67, Nagomi Security 64, Morado 64 Congratulations to every winner. ### The pattern across the first year Read the findings side by side and one theme dominates: convergence. The category has converged on one color, one register, one reading level, one set of rented platforms, and one destination for its marketing. Against that backdrop, the outliers did not sacrifice credibility by breaking convention. They gained it. The startups at the top of these rankings paired a big idea with disciplined execution, and the data suggests the rest of the field has more to fear from blending in than from standing out. ### About Yaya Yaya is a brand and digital design studio working exclusively with cybersecurity startups. Since 2019 we have helped more than 50 businesses across North America, Europe, the Middle East, and Asia create Cult Products: propositions, brands, and websites that make selling to enterprise CISOs easier. We take one project a month, and the founders you meet do the work. We helped both Twine and Geordie reach the RSA Innovation Sandbox final, with Geordie taking the win. --- # Articles ## Your team page is a security control URL: https://yaya.co/resources/your-team-page-is-a-security-control Published: 2026-08-19 Buyers of early-stage security products know the product is immature. They get comfortable with the people instead. A team page showing domain lineage, people who have sold into security or operated what they now secure, answers the buyer’s real fear: being bluffed. A missing team page is a hole in the buying journey. Key points: - Early-stage buyers use the team as a proxy for the product they know is not finished. - An industry analyst we interviewed flagged a missing team page as an active gap in the buying journey. - Domain lineage answers the buyer’s real fear, which is being bluffed on things the vendor does not understand. - CISOs are career-exposed and professionally suspicious, so de-risking language beats urgency every time. - A visible founder drives inbound, but the business has to survive beyond one person’s feed. You are asking a career-exposed executive to bet part of their reputation on a product that is eighteen months old. They know it is not finished. You know it is not finished. The question your website has to answer is not whether the product is mature. It is whether the people behind it can be trusted to close the gaps in the right order. That is why the team page, the most neglected page on most startup sites, is doing security work. It is a control. It reduces the buyer’s risk, and the buyer knows it. ### The proxy: people stand in for the product Buyers of early-stage security products are not naive. They understand exactly what stage you are at, and they price the immaturity in. What they cannot price in from a feature list is judgment. Will the roadmap bend toward their reality? Will the gaps close in the order that matters? Will the vendor still exist in two years? Since the product cannot answer those questions, the people have to. In our CISO research, buyers of early products consistently described getting comfortable with the team as the substitute for getting comfortable with the product. The founders’ history, their depth in the domain, the specificity of how they talk about the problem: these carried the weight the product could not yet carry. An industry analyst we interviewed put it more bluntly. A missing team page is not a cosmetic omission. It is an active gap in the buying journey. The buyer goes looking for the people, finds nothing, and draws a conclusion. Silence about the team reads as something to hide, or worse, as a team that does not understand what its buyers need to see. **If the product is immature, the team is the product. Hiding it is hiding your strongest asset.** ### What domain lineage answers The team page is not a vanity wall. It exists to answer one specific fear: being bluffed. Security buyers have all been burnt. Arjun Bisen of Overwatch made this point publicly on our podcast: “everyone is burnt by vendors over-promising and under-delivering.” Buyers have seen the slick marketing campaign, then met the product. “The delta between what they said and what they delivered is huge.” Which is why radical honesty about what you can and cannot do earns disproportionate credit. The buyer’s nightmare with an early-stage vendor is discovering, mid-deployment, that the vendor never really understood the environment they claimed to secure. Domain lineage is the antidote, and it has two forms. The first is having sold into security before: you know the procurement gauntlet, the proof-of-concept rituals, the way a security team actually evaluates. The second is having operated the class of software you now secure: you were on the other side of the desk, running the thing, feeling the pain first-hand. Either one tells the buyer that when they ask a hard question, they will get a real answer instead of a bluff. Both together are close to unfair. So say it plainly on the page. Not a paragraph of adjectives, but the specific history: where the team sold, what the team ran, what they saw break. ### The psychology you are selling into To understand why this matters so much, look at the job you are selling into. A CISO is professionally suspicious by design and career-exposed by structure. Nobody thanks them for the ten thousand attacks that were stopped. One miss defines a career. And in the current market the dominant fear is not missing out on a hot new product. It is buying the wrong thing: spending budget and political capital on a vendor that fails, disappears, or turns out to be a feature the incumbent ships next quarter. Every element of your site lands on that psychology. Urgency plays, countdown energy, and pressure tactics do not read as momentum to this buyer. They read as risk. The vendor pushing hardest is the vendor with the most to hide. ### De-risk, do not pressure The alternative to pressure is subtraction. Take risk off the table, visibly, on the page. Three de-risking moves came through our research again and again. Say what you replace: budgets are mostly replacement, not incremental, and the buyer is silently asking what comes out of the stack if you come in. Say what you do not claim: scoping your own product honestly is rare enough that it functions as a differentiator, and buyers notice when a website describes a product that does not exist yet. And say how fast they can verify: how quickly a skeptical practitioner can see the product working on their own environment, without a meeting. The team page is the fourth de-risking move, and it compounds the other three. An honest claim from an anonymous vendor is just a claim. The same claim from a named team with visible domain history is evidence. ### The founder as the face There is a nuance here worth getting right, because founders tend to swing to one of two extremes. The first extreme is invisibility. The founder stays out of the marketing entirely, the site speaks in corporate first-person plural, and the buyer meets no humans until the sales call. For an early-stage security company this throws away the inbound engine. In our research, education with an opinion attached drives interest before any marketing function exists, and a founder taking a contentious position beats a company contributing politely to the conversation. Buyers of early products want to see who they are betting on, and founder-led sales is the reality of this stage anyway. The second extreme is total identification. The company becomes one person’s feed, one person’s face, one person’s voice. It works right up until it becomes the risk. The buyer committing to a multi-year vendor relationship is quietly asking what happens if that one person burns out, leaves, or simply stops posting. The resolution is sequencing. Lead with the founder now, because at this stage the founder is the most credible asset you have. But build the team’s credibility on the same page, in the same register, so that trust attaches to the company and not only to the individual. The founder opens the door. The team page proves there is a company behind it. ### The control, implemented Treat the team page like any other control: define what it must prove, then implement. It must prove domain lineage, so name the specific history rather than the adjectives. It must prove judgment, so link the thinking, the research, the opinions the team has published. It must prove honesty, so let its tone match a product page that states plainly what you do and do not yet cover. And it must prove there are humans, so use real photography and real words, not a grid of logos and stock smiles. None of this works, though, if the visitor never gets that far. The team page is the second question a buyer asks. The first is what you actually do, and most security homepages fail it in the opening seconds, which is the subject of the five-second homepage. And if you want the deeper version of how founders build domain credibility before there is any product to show, start with the validation work itself in 250 conversations before a line of code. The product will mature. The category will shift. But the reason an early buyer says yes to you, rather than waiting a year for the safe choice, is almost always the same. They believed the people. Give them a page that makes believing easy. --- ## How to stand out in agentic security when everyone is agentic URL: https://yaya.co/resources/how-to-stand-out-in-agentic-security Published: 2026-08-15 Every agentic-security vendor now pitches some version of AI for security and security for AI, so the words no longer separate anyone. Differentiation lives one level down: your specific philosophy of the problem, what you refuse to build, and a story a CISO can retell days later. Key points: - The agentic-security category is norming around identical messaging, and a CISO is pitched by somebody new in this space nearly every day. - No two agentic-security teams actually think about the problem the same way; the differentiation is real but sits one level below the headline. - Your competitor set includes the frontier AI labs, and vertical slivers of domain depth are the moat against them. - Refusing to ship a feature can differentiate harder than shipping one, as ThreatLocker’s public refusal of an 85%-accurate AI feature shows. - When buyers cannot distinguish vendors, the memorable one wins the shortlist and the forgettable ones get compared on price. There is a sentence being said in hundreds of pitch meetings this quarter: we use AI to secure AI. It appears as “AI for security, security for AI,” as “securing the agentic enterprise,” as “trust for autonomous systems.” The wording shifts. The claim does not. Agentic security is the fastest-forming category in cybersecurity, and like every fast-forming category it is norming around identical messaging while the products underneath diverge wildly. The buyer feels this before the founders do. A CISO responsible for AI risk is pitched by somebody new in this space nearly every day. Every deck opens with the same market context, the same adoption statistics, the same threat framing. By the fourth vendor in a fortnight, the words have stopped carrying information. The category has arrived at the point where saying what everyone says costs the same as saying nothing. This is the specific problem of standing out in agentic security: the pressure to adopt is real, the budgets are forming, and the buyer cannot tell you apart. ### The differentiation is real. The messaging hides it. Here is the strange part. In our work across agentic-security clients, we have never met two teams who think about the problem the same way. One team sees it as a threat-detection problem: agents as a new class of adversary and attack path. Another sees it as a misbehavior problem: the agent is not malicious, it is overeager, and the risk is what it does with legitimate access. Some build guardrails at the prompt and policy layer. Some anchor everything in identity, treating every agent as a workforce member with credentials and entitlements. Some sit at runtime, watching what agents actually do. Some sit at the endpoint, some at the gateway. These are different theories of the problem, and they lead to different products, different buyers, and different futures. Yet almost none of that thinking survives the trip to the homepage. It gets sanded down into the category-default sentence, because the category-default sentence feels safe. It is not safe. It is camouflage. Meanwhile, being findable when a buyer describes their use case to a search engine or an LLM is table stakes now, not a story. Discoverability gets you into the consideration set. It cannot make anyone remember which vendor you were. **Your theory of the problem is the differentiator. The headline claim stopped being one the moment everyone adopted it.** ### Differentiate against the labs, not just each other Most agentic-security founders benchmark themselves against peer startups. The more dangerous competitor is bigger and quieter. Justin Woody of Twine, speaking on our podcast, puts it in shipping terms. “You’re avoiding these little boats. The ones that are close, you need to make these quick corrections, but you’re always looking out for the big container ships because they move so fast, and if you aren’t careful, that’s going to run you over.” The container ships are the frontier AI labs, whose models absorb capabilities that entire startups were founded on. “Keep an eye out for the big ships that are coming,” he says, “because they’re the ones that can wipe you out.” Woody’s answer is vertical slivers. “There’s no way these big companies like OpenAI and Anthropic have the discipline for the million different slivers that are out there,” he told us. “They’re going to build this broad platform, and what we’re building is these deep vertical slivers to address people’s needs. That’s the moat.” Depth in a specific domain, its workflows, its failure modes, its regulatory texture, is the moat a horizontal model provider has no incentive to cross. A lab will ship a general capability. It will not learn the operational reality of your niche, because your niche does not move their metrics. For positioning, this cuts two ways. First, your story should make the sliver explicit: name the domain depth that makes you defensible, rather than gesturing at breadth that makes you look like a feature the labs will ship next quarter. Second, differentiate from the labs out loud. Most vendors only position against peer startups, which tells the buyer nothing about the question they are quietly asking: why won’t the model providers just do this? ### Philosophy as positioning: the power of refusal The sharpest differentiation move in an AI-saturated market may be a public refusal. Rob Allen of ThreatLocker told us on the podcast about testing AI for allow/deny categorization. “It got it right somewhere in the region about 85% of the time.” They refused to ship it, because ThreatLocker’s philosophy is deny-by-default, and any error rate applied to a deny decision is catastrophic. “Anything greater than 0% is going to be less good than default deny.” Fifteen percent wrong is not a feature. It is an outage generator with a marketing budget. Consider what that refusal communicates. In a market where every vendor is bolting AI onto everything, a company that says “we tested it, here is the number, and here is why we will not ship it” has told you more about their engineering seriousness than any capabilities page could. The refusal is the positioning. It draws a line the buyer can trust precisely because it cost something to draw. Geordie’s founders make a parallel move at the level of architecture. “We are specifically focused on AI agents. We’re not building for every AI application in the business,” as they put it on our podcast. Agents are a genuinely new kind of actor, so watching them demands thinking built for agents, not endpoint-era instincts retrofitted with a new data source. Agree or disagree, it is a position, and a position invites a reaction. Arjun Bisen of Overwatch adds the commercial version of the same instinct on his own episode. Everyone in security has been burnt by vendors over-promising, so saying “certain things we can’t do yet, but we’re willing to work with you to get there” earns disproportionate credit. Every one of these is the same underlying move. A philosophy, stated plainly, with the costs shown. ### The forgettable get compared on price Why does this matter commercially rather than aesthetically? Because of what happens after the meeting. Our research keeps returning to the same behavioral fact: days later, at a peer dinner, buyers half-remember the vendors they saw. The pressure to adopt is real, so a shortlist will be formed. The vendor with a distinct theory of the problem, a name that telegraphs the domain, a refusal worth retelling, gets recalled and recommended. The vendors who all said the category sentence collapse into a single blur, and the blur gets evaluated the only way a blur can be: on price. Undifferentiated brands get commoditized, and commoditization in an unformed category is a brutal place to live, because you inherit price competition before you have inherited revenue. The buyer is simultaneously pressured to adopt and unable to distinguish. That combination does not slow purchases. It routes them to whichever vendor is easiest to remember and safest to forward. Memorability is not a branding luxury in this market. It is the mechanism by which shortlists form. **In a category the buyer cannot parse, the memorable vendor wins the shortlist and the rest negotiate discounts.** ### Becoming a category of one in a category of hundreds The endgame is not to win the comparison. It is to make comparison beside the point. We call this becoming a category of one: a position built on your actual theory of the problem, expressed so distinctly that the buyer has nothing to line you up against. The full argument lives in our category-of-one piece, but the agentic-security application is specific enough to state here. Start with the market truth every buyer already feels, the contradiction between mandated AI adoption and vanishing visibility, which we unpack in the enterprise contradiction. Then, where every competitor states the category, state your philosophy: the lane you claim, the sliver that defends you from the labs, the thing you refuse to build and why. Then make it concrete. A philosophy that never becomes a mechanism is poetry, and buyers cannot buy poetry; the test of whether yours survives is the five-second homepage. None of this is hypothetical bravery. We helped both Twine and Geordie reach the RSA Innovation Sandbox final, with Geordie taking the win. Both compete in exactly this crowded space. Neither leads with the category sentence. Everyone is agentic now. That is precisely why saying so has stopped working. The vendors who will own this category are the ones willing to say the second sentence, the one about what they actually believe, and to let it cost them something. Different by design, in the one corner of the market where sounding the same is the default setting. --- ## 250 conversations before a line of code URL: https://yaya.co/resources/250-conversations-before-a-line-of-code Published: 2026-08-11 Talk to buyers before you build. Justin Woody planned 100 conversations for Twine and did 250; nearly all pointed to a different pain, and the company pivoted before writing code. Validation shapes the proposition, surfaces your first design partners, de-risks the raise, and hands you honest messaging. Key points: - Twine’s 250 pre-build conversations revealed that identity, not vulnerability, was the bigger pain, and the company pivoted before writing code. - Ask the purchase-intent question early: is this pain big enough for you to buy tomorrow? Woody’s one regret was not asking it. - Itzik Alvas’s referral test is a fast honesty check: if a buyer will name someone else with the problem, the pain is real. - Design partnerships are easier to start than founders assume, including with dream logos, when value is two-way and no sales hook hides in the research. - Validation is not a delay to building; it produces your first design partners, your first honest messaging, and a de-risked raise. Justin Woody planned 100 conversations with buyers before building anything at Twine. “We thought we were going to do one hundred,” he told us on the Cult Products podcast. He ended up having 250. Nearly all of them told him the same uncomfortable thing: the bigger pain was not vulnerability management, the problem he had set out to solve. It was identity. “We heard this in 99.9% of our conversations, which made us say, alright, I guess identity is a problem.” So Twine pivoted, before a single line of code existed to defend. Sit with the counterfactual for a moment. Without those conversations, an experienced team out of Claroty and Mandiant builds a competent product for the wrong pain, discovers the mismatch a year later through the sales pipeline, and pivots anyway, with a burned year and a built codebase pulling against the turn. The 250 conversations did not delay the company. They were the fastest work Twine ever did. Most founders know, in the abstract, that they should talk to customers first. Fewer treat those conversations as what they actually are: the process that shapes the proposition itself. Here is what that looks like in practice, from founders who did it in public and from our own research with the buyers on the other side of the table. ### The spiral, not the checklist Woody describes the process with an image worth keeping. “A spiral, right, that keeps getting smaller and smaller until you hit the middle,” he said on the episode. “And each conversation gets your spiral to be tighter and tighter.” The first ten conversations are wide and disorienting; everyone’s pain sounds slightly different, and you cannot tell signal from anecdote. By conversation eighty, patterns repeat. By two hundred, you can finish the buyer’s sentence, and when a new conversation surprises you, the surprise itself is information. Validation is not a checklist you complete. It is a curve you converge along, and you know you are done when the spiral stops tightening. He is also candid about the one thing he would change, and it is a question. Across 250 conversations, he never directly asked: is this pain big enough for you to purchase against tomorrow? People will confirm that a problem exists all day. Confirming that it outranks the other forty problems competing for the same budget is a different admission, and it is the one that predicts revenue. Ask it early and ask it plainly. A wince is data. **Pain that is real but not purchasable is a research finding, not a business.** ### The referral test Itzik Alvas ran the same play at Entro Security: more than 200 conversations with practitioners before a line of code. Out of them came a filter any founder can apply in the last two minutes of a call. “Do you know anybody else with that problem? Do you know anybody else that would like to have that conversation too?” he asked on his episode. If the answer comes with a name and an introduction, the pain is real. The mechanics of the question are what make it honest. Telling a founder their idea is interesting costs a practitioner nothing; the cybersecurity community is small and people are generous to founders. A referral is different. It spends real currency, a colleague’s time and the referrer’s credibility. A yes means the pain is real enough to vouch for. A polite deflection means you have learned something too, and learned it in two minutes instead of two quarters. This is the core insight of The Mom Test, the book we recommend to every founder at this stage: people will lie to you to be kind, so design questions that politeness cannot answer. Ask about behavior, past spending, and referrals. Never ask “would you buy this?” and believe the answer. ### From conversations to a testable proposition Conversations tell you the pain is real. They do not yet tell you that your framing of the fix will land. The method we walk through in our webinar bridges that gap. Write the value proposition down as a sentence a stranger could evaluate. Then put it in front of honest outsiders, and test three things: do they understand it, unprompted, in their own words; how much do they want it, scored out of ten rather than gestured at; and what do they expect it to cost, which surfaces price sensitivity before a procurement team does. Iterate through the conversations until the scores move. Then, and only then, put the proposition on a live page and let real traffic vote. The sequencing matters. Founders love to skip to the live page, because a page feels like progress and a survey feels like homework. But traffic on an unvalidated proposition just measures how convincingly you phrased the wrong thing. The conversations come first because they are where the proposition gets its content: the words buyers use for the pain, which are almost never the words in your architecture diagram. That language is an asset. It becomes the homepage, and it is the difference we describe in the five-second homepage between a line that lands in seconds and a poetic sentence that could describe three unrelated products. ### Design partners are closer than you think The step after validation is design partnership, and here founders consistently overestimate the barrier. In our CISO research, a finding that surprises almost every founder we share it with: design partnerships are easier to start than you assume, including with the dream logos. Senior security buyers take these conversations willingly, on conditions that are entirely within your control. The value has to be genuinely two-way. Pricing and intent have to be transparent from the first email. And there must be no sales hook hidden inside a research conversation, because the buyer who discovers one will remember it, and the community they talk to is small. What does the buyer get? Earlier than you think, quite a lot: influence over a roadmap they will eventually depend on, early sight of a capability their incumbent vendors lack, and a founder who actually listens. One CISO we interviewed put the value of a good design partner in terms every founder should internalize: they tell you which missing capability will block the sale in eighteen months. That is knowledge no amount of internal planning produces, and it arrives while the fix is still cheap. The trust that opens these doors is personal before it is corporate. Buyers of early-stage products get comfortable with the people as a proxy for the immature product, which is why the same credibility you build in research conversations has to be visible on your website too. We cover that in your team page is a security control. ### What validation buys you beyond the product Frame the 250 conversations as product research and you undercount the return. Three other assets come out of the same work. **A de-risked raise.** An investor hearing “we held 250 buyer conversations and pivoted on what we learned” is hearing evidence of process, not just conviction. The pivot is not a blemish on the story. It is the story: proof the company steers by market signal. **Your first design partners.** The best conversations do not end. The practitioner who lit up in minute forty is your first design partner candidate, already warm, already invested in the shape of the fix. **Your first honest messaging.** By the end, you have heard the pain described a hundred ways and watched which framings made buyers lean in. Your positioning is no longer a guess to be tested in the market. It has already survived contact. The founders who skip this stage usually skip it because building feels like progress and talking feels like delay. Twine’s story is the rebuttal. The most consequential product decision the company ever made happened before the product existed, in conversation number one through two hundred fifty. The code came after, and it was written at the right target. --- ## How bold is too bold? The CFO-forward test URL: https://yaya.co/resources/how-bold-is-too-bold Published: 2026-08-04 Bold branding works in cybersecurity when it traces to a real differentiator and fits the team who will live it. The ceiling is consensus buying: your champion will forward your site to a finance stakeholder, so the working test is whether they can do that without wincing. Forgettable is the bigger risk. Key points: - In our Cult Products Awards report, the outliers among 77 RSA startups increased their trustworthiness by taking risks, not despite taking them. - If you get no reaction, you are forgotten: nobody can hum the Avengers theme because it is exactly what you would expect. - The ceiling is real: a security-focused VC has watched deliberately irreverent brands create measurable go-to-market drag in consensus-driven buying. - The working test is whether your champion can forward your website to a finance stakeholder without wincing. - Boldness must trace to a real differentiator and fit the team; playfulness imposed on researcher-founders reads as fake. Every cybersecurity founder we meet holds two instincts at once. The first: we have to stand out, because the category is a sea of sameness and we are drowning in it. The second: we cannot afford to stand out too much, because our buyers are the most professionally suspicious people in software and one wrong note could cost us the deal. Founders usually assume one instinct must be wrong. Neither is. The interesting question is not whether to be bold. It is where the ceiling sits, and it turns out there is a working test. ### The case for bold: forgettable is the expensive option Start with the evidence for boldness, because it is stronger than most founders believe. When we scored the 77 startups exhibiting at RSA’s Early Stage Expo and Next Stage for our Cult Products Awards report, the companies that stood out were not trading credibility for attention. The outliers increased their trustworthiness by taking risks. Confidence in the brand read as confidence in the company; a strong, distinctive presence signaled a team that knew exactly what it was and was not apologizing for it. The crowded middle, well executed and interchangeable, earned no such credit. We wrote up the full pattern in security brands all sound the same. Which points at the real cost most founders never price in: the cost of no reaction. Here is the test we use in creative reviews. Try to hum the Avengers theme. Almost nobody can, from a franchise with billions in box office, because the music is exactly what you would expect and nothing more. Now try Game of Thrones. Everyone can. One composition took a risk and lodged itself in memory; the other was competent and evaporated. Brands work the same way. If you get no reaction, you are not being safely neutral. You are being forgotten, and forgotten does not make shortlists. Our own line for it: Marmite, not butter. Butter offends nobody and nobody has ever crossed a street for it. **It can be very risky not to be bold. Safe and forgettable is a risk; it just sends the invoice later.** ### The ceiling is real: what irreverence costs in the room you are not in And yet the founders’ second instinct, the fear, is grounded in something real too. In our research, a security-focused VC who has watched many portfolio companies go to market described watching deliberately irreverent brands create measurable go-to-market drag. Not a vague chill. Slower cycles, harder internal advocacy, deals that leaked energy at every approval step. The detail that should stop every founder mid-rebrand: a CISO privately asked whether presenting that vendor internally would be embarrassing. Understand why that question is fatal, because it is not about taste. Security buying is consensus-driven. A practitioner champion discovers you, but the CISO gathers agreement across engineering, legal, procurement, and finance before anything is signed, and your materials travel through that whole chain without you in the room. Your website gets forwarded to a CFO who forms an opinion in seconds, and that CFO is not your audience, shares none of your industry’s in-jokes, and controls the money. A brand that delights practitioners but makes your champion hesitate before forwarding it upward is not bold. It is friction wearing boldness’s clothes, and you will never see the deals it costs you, because they die quietly in rooms you were never invited to. ### The test: can your champion forward you to finance without wincing So here is the line, stated as a test you can actually run. Pull up your homepage and imagine your best internal champion, the practitioner who loves you, about to forward it to their CFO with a note saying “we should look at this.” Can they hit send without wincing? If yes, whatever boldness you have is inside the ceiling, and you almost certainly have room for more. If they would hesitate, add a caveat to the email, or send a sanitized deck instead of the site, the brand is creating drag exactly where you can least afford it. Notice what the test does not ask. It does not ask whether the CFO will love the brand, laugh at it, or remember it. It asks only whether the brand survives being forwarded to someone who is not its audience. Survival is the bar. Delight is for your actual buyer. The test also exposes the false binary founders bring to this conversation: that the choice is between bold-and-risky and safe-and-dull. The real spectrum runs from forgettable through distinctive to embarrassing, and the profitable zone, distinctive, is wide. Most cybersecurity brands fail it from the forgettable side, as the category’s own websites demonstrate. The irreverent failures are rarer; they are just more visible, which is why they dominate the cautionary tales. ### Bold must trace to something, and it must be yours Two qualifiers keep boldness on the right side of the line, and both are about honesty rather than volume. First, boldness must trace to a real differentiator. Bold for bold’s sake is decoration, and buyers metabolize it as noise within a quarter. The question to ask of every daring choice, visual or verbal, is what truth about the company it expresses. A genuinely contrarian product philosophy can carry a contrarian brand. A distinctive founding story can carry a distinctive voice. If the boldness expresses nothing, it is a costume, and costumes read as costumes. Second, boldness must fit the team who will live it. In the same research that surfaced the VC’s warning, another pattern: playfulness imposed on researcher-founders reads as fake, and security buyers are professionally suspicious of fake. A team of quiet ex-agency researchers fronted by a jokey mascot brand is a mismatch every buyer can feel in the first meeting, when the website’s voice and the founder’s voice fail to be the same voice. Boldness has more registers than humor. Precision is bold. Total conviction is bold. Naming the uncomfortable truth in your category is very bold. The right register is the one the founders can sustain in person, on their worst day, in front of a skeptical room. ### How we draw the line in practice Two mechanisms turn all this from judgment calls into process. The first is the archetype cocktail. Rather than choosing one brand archetype from the classic twelve, we build a weighted mix of about three. Cybersecurity gravitates to the Sage by default, the expert who knows, which is why the category all sounds the same; the Sage alone produces whitepapers in a trench coat. The interesting work is pairing Sage trust with something bolder, in proportions the team can actually inhabit. The weighting is the safety mechanism: enough Sage to carry the CFO-forward test, enough of the bolder note to be remembered at the peer dinner. When we ran the archetype exercise with Geordie, it moved their messaging from fear-led to Caregiver-led empowerment, bold as a category position precisely because everyone else was selling dread. Henry Comfort put the choice plainly on our podcast: “You can talk a lot about fear. You can talk a lot about risk. You can talk a lot about uncertainty or doubt. But actually, there’s so much opportunity in this field.” The second is a rule about roles in creative review. It is the creative team’s job to go too far, and the business’s job to draw the line. Both halves are load-bearing. If the creative work never crosses the line, you have no idea where the line is, and you end up parked in the forgettable middle by default, having never tested the boundary. The nightmare outcome of a review is not a client saying “too far.” Too far means the edge is now mapped, and one step back from it is exactly where a brand should live. The nightmare is a client saying you did not push far enough, because it means the whole exploration happened inside the safe zone and the money bought no information at all. Which returns us to the founders’ two instincts. Stand out: correct. Fear the edge: also correct. The resolution is not a compromise between them. It is a sequence. Go too far deliberately, find the edge, then govern the result with one question: would your champion forward this to finance without wincing? Ship the boldest thing that passes. --- ## When to launch: the cybersecurity market calendar URL: https://yaya.co/resources/when-to-launch-cybersecurity-market-calendar Published: 2026-07-28 There is no perfect launch moment, only market logic. US security buyers set priorities in September, December is dead, and RSA dominates the early months of the year. Pick the window, count backward about three months for brand work, and remember stealth means the product is private, not the founder silent. Key points: - September is when US security buyers return from vacation and set quarterly priorities; December moves nothing; by early in the year, RSA becomes the gravity well. - The window you pick determines the runway you need, so launch timing is a finance decision as much as a marketing one. - The role-reversal test: if a dream enterprise customer approached tomorrow, you would not send them away for six months, so you are more ready than you feel. - Stealth does not mean silent: publish research and opinion while the product stays private, and inbound starts before a marketing function exists. - On events, go big or go deliberate, never the middle; and count backwards about three months of brand work from your chosen date. Every founder runs the launch-timing debate, usually more than once. Before the Series A or after, so the raise has a story. Before the product feels ready or after, so the product can speak for itself. Both versions of the debate assume a perfect moment exists and can be found by reasoning harder. It does not. What exists is market logic, and it is more useful than perfection: it gives you a date you can plan against. ### The calendar does not care about your roadmap The cybersecurity buying year has a shape, and it is not the shape of your sprint plan. September is the serious month. US buyers come back from summer vacations and set quarterly priorities, budgets get committed against named problems, and a vendor that is visible and legible right then gets evaluated inside that cycle. December is the opposite: nothing moves. Deals stall, champions are on leave, and a launch lands like a press release on New Year’s Eve. Then, early in the year, RSA becomes the gravity well. The industry’s attention bends toward one week; every vendor’s news competes with every other vendor’s news, and the weeks around it are consumed by preparation and recovery. None of this is a complaint. It is a schedule, and the strategic consequence is the point: the window you pick determines the runway you need. A September launch and an RSA launch are different financial plans, not just different dates. Miss your window by six weeks and you are not six weeks late; you are one full buying cycle late, burning payroll while the market looks elsewhere. Founders treat launch timing as a marketing question. It is a finance question wearing a marketing costume. **Pick the window first. Let the window set the runway, not the other way round.** ### The role-reversal test The other half of the debate is readiness, and here founders reliably hold themselves to a standard no buyer holds them to. The product needs one more capability. The messaging needs one more pass. Ready recedes as you approach it. So run the test in reverse. If your dream enterprise customer approached you tomorrow, unprompted, with the exact problem you solve, what would you do? You would not say “come back in six months.” You would take the meeting, show what exists, be straight about what does not, and start the relationship. Nobody in the history of startups has turned that meeting down. That answer is the answer. If you are ready to have that conversation, you are ready to launch, because a launch is only that conversation happening at scale. The polish you are waiting for is polish buyers of early-stage products do not expect. What they are actually evaluating, as our own buyer research keeps confirming, is whether the problem is real, whether you understand it, and whether they trust the people. All three can be true today. ### Stealth does not mean silent The word “stealth” does a lot of damage here, because founders hear it as a vow of silence. It is not. Stealth means the product is private. It says nothing about the founder. The approach we recommend runs two tracks. The product track stays dark: no feature reveals, no screenshots, no roadmap in public. The expertise track runs loud from the earliest days: publish the research, share the findings, take positions. In our CISO research this was one of the clearest patterns on the inbound side: research and education with an opinion attached drive interest before any marketing function exists, and taking a contentious position beats contributing politely to a conversation everyone else is already having. A founder who writes “my startup is in stealth, but here is what our research across two hundred environments found” is not breaking stealth. They are building relationships with the humans who will one day be customers, while the product stays private. By launch day, the audience already exists, already associates the founder with the problem, and already trusts the thinking. The same conversations feeding your validation work generate the material; publishing it just compounds the return. And the published track now has a second reader: the answer engines mapping who knows what in each category, which is worth extra in a space as contested as agentic security. ### Version zero If the calendar argues for picking a window and the role-reversal test argues you are readier than you feel, the remaining anxiety is the product itself. Too rough to show. Here the strongest counterargument comes from a founder who lived it. Itzik Alvas of Entro Security argues publicly for releasing earlier than feels comfortable. “Nothing beats delivery,” he said on our podcast. “Nothing beats, hey, it’s version zero, it’s not even alpha, but I just wanted you to see it, play around with it and tell me what do you think.” The logic underneath is about how security is bought. It is an experience good; buyers need to touch the thing before they believe it, and nothing you write or present beats letting a buyer experience the product. A rough version in a buyer’s hands generates the kind of feedback and trust that a polished deck never will. Honesty about roughness costs less than founders fear, and the buyers it loses were not early adopters anyway. ### Go big or go deliberate Launches in this industry get entangled with events, so the events discipline belongs in the timing plan. The founders who have done it well converge on the same rule from different directions. Rob Allen describes ThreatLocker’s approach as “go big or go home from a marketing perspective”, with the crucial addendum he offers on his episode: “There is a lot between doing nothing and doing RSA.” Justin Woody of Twine, after walking off conference floors more confused than when he walked on, arrives at the same place on his: “How do you do less events but make your impact bigger?” The shared enemy is the middle: the six-foot booth at the mid-tier conference, staffed thin, visited by nobody with budget, expensive enough to hurt and small enough to vanish. Either commit to an event fully, with the presence and preparation to be remembered, or choose the deliberate small play: a dinner for twelve of the right practitioners, a workshop, a research briefing. Both extremes work. The middle only burns money quietly. ### Count backwards One last input, and it is the one founders discover latest: the work takes time. Brand takes about three months to do properly: positioning, identity, messaging, a website that can carry a launch. So the planning motion is simple arithmetic. Pick the window the calendar and your runway agree on. Subtract three months. That is when the brand work starts, which usually means it starts before the debate about whether to launch has even finished. A September launch is a June start. An RSA launch means the work is underway before the holidays, precisely when nothing else is moving and the time is available. And the arithmetic is unforgiving in one direction only: brand work can wait for a later window, but a window will not wait for late brand work. So the debate resolves into a sequence rather than an agonized decision. Read the calendar. Pick the window your runway reaches. Run the role-reversal test to settle the readiness anxiety. Keep publishing while the product stays private. Choose your events at one extreme or the other. Then count backward and start. The founders who get this right are not the ones who found the perfect moment. They are the ones who picked a window, trusted the arithmetic, and were entirely ready when their market looked up. --- ## AI is your salesperson now URL: https://yaya.co/resources/ai-is-your-salesperson-now Published: 2026-07-21 Security buyers now describe their situation to an LLM and get three to five vendor recommendations, not twenty links. Being one of the five is the new page one. Specific positioning, a fast readable website you own, and genuine presence in the communities models cite decide whether you make the list. Key points: - Buyers describe a use case to an LLM and get three to five recommendations; being one of them is the new page one. - Different engines cite different sources, and enterprise buyers are often on Copilot because of Microsoft’s footprint. - A vendor positioned for everyone gives the model nothing to match; specificity wins the recommendation. - Your website is the front door twice, first for the model and then for the referred human. - Most of the category rents closed website platforms; a codebase you own is the version AI can actually read. Here is how a security product actually gets found now. A buyer does not type a category name into a search engine and wade through twenty links. They open an LLM and describe their situation: we are a 100-person company with 10 IT staff, our emails keep going to spam, give me the top five options. The model answers with a shortlist, and the buying journey starts from there. That description comes from Deepak Gupta, the second-time founder behind Grakka, on our Cult Products podcast, and it matches what we see across the security startups we work with. “They don’t say that, give me a CNAP solution or give me an email security solution,” he told us. “They specifically ask about the specific use case.” Buyers do not ask for categories. They describe use cases in context and let the model translate. ### Three to five names, not twenty links A search results page gave you twenty chances to be seen, with a long tail of pages behind it. An LLM gives three to five recommendations. That is the entire surface. If you are one of the five, you are on the shortlist before you have spoken to anyone. If you are not, you do not exist for that buyer, and there is no page two to rescue you. Being one of five is the new page one. The mechanics change with it. The model is not matching keywords; it is matching the buyer’s described situation against everything it can read about you: your site, your documentation, and what other people say when you are discussed. Run the exercise on yourself. Write the prompt your best customer would have typed the month before they found you: their company size, their team, their symptom. Ask it in each engine your buyers use and read what comes back. That shortlist is your real competitive set, and it rarely matches the one on your battle cards. If you are not on it, the rest of this article is your to-do list. ### Different engines, different sources Gupta’s research points at a wrinkle that catches founders out: different engines cite different sources. “So the big challenge or what we have seen when we do the AI search is each LLM works differently,” he said on the episode. Some read your website for messaging and positioning, some lean on third-party sources, some go to video. The material that earns you a recommendation from one model is not automatically the material that earns it from another. And the engines are not evenly distributed across buyers. Enterprise and regulated buyers are often on Copilot, in his words “because Microsoft has a good penetration in a lot of regulated industry”. If you sell to banks, insurers, or government, the model reading about you is probably Microsoft’s. Ask it about your problem space today and see whether you appear. ### A vendor for everyone is a vendor for no one Think about what the model does with that use-case prompt. It looks for vendors whose public record matches a 100-person company, a small IT team, and an email problem. A vendor whose website claims to secure everything for everyone gives the model nothing to match against. A vendor who plainly states who they are for and what problem they remove is easy to recommend, because the fit is legible. Specificity beats breadth. The narrow claim, the named buyer, and the concrete mechanism win the recommendation for the same reason they win with a human reader: the model can tell what you are. A machine deciding between five slots has no room for a maybe. This is the argument for a category of one carried to its logical end. Claim one lane with total clarity and both audiences can act on you in seconds: the human buyer can place you against something they know, and the model can match you to a described situation. Vagueness fails both. A wide, hedged proposition does not make you eligible for more shortlists. It makes you eligible for none of them. ### The front door gets used twice Gupta’s sharpest point is about what happens after the recommendation. The website is the front door, and it gets used twice. The model reads it first, when deciding whether you belong on the shortlist. Then the human reads it, arriving warm from a referral the model just made. If the design is dated, the UX clumsy, or the messaging vague, the trust conversion fails at the second door and the referral is wasted. This raises the stakes on craft. A recommendation from a model arrives with borrowed credibility, and a site that looks unloved spends it instantly. Buyers of security products are professionally suspicious; a front door that does not match the promise of the referral confirms their suspicion rather than easing it. That second visit behaves like any other first visit. You have about five seconds to land who you are for and why you are different. And once the visitor is convinced enough to act, do not route them into a demo-only dead end, because nobody wants to book your demo. A buyer referred by a machine still wants to verify you on their own terms. ### Educate where the models listen Communities are now ranking inputs. Reddit, LinkedIn, Quora, and Hacker News feed the models’ picture of who is credible on a topic. The instinct to go and promote yourself there is exactly wrong. Those communities detect and punish self-promotion, and the models learn from how communities respond. Contribute real answers. Educate. Take positions you can defend. The presence that earns trust with practitioners is the same presence that earns citations from machines. Our CISO research points the same way from the demand side. Research and education with an opinion attached drive inbound before any marketing function exists, and taking a contentious position beats contributing politely to the conversation. The models amplify that effect. A vendor with a distinctive, defensible position gets discussed, quoted, and linked, and the model reads all of it. A vendor who says what everyone else says gives the machine no reason to pick them out of the chorus. ### Own the version of yourself that machines read There is an infrastructure question underneath all of this. When we scored the 77 startups exhibiting at RSA’s Early Stage Expo and Next Stage for our Cult Products Awards report, we found a category standardized on rented website platforms: most sites are built and hosted on Webflow, WordPress sits in second place, and HubSpot dominates the marketing stack. That is the status quo, and it is worth naming plainly: the layer AI reads is a layer most security startups do not own. A codebase you own, structured for machine readability, is the version of your site that AI can actually read and your team can extend. Clean semantics, fast pages, structured data, and content a crawler can parse without fighting a page builder’s output. This is why we build client sites in code the client owns: a React front end, Sanity as the content layer, and a repo in the client’s GitHub, designed for AEO and AI tooling from the start. The machines reading your site will keep changing. Owning the code is what lets you keep up with them. ### Train the salesperson On the podcast, Gupta landed on the line the whole argument turns on. > “AI is your salesperson. AI is your affiliate manager. They are linking you to the customer.” Asked what follows from that, he was specific. “You just need to train the AI that this is what I’m selling, this is what I do, this is the problem I’m solving, and AI is gonna go and sell it for you.” The training material is everything the model can read: your homepage, your documentation, your community answers, and the structure of the pages that carry them. Most of your future buyers will meet this salesperson before they ever meet you. It is already giving its pitch. Decide what it says. --- ## The enterprise contradiction: adopt AI faster, secure it later URL: https://yaya.co/resources/the-enterprise-contradiction Published: 2026-07-14 Enterprises are pushing employees to adopt AI as fast as possible while security teams scramble to see what those agents are doing. The gap is the market every agentic-security founder sells into. The winning pitch treats the CISO as the AI champion: give the business line of sight so innovation continues. Key points: - Employees are told, sometimes in their performance reviews, to adopt AI as fast as possible in the domain they understand least, and that behavior is the fastest-growing attack surface. - Organizations split into a hell-no camp that blocks agents and a cart-before-the-horse camp that already runs them without visibility; there is no comfortable middle. - Agentic tooling does not create the data-governance problem; it surfaces the one the organization already had. - Most security leaders want to say yes to the business, so sell enablement, not gatekeeping. - Security is a cost center and AI is a rare chance for a CISO to be seen enabling revenue; sell them that identity. Somewhere in a large enterprise right now, an employee is being told to adopt AI faster. Not encouraged. Told. In some organizations the instruction has reached performance reviews: find ways to use AI in your work, and be measured on it. The same employee has near-zero training in how these systems fail, what they can access, or what happens when an agent acts on their behalf in a system they barely understand. Multiply that by every department, and you get the defining contradiction of the enterprise right now. The behavior the organization is actively incentivizing is also its fastest-growing attack surface. Adoption is mandated from the top. Security is asked to catch up from behind. Nobody has resolved the tension, because the tension is structural: the business case for AI is measured in quarters, and the risk is discovered in incidents. If you are building an agentic-security company, this contradiction is not background noise. It is your market. Every buyer you will ever talk to is living inside it. ### Shadow agents and the vanishing perimeter The scale of the problem is easy to underestimate because most of it is invisible by definition. In some organizations, shadow agents already outnumber sanctioned ones. An employee connects an assistant to their inbox. A team wires an agent into the CRM to draft follow-ups. None of it goes through procurement, because none of it feels like buying software. And the supply side is accelerating the drift. Every SaaS vendor is quietly becoming an agent vendor. The tools an enterprise already licensed are shipping agentic features into production environments, which means an organization’s agent population grows without anyone making a single new purchasing decision. The perimeter did not move. It dissolved. Here is the point a board advisor made in our research that reframes the whole category: agentic tooling does not create the data-governance problem. It surfaces the one the organization already had. The permissions were always too broad. The data was always over-shared. Agents simply move fast enough, and touch enough systems, to turn a chronic condition into an acute one. **Agents are not the disease. They are the diagnostic.** ### Two camps, no middle path Hanah-Marie Darley and Henry Comfort, the founders of Geordie, describe the market as split into two camps. Unpacking it with early adopters, Darley told us on our podcast, “they essentially found themselves in two camps: those who couldn’t adopt because the risks were too big, or those who did adopt and then realised the risks were too big. There was no middle path.” The first is the hell-no camp: security blocks agents outright, and the organization forfeits the productivity the board is demanding. The second is the cart-before-the-horse camp: agents are already in production with no visibility, and the reckoning is scheduled for them, in the form of an audit or a cyber-insurance renewal that asks questions nobody can answer. What there is not, in their telling, is a comfortable middle path. The pressure to adopt does not pause while security designs a policy. An organization is either refusing the future or running it unsupervised. The detail that matters most for founders is this: most security leaders want to say yes to the business. The hell-no posture is not conviction. It is the only move available to a leader who cannot see what the agents are doing. Give that leader visibility and the posture changes, because the posture was never the goal. It was a symptom of blindness. Geordie’s founders reach for a story from the industrial revolution to make the point. Mining machinery went deeper than ever before and released an invisible, flammable gas. The response that worked was not closing the mines. It was the Geordie lamp. “It gave line of sight into this new risk that you otherwise couldn’t see with your own eyes,” Darley told us, “so that you could deal with the risk and then continue to power innovation.” AI agents are the same moment. “They’re operating across systems, within code, all over the place. And so we ultimately turn the lights on.” The gas is already in the tunnel. The question is whether anyone can see it. ### The CISO wants to be the AI champion Now look at the same contradiction from the buyer’s chair, because this is where most agentic-security pitches go wrong. Security is a cost center. It has always been a cost center. Nobody attributes revenue to the breach that did not happen, and the CISO’s budget conversation is a permanent exercise in justifying insurance. Then AI arrives, and for the first time in most CISOs’ careers, there is a boardroom topic where security can be seen enabling revenue rather than taxing it. The CISO who helps the business adopt AI safely is not a gatekeeper. They are a champion of the thing the CEO cares about most this year. That is a rare identity upgrade, and it is on offer exactly once. A CISO in our research put it with an analogy worth keeping. The answer to road deaths was never banning cars. It was making cars safer, and making the safe path the easy path, so that nobody had a reason to route around the rules. Seatbelts, crumple zones, motorways. The transport did not slow down. The dying did. The lesson for security leaders is direct: if the safe path is slower than the shadow path, the shadow path wins, every time, in every organization. The job is not to say no. It is to make yes survivable. ### Sell enablement, not gatekeeping For founders, the pitch implication falls straight out of the psychology. Most agentic-security messaging is fear-led: the threats are multiplying, the agents are unaccountable, be afraid, buy control. Fear-led messaging casts the CISO as a gatekeeper, and the gatekeeper identity is precisely the one they are trying to escape. The pitch that lands sells the other identity. You are not offering a way to stop the business. You are offering the line of sight that lets the CISO say yes, with evidence, faster than their peers. The product is control, but the story is permission. When we worked with Geordie on their brand, their archetype work moved them deliberately away from fear-led messaging toward empowerment. Comfort described the shift on our podcast as “focusing on empowerment of customers in a really specific way”, and that repositioning is inseparable from how the company now reads: not the alarm in the mine, but the lamp. There is a second-order benefit. Enablement stories travel upward. A fear story stops at the security team, because fear is the security team’s job. An enablement story gets forwarded to the CIO and the board, because it speaks to the thing they are already being measured on. In a bottom-up market, a story that survives being forwarded is a distribution channel. **Sell the CISO the identity of the enabler, and the control comes along for free.** ### The market will not wait for a resolution The contradiction at the top of this piece is not going to resolve itself politely. Adoption mandates are strengthening, agent populations are compounding through the SaaS supply chain, and the audit and insurance cycle is about to start asking pointed questions of the cart-before-the-horse camp. The founders building for this moment are selling into a buyer who is pressured, exposed, and looking for the vendor who understands that they want to say yes. Which raises the harder problem. Understanding the contradiction gets you into the conversation, but nearly every agentic-security vendor now opens with some version of the same story, and we have written separately about how to stand out in agentic security when everyone is agentic. And whatever story you choose still has to survive contact with a buyer whose stack is already overflowing, which is why it pays to remember that CISOs don’t want more tools. They want fewer, with better line of sight. The enterprises figured out the hard way that the answer was never banning cars. The vendors who win this market will be the ones who showed up selling headlights. --- ## CISOs don’t want more tools. They want fewer. URL: https://yaya.co/resources/cisos-dont-want-more-tools Published: 2026-07-07 CISOs are not shopping for another tool. Every product in their stack is a job to run, and budget usually comes from retiring something else. The startups that win explain what comes out of the stack when they come in, claim one narrow lane, and use de-risking language instead of urgency. Key points: - Every security tool is a job to run, so a new product pitch starts from negative value until it proves otherwise. - Security budget is replacement budget: the question in the buyer’s head is what comes out of the stack if you come in. - The current market fear is buying the wrong thing, so de-risking language beats urgency every time. - Buyers trust narrow specialists but want to consolidate; resolve the contradiction by owning one lane and publishing your roadmap as an explicit journey. - Calling yourself a platform hands the win to an incumbent who already says it with more evidence. Every cybersecurity pitch assumes the buyer has a gap. Our webinar research, built on interviews with CISOs and senior security buyers at companies including Apple, Yahoo, and Red Hat, found the opposite. The stack is not empty. It is overflowing. The most common misconception we see founders carry into the market is the belief that a CISO is looking for one more product. They are not. Most of them are quietly looking for three fewer. That single misreading shapes everything downstream: the homepage that lists capabilities, the outbound that promises another dashboard, the deck that positions you as an addition. To a buyer whose team is already drowning, an addition is not a gift. It is a liability with a logo. ### Every tool is a job to run A security product is not a capability that arrives in the post. It is work. It has to be deployed, integrated, tuned, staffed, triaged, renewed, and defended at budget time. The stacks our interviewees run already bombard their teams with notifications, and every alert is a decision someone has to make before going home. So when your pitch lands, the CISO does not hear “new capability.” They hear “new job.” More tools often mean more toil, and the person you are selling to is the one who owns the toil. This is why feature lists fail as persuasion. A list of things your product does is, from the buyer’s chair, a list of things their team will now have to do. **The pitch that respects the buyer starts from the work your product removes, not the features it adds.** ### The question in the buyer’s head Here is the uncomfortable arithmetic. Security budget is rarely incremental. It is replacement budget. When a CISO reads your homepage, the question forming behind their eyes is not “is this good?” It is “what comes out of my stack if you come in?” If your story has no answer to that question, the buyer has to invent one, and inventing budget justifications for a vendor they met four minutes ago is not how CISOs spend their afternoons. The winning story does the work for them. It retires a line item, and it does something the retired product could not. That second half matters. Pure replacement is a procurement exercise, and procurement exercises are decided on price. Replacement plus a new result is a strategy, and strategies get sponsored. This is also why “we integrate with everything” is weaker than founders think. Integration says you sit alongside the stack. Replacement says you shrink it. Only one of those is what the buyer actually wants. ### The market’s real fear is buying the wrong thing CISOs are professionally suspicious for structural reasons. Nobody thanks them for the ten thousand attacks their stack stopped last quarter. One miss defines a career. That asymmetry produces a buyer who is career-exposed on every purchase, and right now the fear that dominates the market is not moving too slowly. It is buying the wrong thing. Urgency messaging reads that fear exactly backwards. Countdown energy, this-quarter pressure, breach statistics deployed as a cattle prod: all of it signals a vendor optimizing for their own pipeline rather than the buyer’s safety. What outperforms it, consistently in our research, is de-risking language. Three components: - **What you replace.** Name it. The buyer needs the budget story before the technology story. - **What you do not claim.** Stating your limits plainly is the single cheapest credibility purchase available to an early-stage vendor, because everyone else claims everything. - **How fast they can verify.** A short path to proof, a scan, a trial, a time-boxed evaluation, converts skepticism into evidence without asking for trust up front. De-risking is not timid. It is precise. A vendor who knows exactly what they displace and exactly where their edges are sounds more dangerous to incumbents, not less. ### The contradiction you have to resolve Our CISO research surfaced a contradiction that sits at the center of security go-to-market. Buyers trust narrow specialists. A vendor that does one thing deeply reads as credible, current, and safe to evaluate. But the same buyers want to consolidate, because every extra vendor is procurement overhead, another renewal, another throat to choke. Founders usually respond to this tension by hedging. They describe their product broadly enough to look consolidation-friendly and end up sounding like everything else. The word that hedge reaches for is “platform,” and in our interviews, platform and governance layer came up as dead words. Not because breadth is bad, but because an incumbent already says them, with a decade of deployments behind the claim. When a twelve-person startup says platform, the buyer does not hear ambition. They hear a category they cannot place and a claim they cannot check. The resolution that works is sequencing, not hedging. Claim one lane with total clarity. Be verifiably the best in that lane. Then publish your roadmap as an explicit journey: here is where we start, here is what we take on next, here is where this goes. A published journey gives the consolidation-minded buyer a reason to bet on you without requiring you to pretend you are already broad. It converts “narrow” from a limitation into the first chapter of a plan. **Narrow now, with a stated direction, beats broad-sounding and unplaceable every time.** ### Where the story has to land All of this compresses into one unforgiving moment: the first seconds on your homepage. Our research found that the most common CISO reaction to startup homepages is “I still don’t know what you do.” Abstract benefit language fails because the same poetic sentence could describe three unrelated products. What survives is mechanism: what your product creates, what it attaches to, what happens when it finishes, and what leaves the stack because of it. We have written separately about the five-second homepage, because that is the window your replacement story gets. There is a second audience for the same story, and it is not the CISO. Our webinar research found that the real buyer is often one level below: a practitioner who discovers you, tries you, and carries you upward, while almost every vendor aims its messaging at the CISO directly. A replacement story simple enough for that champion to repeat in a corridor conversation, this replaces X and does Y that X never could, is a story that sells while you are not in the room. Complexity does not survive being retold. Clarity does. The discipline pays off most in crowded categories. If you are building in agentic security, where a CISO is pitched by somebody new almost daily, the fewer-tools story is close to the only story that opens a conversation, and we have covered how to stand out in agentic security in its own piece. The instinct this asks of founders is genuinely hard: to stop presenting your product as one more thing, and start presenting it as one less. Fewer tools, fewer alerts, fewer line items, one clear lane, one published journey. The vendors that internalize this stop sounding like the two hundred others in the inbox. They start sounding like the rare one who has actually sat on the buyer’s side of the desk. That is not a messaging trick. It is a different theory of the customer. The CISO is not a gap waiting to be filled. They are an operator running an overloaded system, looking for the one vendor whose arrival makes the system smaller. --- ## Security brands all sound the same too URL: https://yaya.co/resources/security-brands-all-sound-the-same Published: 2026-06-30 Nearly all 77 cybersecurity startups we scored at RSA write in the same technical, professional, informative register, which makes voice one of the cheapest untapped differentiators in the category. The fix is strategic: derive a voice from positioning and brand archetypes, pair the Sage’s credibility with something bolder, and test that it survives being forwarded. Key points: - Scoring tone of voice across 77 startups, we found nearly all of them writing in the same technical, professional, informative register. - Wiz shows the ceiling is self-imposed: touches of personality alongside bold, Apple-like copy, credible and characterful at once. - Cybersecurity gravitates to the Sage archetype; the interesting work is pairing Sage trust with something bolder in a weighted cocktail of about three archetypes. - If you get no reaction, you are forgotten. Nobody can hum a theme that sounds exactly as expected. - Character has a ceiling: your champion must be able to forward your site to a finance stakeholder without wincing. The visual sameness of cybersecurity gets all the attention. The sea of blue, the padlocks, the plexus lines. It is easy to mock and easy to measure, and we measured it: almost 70% of the 77 startups we scored at RSA for our Cult Products Awards report use blue as their primary color. We covered what that visual convergence costs separately. But run a different test. Strip the logos and colors away entirely. Take the words alone from ten security startup homepages and read them aloud. Could you tell which company is speaking at any point? Could you tell where one ends and the next begins? Our research says no, and that gap is an opportunity hiding in plain sight. ### Seventy-seven companies, one register Scoring tone of voice was part of the Radical Story pillar in our report, and the finding was blunt: nearly all 77 startups write in the same highly technical, professional, informative register. Very few distinct personalities anywhere on the expo floor. Each company arrived at that voice for a defensible reason. The buyer is technical, so the copy is technical. The purchase is serious, so the tone is serious. The market punishes hype, so the register is flat. Every step of that logic is sound, and the collective result is a category where the words do no differentiating work at all. When everyone signals expertise the same way, expertise stops being a signal. Founders will spend six figures on a visual identity and then hand the words to whoever is free that week. The report’s data says the words are exactly as converged as the colors, which means voice is one of the cheapest untapped differentiators in the category. ### The Wiz exception One company keeps coming up as the counter-example, and our report named it: Wiz. Touches of personality, including lines like “Shift happens,” sit alongside bold, Apple-like copy. The result is credible and characterful at the same time. That combination matters more than the humor itself. The category assumes a trade-off: you can be taken seriously or you can be interesting, pick one. Wiz demonstrates the trade-off is imaginary. Its personality does not undercut the engineering credibility; it frames it. A company confident enough to be playful about a serious subject reads as a company that knows exactly what it is doing. The wrong lesson is to copy Wiz’s jokes. “You’ve got to zag,” Kelly Allen said on our podcast with Sara Carty of Unboring. “Copying someone doesn’t help. Actually, copying competition doesn’t help.” You cannot be Wiz; what you can learn from them is brand. The lesson is that a distinct voice is available in this market, and almost nobody is claiming one. ### Why everyone defaults to the Sage There is a reason the register converged, and it is not laziness. In archetype terms, cybersecurity gravitates naturally to the Sage: the expert, the analyst, the measured voice of knowledge. Trust is the currency of this industry, and the Sage is the archetype of trust. The mistake is stopping there. A pure Sage voice is indistinguishable from 76 other pure Sage voices. **The interesting work is pairing Sage trust with something bolder.** In our archetype method, a brand voice is not one archetype but a weighted cocktail of about three, and the weighting is where the personality lives. The Sage stays in the mix, because the credibility is non-negotiable. What changes is what you blend it with, and the blend comes from your positioning: what you alone can say, said in a way only you would say it. We have watched this work in practice. Hanah-Marie Darley and Henry Comfort of Geordie described on our podcast how the archetype exercise moved their messaging away from fear-led security talk toward Caregiver-led empowerment. It is a voice that matches what their buyers actually want. “Most of the security leaders that we talk to want to innovate. They want to say yes to the business,” Comfort said. “But they’re trying to be responsible. They’re trying to be practical.” The archetype did not decorate the strategy. It was the strategy, expressed in words. That is the core discipline. Voice is not a copywriting flourish applied at the end. It is a strategic choice derived from positioning and archetypes, made once, and then spent everywhere the company speaks. ### Competent is not the same as memorable Most cybersecurity copy is professionally written, expensively produced, and gone from the buyer’s head before the tab closes. It is not bad. It is the verbal equivalent of a film score that does exactly what you expect and nothing more, which is a thing you never hum afterwards. We take that test seriously enough to run it in creative reviews, and it is set out in full in how bold is too bold. The difference is not quality. It is distinctiveness. We put it this way: Marmite, not butter. Everyone eats butter and nobody talks about it. Some people hating your voice is the price of anyone remembering it. **If you get no reaction, you are forgotten**, and forgotten is the most expensive thing a startup brand can be. A voice that provokes nothing, risks nothing, and sounds like the category average is not a neutral asset. It is a silent one. ### The boldness ceiling Bold has a limit, and the limit is practical rather than aesthetic. Our CISO research defines it precisely. There is a real ceiling on this, and it is commercial rather than aesthetic. Deliberately irreverent brands can create measurable go-to-market drag, to the point where a buyer who likes you still cannot carry you into their own building. We set out the evidence and the ceiling in how bold is too bold. Because security buying is a consensus sport, your website will be read by people who are not your audience, and it has to survive being forwarded to finance. So the test for any voice decision is this: **can your champion forward your site to a finance stakeholder without wincing?** Character that survives that forward is an asset. Character that does not is drag. There is a second constraint from the same research: playfulness imposed on researcher-founders reads as fake. If the founding team is a pair of serious ex-agency researchers, a wisecracking brand voice will crack the first time a buyer meets them on a call. The voice has to be an amplified version of who the team actually is, not a costume. Where the ceiling sits for your specific brand is its own question, and we treat it fully in How bold is too bold. ### Voice is a positioning decision Pull the threads together and the takeaway is uncomfortable for anyone hoping to fix this with a better copywriter. The words on your website converged for the same reason the colors did: nobody treated them as a strategic surface. A distinct voice is not written, it is decided. It starts from positioning, takes shape as a weighted blend of archetypes with the Sage as the base note, gets stress-tested against the forwardability ceiling, and only then gets written down. Do that work and every sentence the company publishes becomes a differentiator that costs nothing extra to deploy. Skip it and you will sound like the other 76, no matter how good the writing is. --- ## Nobody wants to book your demo URL: https://yaya.co/resources/nobody-wants-to-book-your-demo Published: 2026-06-23 Most security buyers will never book a demo. They arrive cold or warm, not ready to buy, and asking for a meeting on arrival drives them away. Offer value first: a self-serve trial, a free scan, a product tour video, or a no-strings POC. Give before you get. Key points: - Only 42% of the 77 startups we scored give visitors anything of value before asking for their contact details. - Visitors arrive cold, warm, or hot, and only the smallest group ever books a demo. - Security is bought as an experience good: self-serve trials, free scans, product tours, and no-strings POCs outperform demo-only websites. - Never gate a case study; the person reading it is evaluating you. - Cold outbound is negative-yield in a small community that talks. Count the doors on a typical cybersecurity startup website. There is usually exactly one: book a demo. It sits in the header, anchors the hero, and repeats down the page like a chorus. When we scored the 77 startups exhibiting at RSA’s Early Stage Expo and Next Stage for our Cult Products Awards report, the pattern held across the category. Most marketing activity aims at the very end of the buying journey, the demo booking, and only 42% of the startups offer anything of genuine value before asking for contact details. The uncomfortable truth is that the door almost nobody wants to walk through is the only one on offer. ### The first date problem For our webinar on why CISOs don’t want to talk to you, we interviewed CISOs and senior security buyers at companies including Apple, Yahoo, and Red Hat. One finding came through with total consistency: they do not want to book your demo. People hate meetings. They hate being sold to. They hate handing over their details, because they know exactly what happens to details. It is a bit like going on a first date and immediately asking the person to marry you. You would not do that in person, so why is it the first and only thing your website asks of a stranger? A demo is not a small request. It asks a busy, professionally suspicious person to give up half an hour, sit through a pitch, and enter a sales process before they know whether you are even relevant to them. Our CISO research is blunt on why that lands badly. CISOs are career-exposed. Nobody thanks them for the ten thousand attacks their stack stopped, and one bad purchase can define a career. The current market fear is buying the wrong thing. An early meeting request reads as pressure, and pressure reads as risk. ### Cold, warm, and hot visitors Visitors arrive at your website in one of three states. Cold visitors know they have a problem. They do not yet know what can fix it, and they have never heard of you. Warm visitors know the problem and the kinds of products that address it, but they do not know you. Hot visitors know the problem, the options, and you. They are close to a decision. Only the smallest of these three groups will ever book a demo. A website whose only destination is a demo form serves the hot group and turns everyone else away, which is exactly what our awards research found the category doing: aiming nearly all activity at the small minority ready to buy now, while ignoring the much larger group who are not ready yet. That larger group is not a rounding error. It is next year’s pipeline. Serve each temperature with something useful, because in this market you must give before you get. Each state has a matching gift. Cold visitors need education: name their problem clearly, show them the ways it can be fixed, and teach them something they can use whether or not they ever buy from you. Warm visitors need evidence: how your approach differs from the category they already understand, what it would replace in their stack, and proof it works in an environment like theirs. Hot visitors need friction removed: pricing they can find, a trial they can start, and yes, a demo button. The mistake is not having a demo. The mistake is offering nothing else. ### Security is bought by touching it Security is bought as an experience good. Buyers cannot evaluate it from a brochure or a slide deck. They need to touch the product and watch it behave in something like their own environment. In our CISO research, the vendor motions that earned the most praise were all versions of letting the buyer experience the product on their own terms: - A self-serve 30-day trial, deployable across the whole organization, startable in five minutes without talking to a human. - A low-friction scan as the primary call to action, with “talk to us” as the quieter secondary option. - A short product tour video in the how-it-works section, so a visitor can see the product without booking anything. - A no-strings, time-boxed proof of concept that ends with a findings report the buyer keeps either way. Notice what these have in common. Each one hands the buyer evidence and control. Each one lets them verify your claims quickly, privately, and without entering a sales process. De-risking beats urgency with this audience: say what you replace, say what you do not claim, and show how fast they can check for themselves. **Build the buying journey the buyer wants: evidence first, commitment later.** ### The champion does the selling There is a second reason self-serve motions win, and it is about who actually buys. Security purchases are increasingly bottom-up. A practitioner discovers you, tries you, and becomes your champion. The CISO gathers consensus and signs, and finance forms its own view of you from your website. The real buyer is often one level below the CISO, yet almost every startup aims its website squarely at the CISO and puts the product behind a sales call the practitioner never wanted to have. A demo-only site makes the champion’s job harder at every step. They cannot try the product without inviting a salesperson into their evaluation. They cannot forward proof that sits behind a form. The self-serve trial, the scan, and the tour are the tools your champion uses to sell you internally when you are not in the room. Design for the person doing your selling, and make sure everything they need travels well when forwarded. ### Never gate a case study A special mention for a self-inflicted wound: the gated case study. Someone reading a case study is not a casual browser. They are evaluating you. They are looking for proof that you have done this before, for a company like theirs. Putting a form between that person and the proof stops them at the precise moment they are trying to convince themselves to buy from you. Give the case study away. The reader is doing your selling for you. ### Cold outbound digs the hole deeper If demo-first websites underperform, demo-first outbound is worse. In our CISO research, cold outbound consistently came out as negative-yield. It does not merely fail; it costs you future revenue. A former CISO told us about a vendor whose clever, sarcastic follow-up message genuinely landed. As an opener, it would have worked. It arrived after six canned, automated messages, and by then the deal was dead permanently. The security community is small and it talks. Peers and word of mouth are the real channel, and you rarely get a second attempt with a buyer you have annoyed. Every automated sequence you send is spending trust you have not yet earned. ### Give before you get None of this means deleting the demo button. It means demoting it. The demo becomes one door among several: the right one for the small hot group, while the scan, the trial, the tour, and the ungated proof serve everyone else. Each free, useful thing a visitor takes from your site moves them one temperature warmer, on their schedule rather than yours. The same logic extends beyond the product. Buyers of early-stage products get comfortable with the people behind them as a proxy for the product’s maturity, which is why your team page is a security control. And increasingly the first evaluation happens before anyone reaches your site at all, when an AI model decides whether to recommend you. Ask one question about every page on your site: what does a visitor get here without giving anything? If the honest answer is nothing, you have built a website for the smallest group of buyers you have, and left the rest at the door. --- ## Category of one: the business case for niching down URL: https://yaya.co/resources/category-of-one Published: 2026-06-16 Narrowing your niche does not shrink your opportunity; it concentrates it. At startup scale, a narrow niche is the only affordable way to become the obvious choice for one buyer. It also makes you machine-readable: an LLM asked for the best option for a specific buyer will not recommend a generalist. Key points: - When buyers can compare you feature for feature, the decision defaults to price, and undifferentiated brands get commoditized. - A startup cannot afford to be a plausible option for everyone; it can afford to be the obvious choice for one narrowly defined buyer. - The Blue Ocean method, mapping what competitors emphasize and then eliminating, reducing, raising, and creating, is how you find the gap where comparison becomes impossible. - Table-stakes capabilities must exist but must not be the story, because everyone has them. - LLMs answering buyer questions return three to five recommendations, and they will not recommend a vendor that claims to serve everyone. Ask a cybersecurity founder who their product is for and the answer usually starts specific and ends broad. “Security teams at mid-market SaaS companies. Although honestly, anyone with a cloud footprint could use it.” The second sentence feels safe. It is the expensive one. The fear underneath it is rational. Narrow the ideal customer profile and the addressable market on your fundraising slide gets smaller. Every instinct says keep the doors open, because you do not yet know who will walk through them. At startup scale, that instinct is wrong. The narrow niche is not the risk. It is the only affordable way to matter. ### What being comparable actually costs Start with the mechanism. When a buyer can line you up against four competitors and compare feature for feature, the comparison happens, and it resolves the way comparisons always resolve: on price. In our webinar research with CISOs and senior security buyers, the pattern was blunt. Undifferentiated brands get commoditized, and commoditization erodes margins. Not slowly, and not only at renewal. It shows up in the first negotiation, when procurement asks why you cost more than the vendor whose website says the same things yours does. Broad positioning guarantees this outcome. If you claim to serve everyone with a cloud footprint, you have volunteered to be compared with everyone who makes the same claim, which in cybersecurity is a very long list. The category’s own sameness makes it worse. When we scored the 77 startups exhibiting at RSA’s Early Stage Expo and Next Stage for our Cult Products Awards report, we found a crowded middle tier: companies executing well, saying similar things, in a similar register, and blending into one another. Well executed and undifferentiated is still undifferentiated. **If buyers can compare you, they will, and the comparison ends at price.** ### The only market you can afford Here is the arithmetic that makes niching a commercial decision rather than a branding preference. Becoming the obvious choice costs money: content, presence, repetition, the slow accumulation of recognition among a defined group of buyers. An incumbent can afford to run that play across an entire category. You cannot. You can afford to run it for one narrowly defined buyer with one urgent problem. That is the real trade. Broad positioning buys you a faint presence everywhere. Narrow positioning buys you a strong presence somewhere, and somewhere is where deals happen. The smallest commercially viable niche, small enough to dominate on your budget and large enough to sustain the business, is not a compromise. It is the entry strategy. You expand later, from a position where a group of buyers already treats you as the default answer to their problem. There is a wrinkle from our CISO research worth naming, and we go into it properly in CISOs don’t want more tools. Buyers trust narrow specialists and simultaneously want to consolidate. The resolution is not to fake breadth: claim one lane with total clarity, be the best at it, and be honest about where the roadmap goes next. ### Finding the gap: eliminate, reduce, raise, create Niching down tells you how big to aim. It does not tell you where. For that, the most useful exercise we run with founders comes from Blue Ocean thinking. Map what every competitor in your space emphasizes: the capabilities they lead with, the proof points they repeat, the language they share. Then work through four moves. What can you eliminate that the category treats as mandatory? What can you reduce below the category standard? What can you raise well above it? What can you create that no one offers at all? The point of the exercise is not a longer feature list. It is to find the gap where comparison becomes impossible, the position from which a buyer cannot line you up against the alternatives because you are not playing the same game. Figma is the clean public example. The market leader in design tools was not prioritizing real-time collaboration. Figma made it the center of the product, became impossible to compare on the incumbent’s terms, and eventually displaced it. The lesson is not “copy Figma.” The lesson is that the winning position was sitting in plain sight, in the gap between what the category emphasized and what users actually needed. ### Table stakes are not a story A common objection at this point: “but buyers require X, so X has to be front and center.” Sometimes the first half is true and the second half is not. Every category has table stakes, the capabilities a product must have to be taken seriously. In security that list is long: integrations, discoverability of assets, reporting, the compliance checkboxes. You must have them. You must not build your story on them, because everyone has them, and a story everyone can tell is not a story. It is background noise. The discipline is to separate the two lists. One list is what gets you past the technical evaluation. The other is the single thing that makes you the obvious choice for your niche, the thing you say first, loudest, and everywhere. When those lists get mixed, the homepage turns into an inventory and the buyer leaves without a reason to remember you. We wrote about the cost of that in the five-second homepage: you get seconds to land who you are for and why you are different, and table stakes never land it. ### Your next buyer might be a machine There is now a second audience for your positioning, and it is even less patient with vagueness than a CISO. When Deepak Gupta of Grakka joined our podcast to talk about answer engine optimization for cybersecurity, he described how security buyers actually use LLMs. They do not ask for a category. They describe a use case in context: a company of this size, a team of this shape, this specific problem, give me the top options. The engine returns three to five recommendations. “You are not getting 20, 30 links and you don’t want to waste your couple of hours doing research,” as he put it. Not twenty links to work through. Three to five names. Think about what that selection step does to generalist positioning. An LLM asked for the best option for a precisely described buyer is matching claims against context. The vendor that claims to serve everyone matches nothing precisely, and a vendor that matches nothing precisely does not make a three-name shortlist. Gupta is blunt about the alternative: “You cannot just say that I’m serving every single company, every single industry… You have to have a specific niche in mind.” The niche you feared was limiting is exactly what the machine needs to recommend you. His other warning matters here too: the website is still the front door, and if the messaging fails when a human clicks through, the recommendation is wasted. This is not a future problem. Different engines cite different sources today, and enterprise buyers are often already asking Copilot. We cover what this means for the most crowded category of the moment in how to stand out in agentic security. **Machine-readable positioning is narrow positioning. There is no generalist answer to a specific question.** ### Five steps to a category of one The method we use to turn all of this into a working value proposition has five steps, and the order matters. 1. **Choose the smallest commercially viable niche.** Small enough to dominate, large enough to sustain you. 1. **Name the big transformational result** that buyer wants. Early adopters do not buy incremental improvement from a startup; they buy the outcome no established vendor is offering them. 1. **Frame your product as the medicine.** The thing that gets them from the painful present to that result, described concretely. 1. **Build differentiation that makes comparison impossible.** The eliminate, reduce, raise, create work above. 1. **Set an offer whose price balances the value.** The formula that holds it together: we help X to achieve Y by doing Z, unlike everyone else. Every part of that sentence does work, and the last clause is the one founders skip. If “unlike everyone else” is empty, the rest is a commodity description with better grammar. The founders who resist this usually resist it because niching feels like settling for less. It is the opposite. A category of one is the largest position available to a company your size: one hundred percent of a market you define, instead of a rounding error of a market someone else owns. It is not about being better than everyone else. It is about being different by design. --- ## The five-second homepage URL: https://yaya.co/resources/the-five-second-homepage Published: 2026-06-09 Security buyers give a homepage about five seconds to answer one question: what does this product actually do? Abstract benefit lines fail that test. Lines that describe a concrete mechanism, what gets created, what it attaches to, what happens when it finishes, pass it. Be clear first. Be clever after. Key points: - The most common CISO reaction to startup homepages in our research is ‘I still don’t know what you do.’ - Buyers file you into a mental box against a category they already know; if they cannot place you, they leave. - Concrete mechanism lines beat abstract benefit lines in every live messaging test we have run. - ‘Platform’ and ‘governance layer’ are dead words because an incumbent already owns them. - Coining a category is allowed, but it is a multi-year commitment, not a launch-day trick. A CISO opens your homepage. A peer forwarded the link, or your name came up at a dinner, or a practitioner on their team flagged you. They did not arrive curious. They arrived busy, and they are giving you about five seconds to answer one question. What does this thing actually do? In our CISO research, the most common reaction to startup homepages was not an objection to the product or the price. It was a shrug: “I still don’t know what you do.” Senior security buyers read hero line after hero line and could not say what the product created, what it attached to, or what changed once it finished running. That shrug is the whole failure. Everything downstream of it, the demos you are not getting, the outbound that goes unanswered, the deck that dies in committee, starts here. ### The five seconds are real The attention budget is not a metaphor. Security buyers see more vendors in a year than most people see in a career, and almost none of those vendors arrive invited. When someone does land on your site, it is usually because a peer passed the link along, which means you are borrowing trust you have not yet earned. The forwarded link buys you a glance. It does not buy you a read. There is a second complication. The person on your homepage is often not the CISO at all. The real buyer frequently sits one level below, a practitioner who found you, liked what they saw, and will champion you upward if the story is easy to carry. Your homepage has to work for both readers at once: the practitioner who needs to repeat your pitch in a corridor, and the executive who will glance at it for five seconds before the corridor conversation happens. Five seconds, two audiences, one line. That is the brief. ### The mental box Security buyers do not read your homepage the way you wrote it. They scan it, looking for a place to file you. Is this a scanner? An identity product? Something on the endpoint? They hold a mental map of the categories they already know, and their first job is to place you on that map against something familiar. If they can place you, they stay long enough to hear why you are different. If they cannot, they leave. Not because they disagree with you. Because filing you was too much work, and they have a day job. This is why category clarity beats cleverness. A buyer who knows exactly which box you belong in will forgive an unexciting headline. A buyer who cannot find the box will not stay for the poetry. ### Why the poetic line fails Abstract, benefit-led hero lines fail live messaging tests. In the tests we have run, buyers picked the plain description over the clever one every time, including on the Aizome drafts where both CISO reviewers chose the concrete option unprompted. The reason is mechanical. Take a line in the shape of “Take control of your security posture” or “Confidence in every workload.” Read it cold and try to name the product behind it. You cannot, because the same sentence could sit above three unrelated products and be equally true of all of them. A line that could describe anything describes nothing. What succeeded in the same tests were lines that describe a concrete mechanism. What gets created. What it attaches to. What happens when it finishes. A buyer reading a mechanism can simulate the product in their head, place it in their stack, and start forming real questions. That is engagement. The poetic line produces the shrug. **If your hero line could be moved to a competitor’s site without anyone noticing, it is not a hero line. It is wallpaper.** ### Two dead words Two words surfaced in our research as instant category killers: “platform” and “governance layer.” Not because they are false. Because they are taken. An incumbent already says them, louder and with a bigger booth. When a startup leads with “platform,” the buyer hears one of two things: you are claiming a breadth you do not have, or you are a smaller version of something they already own. Neither reading helps you. One CISO after another told us these words carry no information anymore. They are not descriptions. They are camouflage, and camouflage is the opposite of what a five-second glance needs. The fix is not a cleverer abstraction. It is a descent into specifics. Say the thing your product does in words a practitioner could verify in the first minute of a demo. ### Coining a category is allowed, with a warning Some founders respond to the mental-box problem by building a new box. That is legitimate. Categories get coined, and some of the most valuable companies in security named the space they now own. It is also a commitment most teams underestimate. If you coin a category, you take on three jobs for years, not quarters. You have to define it, in one sentence a practitioner can repeat without you in the room. You have to differentiate it from the adjacent term, because every buyer’s first question will be how it differs from the thing it sounds like. And you have to market it consistently, in every asset, on every channel, until the market says it back to you. Half-committed category creation is the worst of both worlds: too novel to file, too underfunded to stick. If you are not ready to make it a multi-year effort, borrow an existing box and win on difference inside it. ### The articulation gap Here is the uncomfortable pattern behind all of this. Technical founders can explain their product for forty-five minutes, fluently, with diagrams, and still not have a story. Ask for the whiteboard session and you get brilliance. Ask for the one sentence and you get silence, or a committee-written line with the word “platform” in it. The hardest thing is always the words. Not the architecture, not the roadmap. The words. Founders assume that because they understand the product completely, the description will fall out naturally. It does not. Compression is a different skill from comprehension, and the homepage is the most compressed asset you own. ### The formula When you sit down to write the line, use this structure: we help X to achieve Y by doing Z, unlike everyone else. X is your smallest commercially viable niche, named plainly. Y is the big result the customer actually wants, not the feature you are proudest of. Z is the mechanism, the concrete thing your product does. And “unlike everyone else” forces you to state the difference that makes comparison hard, because when comparison is easy, the decision defaults to price, and undifferentiated products get commoditized. Most drafts fail at Z. Founders reach for the benefit again and the mechanism disappears. Hold yourself to physical description: what gets created, what it attaches to, what the reader could see working within a minute. You will not publish the formula verbatim, and you should not. It is scaffolding. But if you cannot fill it in, you do not have a copywriting problem. You have a positioning problem, and no headline will hide it. ### Clear first, clever after None of this is an argument for boring. Our Cult Products Awards report scored the 77 startups exhibiting at RSA’s Early Stage Expo and Next Stage, and the outliers who took creative risks read as more trustworthy, not less. Personality works. Boldness works. But it works on top of clarity, never instead of it. Wit in the subhead of a page that has already told me what you do is charm. Wit in place of telling me what you do is a bounce. Sequence the work: pass the five-second test with category, mechanism, and difference, then earn the personality. Two places to go next. If your homepage is clear but reads like a journal submission, the problem is register, and we measured it across the whole category in your website reads like an academic paper. And once buyers finally know what you do, the next failure is asking them to commit too soon, which is the subject of nobody wants to book your demo. --- ## Why every cybersecurity website looks the same (and what it costs you) URL: https://yaya.co/resources/why-every-cybersecurity-website-looks-the-same Published: 2026-06-02 Cybersecurity websites look alike because founders copy the category: almost 70% of the 77 startups we scored at RSA use blue as their primary color, and stock imagery fills the gaps. Sameness makes buyers forget you, forces comparison on price, and erodes margins. The outliers prove that taking visual risks can increase trustworthiness. Key points: - Almost 70% of the 77 cybersecurity startups we scored at RSA use blue as their primary brand color, and secondary colors barely widen the spectrum. - Buyers half-remember vendors days after meeting them, so a name that telegraphs your domain and a mark they can retrieve are functional assets, not vanity. - When buyers cannot tell vendors apart, the comparison defaults to price, and undifferentiated brands get commoditized. - The outliers in our research show that taking visual risks can increase trustworthiness rather than undermine it. - Cover your logo. If nobody could tell your website is yours, that is the problem to fix. Days after a conference, security buyers compare notes. Our CISO research keeps returning to the same scene: a peer dinner where someone half-remembers a vendor. The recollection is usually a fragment, a rough category and a color, and the color is usually blue. The vendor paid for the booth, the flights, and the demo stations. What survived the week was a guess. That matters because the security community is small and peer recommendation is how most real buying journeys start. A name that telegraphs your domain and a mark a buyer can retrieve at that dinner are functional assets. They are not vanity, and most startups do not have them. We know because we measured it. ### The category has a uniform For our Cult Products Awards report, we scored the 77 startups exhibiting at RSA’s Early Stage Expo and Next Stage. The most striking finding was the simplest one: almost 70% use blue as their primary brand color. The secondary colors barely widen the spectrum. If you want to look like everyone else, be blue. The rest of the visual grammar is just as standardized. Padlocks. Hoodie hackers. Matrix code and plexus lines. Gradients. Fingerprints. Purple, when a brand wants to feel edgy without leaving the pack. On our podcast with Kelly Allen and Sara Carty of the cybersecurity marketing agency Unboring, they described how the cycle sustains itself: a marketer under deadline pressure types “cybersecurity” into a stock library, gets a padlock, and ships it. “They’re going to go, oh yeah, everyone’s using a blog and a padlock, and okay, that can’t be a problem,” Allen said. “And it’s not going to break anything. Of course, it’s not. But it’s not going to make your brand stand out when it’s massively saturated.” Layer 77 of these websites on top of each other and you get one website. Blue, abstract, confident, and impossible to attribute to any single company. We feel strongly enough about this that we ban the tropes outright on client work. No purple, no plexus, no floating dashboards. Not because those things are ugly, but because they are ownerless. An asset every competitor can use is not a brand asset. It is wallpaper. ### Sameness feels safe, and that is the trap Nobody gets challenged for choosing blue. It reads as corporate, trustworthy, calm. Every individual decision in the brand process survives review precisely because it looks like what already exists. The trouble is that the sum of 77 defensible decisions is invisibility. There is a copycat version of the same trap. Justin Woody of Twine put it plainly on our podcast. “It’s so easy to fall into the trap. This is what you should do. This is the framework for success. This is what Wiz did, and you should always do what Wiz does. And pretty soon everybody’s doing exactly what Wiz is doing.” Copying the standout brand of the last cycle is how you guarantee you will not be the standout brand of this one. His own test is the one worth stealing: “What things should I do that makes the biggest impact, and what things shouldn’t we be doing that are just following the crowd?” The instinct behind all of it is understandable. Security buyers are conservative, so founders dress like the incumbents to borrow their credibility. But that logic contains a contradiction our webinar research kept running into. Mainstream giants like Palo Alto sell safety and scale to conservative buyers who want the market standard. A startup’s first buyers are early adopters, people specifically hunting for a big transformational result that nobody else offers. Dressing like the incumbent while selling to the early adopter is wearing the wrong uniform to the interview. The people who want what Palo Alto signals will buy Palo Alto. The people who want what you actually offer are scanning the expo floor for the thing that looks different, and you have made yourself invisible to them on purpose. ### What sameness actually costs The cost chain runs in one direction and it ends at your margins. First, you are forgotten. The peer-dinner finding is the mechanism: buyers hold a half-memory of you within days. When the budget conversation happens three months later, the vendors that get named are the ones that can be retrieved. You cannot be shortlisted from a memory that does not exist. And because the security community is small and runs on peer recommendation rather than cold outreach, the peer dinner is not a nice-to-have channel. For most early-stage vendors it is the channel. Second, you get compared on features. If a buyer cannot tell you apart from the two vendors next to you at the expo, the evaluation collapses into a spreadsheet, and spreadsheets are where differentiation goes to die. Third, the spreadsheet defaults to price. When comparison is easy, the cheapest credible option wins. **Undifferentiated brands get commoditized, and commoditization erodes margins for the rest of the company’s life.** That is the real bill for the safe blue website. It is not paid at launch. It is paid in every deal cycle afterwards. ### The outliers prove the opposite move works Our scoring surfaced three tiers. A small group of genuine outliers had a big idea executed well, with Token, Aim Security, and Reality Defender among the named examples. Below them sat a crowded middle: well executed, professional, and undifferentiated. And below that, a tier of clear underinvestment, where brilliant propositions look less premium and less trustworthy than they actually are. Two things stand out in that structure. The underinvested tier confirms that brand quality reads as a proxy for company quality; a weak brand actively misrepresents a strong product. A CISO evaluating an early-stage vendor cannot yet judge the product on a five-year track record, so every visible signal gets recruited as evidence, and a website that looks cheap testifies against engineering that is not. The outlier tier shows something most founders assume is false: **taking risks can increase trustworthiness.** The startups that broke category convention did not look frivolous. They looked like companies confident enough to be recognized. Twine is the public example we know best, because they briefed us directly: do not do the standard blue, tell us how to be bold. They banned the category tropes and stood out at the industry’s most crowded event. We helped both Twine and Geordie reach the RSA Innovation Sandbox final, with Geordie taking the win. Bold, in this market, is not the reckless option. Done with a business case behind it, it is the credible one. ### Cover your logo Here is the five-minute audit. Open your homepage. Cover your logo with your thumb. Now ask the honest question: could a buyer, a customer, or even your own team tell this website is yours and not one of the other 76? Run it properly. Do the same with your pitch deck, your booth graphics, your LinkedIn posts. Ask a friendly customer to try it, because your own team has stared at the brand too long to see it. In our experience most founders fail the test on the first pass, and the failure is useful. It converts a vague sense that marketing is underperforming into a specific, fixable diagnosis. If the answer is no, you have found the problem, and it is not your product, your roadmap, or your sales team. The same test applies to your words, by the way, because the convergence in tone of voice is just as severe as the convergence in color. We wrote about that separately in Security brands all sound the same too. Sameness is a decision, even when it is made by default. The startups that win the peer dinner made a different one. The full data on who they are and what they did is in our Cult Products Awards findings. --- ## Your website reads like an academic paper URL: https://yaya.co/resources/your-website-reads-like-an-academic-paper Published: 2026-05-26 We ran Flesch-Kincaid analysis on 72 of the 77 startups at RSA’s Early Stage Expo. The median site demands a postgraduate reading level. But buyers skim, scroll fast, and click through. Complexity is not credibility. Write one idea per section, translate jargon immediately, and put the argument in the headings. Key points: - The majority of the 77 startup websites we scored require a post-graduate reading level, as hard to read as an academic paper. - Behavioral research shows visitors skim and scroll at speed, more like flies trying to find a way out of a room than PhD students in a library. - In our CISO research, concrete plain descriptions beat abstract clever ones in every live messaging test. - Your homepage must survive being forwarded to a CFO who is not your audience. - Plain language is not dumbing down; it is one idea per section, jargon translated on arrival, and headings that carry the argument. Here is a test you can run on your own website in two minutes. Paste your homepage copy into any Flesch-Kincaid readability checker and look at the grade level it returns. If you are a cybersecurity startup, the odds are it will tell you that comfortably reading your marketing requires a post-graduate education. We know, because we measured the category. For our Cult Products Awards report we scored the 77 startups exhibiting at RSA’s Early Stage Expo and Next Stage, and as part of that work we ran Flesch-Kincaid grade-level analysis on the Home, About, Product, and Blog pages of 72 of them. The median site demands a postgraduate reading level. In plain terms, they are as hard to read as an academic paper. That would be defensible if visitors read websites the way examiners read papers. They do not. ### How people actually read your site Behavioral research on web reading, the accumulated evidence from screen recordings, eye tracking, and heatmaps, tells a consistent story. Visitors do not read. They skim. They scroll at speed, bounce between headings, sample the first words of a paragraph, and click through the moment something looks more promising. The line we used in the report is worth repeating because it reframes the whole problem: users behave much more like flies trying to find a way out of a room than PhD students in a library. Now put the two findings together. The category is writing for the PhD student. The visitor is the fly. A wall of dense, subordinate-clause prose does not slow a skimming reader down and make them concentrate. It bounces them to the next tab, where a competitor may have made understanding easier. ### Complexity is not credibility The dense prose is not an accident. It is a choice, driven by a belief that runs deep in technical founders: sounding sophisticated builds trust with a sophisticated audience. Write simply, the fear goes, and CISOs will assume the product is simple too. Our CISO research says the opposite. In the live messaging tests we have run with security buyers, concrete plain descriptions have beaten abstract clever ones every time. On the Aizome drafts, both reviewers independently preferred the concrete option and both bounced off the abstract one. The buyers doing the judging were exactly the audience the dense prose was written to impress: senior, technical, deeply experienced. They did not reward the complexity. They punished it. The explanation is not that security buyers cannot handle difficult text. They are among the most educated buyers in software. The explanation is that they are time-poor. A CISO evaluating vendors is skimming dozens of sites in stolen minutes between meetings. Prose that takes effort to decode is not a signal of depth in that context. It is a tax, and the reader declines to pay it. It is worth being honest about how the register happens, because nobody sets out to write an unreadable homepage. The copy starts closest to the product, drafted by the people who understand it best. Then it passes through review, and every reviewer who prizes precision adds a qualifier, a dependent clause, a term of art. Each edit is individually defensible. The sum is a paragraph only its authors can skim. The grade level is not a personality trait of your company. It is the residue of a process, which means a process can remove it. **Complexity is not credibility. Making a hard thing easy to understand is the credibility move, because it proves you understand it yourself.** ### The reader you forgot about There is a second reader your prose has to survive, and they never appear in your persona documents. Security buying is bottom-up. A practitioner discovers you and becomes the champion. The CISO gathers consensus and sponsors the spend. And then the link reaches someone in finance who does not know what your acronyms mean, does not care about your architecture, and holds a real vote. They will judge you on how quickly the page makes sense. Your website must survive being forwarded to someone who is not your audience. Post-graduate prose fails that test by definition. The champion who wants to advocate for you internally is handed a page they have to translate before they can share it, which means most of the time they simply do not share it. Plain language is not a concession to the least technical reader. It is the thing that lets your most technical reader sell you onward. ### How to fix it without dumbing down The objection arrives on schedule: our product is genuinely complex, and simplifying the language will misrepresent it. This confuses two different things. Dumbing down removes the substance. Plain language changes the delivery and keeps every bit of the substance. Here is what the second one looks like in practice. #### One idea per section Most dense pages are dense because they are trying to say four things at once. Give every section a single job. If a paragraph is carrying two ideas, it is two paragraphs. The reader skimming your page should be able to name what each section is about from its first line. #### Translate jargon the moment it appears You do not have to avoid technical terms. You have to pay for them on arrival. The first time a term of art appears, spend a clause saying what it means in ordinary words. Experts skip past the translation at no cost. Everyone else stays in the room. The pages that lose readers are the ones that spend that trust nowhere and assume the vocabulary is shared. #### Short declaratives Long sentences are where readability goes to die, because grade-level scores are largely a function of sentence length and word length. Cut the qualifiers. Break the compound sentences. Say the thing, stop, then say the next thing. It feels blunt when you write it. It reads as confident when they skim it. #### Write for the skim first Since the visitor behaves like the fly and not the scholar, design for the fly. Put the argument in the headings, so that reading only the headings delivers the whole case. Front-load the first sentence of every paragraph. Then layer the depth underneath, in the diagrams, the docs, the technical blog, for the minority who slow down. You are not choosing between skimmers and readers. You are sequencing them. ### Depth belongs one click deeper None of this argues against technical depth. Depth is where security credibility lives, and the startups that publish real research and real opinions earn inbound that no advertising buys. The argument is about placement. The homepage is not the venue for your hardest prose. It is the venue for the clearest sentence you can write, with the depth one click away for the reader who has decided to care. The sequence matters, too. Readability is the second problem. The first is that the visitor cannot tell what you do at all, which no amount of simplification fixes if the underlying line is abstract. That failure, and the concrete-mechanism fix for it, is the subject of the five-second homepage. And if you want the readability finding in context, alongside what we found about color, tone, and the three tiers the category splits into, the full study is in our Cult Products Awards report. Your buyers are clever. That was never the question. They are also busy, skeptical, and gone in seconds. Write for the fly, keep the library one click away, and both readers get what they came for. --- ## The best cybersecurity websites, scored URL: https://yaya.co/resources/best-cybersecurity-websites Published: 2025-05-12 The highest-scoring cybersecurity websites on brand differentiation in our RSA 2025 analysis were Prelude Research, Token, Seal Security, Aim Security, Reality Defender, CovertSwarm and Cygence. Most lead with a color other than blue, write below the cohort median reading grade, and offer value before asking for contact details. Key points: - Five of the seven highest-scoring brands lead with a colour other than blue, in a cohort where more than 70% do not. - The top brand in the cohort writes at reading grade 12.2 against a median of 16.2. - Five of the seven give something of value before asking for contact details; only 42% of the full cohort does. - A high brand score measures whether the story is legible and distinct, not whether the product is good. - The bottom half is consistently blue, informative, post-graduate reading level, with a demo form as the only call to action. ### How these were chosen These are not favorites. For the Cult Products Awards we scored all 77 startups exhibiting at RSA 2025 across proposition, brand and marketing, using the same rubric for every company. This list ranks on one dimension of that score, brand differentiation, rather than on the overall total. That is why the order here is not the order of the overall table in the report. Two things worth stating before the list. Scores are relative to a single cohort at a single moment, so a company that has since rebranded may deserve a different one. And a high brand score is not a verdict on the product. It measures whether the story is legible and distinct, which is a different question from whether the technology is good. ### The list #### 1. Prelude Research The highest brand differentiation score in the cohort, and the clearest evidence that plain language is a competitive weapon. Prelude writes at a reading grade of 12.2 against a cohort median of 16.2, which is the difference between a site a security engineer skims comfortably and one that reads like an academic paper. Pink as the primary color in a field where almost 70% lead with blue is the other half of it. #### 2. Token, 89 Token took the overall Cult Products Award, and the brand is why. Green in a blue category, a wordmark that does not hedge, and a proposition about hardware-backed identity that survives being said out loud. Token also offers something of value before asking for contact details, which only 42% of the cohort does. #### 3. Seal Security, 82 The best argument in the cohort that you can stay blue and still be distinct, which matters because most companies will not change color. Seal wins on register instead: an authoritative tone where almost everyone else is merely informative, and copy that states a position rather than listing capabilities. #### 4. Aim Security, 80 Orange, and confident about it. Aim was one of the three brands that scored highest overall in the report, and it is the clearest case of a company using color to signal that it is not another entrant in a crowded AI security field. The site also gives value before the form, which is rarer than it should be. #### 5. Reality Defender, 78 Green, authoritative, and unusually specific about what it detects. Deepfake detection is a category where hype is the default register, and Reality Defender writes as though it expects to be checked. In a market this skeptical, sounding checkable is a differentiator. #### 6. CovertSwarm, 76 The most committed brand idea in the cohort. The swarm metaphor runs through the name, the identity and the service model rather than sitting on the homepage as decoration, which is what separates a brand idea from a tagline. #### 7. Cygence, 73 Blue, but doing more with it than most. Authoritative tone, restrained typography, and a homepage that answers what the company does before it explains why the category matters. That ordering is more unusual than it sounds. ### What the top of the list has in common Five of the seven use a primary color other than blue, against a cohort where almost 70% lead with blue. Four write below the cohort median reading grade. Five give something of value before asking for contact details. None of those is a design decision in isolation; together they describe a company that has decided who it is for and is willing to be less appealing to everyone else. The pattern in the bottom half is the inverse and it is remarkably consistent: blue, informative, post-graduate reading level, demo form as the only call to action. Every individual choice there is defensible. The sum is a category where buyers cannot tell anyone apart and default to comparing on price. --- ## We scored the 77 cybersecurity startups exhibiting at RSA. Here is what we found. URL: https://yaya.co/resources/cult-products-awards-what-we-found Published: 2025-05-06 We scored all 77 cybersecurity startups exhibiting at RSA’s Early Stage Expo and Next Stage against the three Cult Products pillars. Three tiers emerged: a few genuine outliers, a crowded well-executed middle, and clear underinvestment. Almost 70% use blue, nearly all sound identical, and most copy reads at a post-graduate level. Key points: - Token (73 points), Aim Security (69), and Seal Security (69) topped the scoring; the outliers shared a big idea executed well, not a bigger budget. - Almost 70% of the 77 startups use blue as their primary brand color, and secondary colors barely widen the spectrum. - Nearly all 77 write in the same technical, professional, informative register; Wiz remains the category’s clearest counter-example. - Most sites demand a post-graduate reading level while real visitors behave like flies trying to find a way out of a room. - Marketing effort concentrates on the small minority ready to buy now; only 42% offer a genuine value exchange before asking for anything. Every founder exhibiting at RSA believes their startup stands out. The economics of the event depend on it: the booth, the travel, the demo stations, the week of the team’s time. So we decided to test the belief with a scoring system instead of an opinion. For our Cult Products Awards report, we scored all 77 startups exhibiting at RSA’s Early Stage Expo and Next Stage. This article is the summary. The full report carries the detailed scores and breakdowns, and it goes further than we can here. ### How we scored Judges assessed every startup against the three Cult Products pillars. **Revolutionary Vision** covers the strategy layer: how narrow and well-chosen the niche is, how real the differentiation is, and whether the company communicates from the customer’s problem rather than its own feature list. **Radical Story** covers the brand layer: the quality of the visual identity, the avoidance of category tropes, and the tone of voice. **Fanatical Followers** covers the audience layer: SEO, digital advertising, and how well the company builds a relationship with buyers who are not ready to purchase yet. The three pillars matter because they force the assessment beyond aesthetics. A beautiful identity wrapped around an undifferentiated proposition scores poorly on Revolutionary Vision. A sharp niche with a generic brand scores poorly on Radical Story. A strong company invisible to buyers who are still researching scores poorly on Fanatical Followers. Same pillars, same judges, all 77 companies. Here is what came out. ### Three tiers, not a spectrum We expected a smooth distribution. We got three distinct tiers. At the top, a handful of genuine outliers. Token led the scoring with 73 points, with Aim Security and Seal Security close behind on 69 apiece, and Reality Defender also among the named standouts. What the outliers share is not budget. It is **a big idea executed well**, consistently, across identity, messaging, and digital presence. In the middle, the largest group: well-executed and undifferentiated. These are professional brands built by competent people, and almost nothing distinguishes one from the next. This is the crowded tier, and it is crowded precisely because it is where the safe decisions lead. At the bottom, clear underinvestment. This tier worried us most, because several of these companies have brilliant propositions that look less premium and less trustworthy than they actually are. The product is ahead of the brand, and the brand is taxing the product. One more thing the top tier proves: the outliers took risks, and the risks made them look more credible, not less. Taking risks can increase trustworthiness. The middle tier’s caution is not buying the safety it thinks it is. ### A sea of blue The color data is the finding people quote back to us. Almost 70% of the 77 startups use blue as their primary brand color. The secondary colors barely widen the spectrum. If you want to look like everyone else, be blue. We have written separately about why the category converged on one visual grammar and what it costs. The short version: buyers half-remember vendors within days, sameness makes retrieval impossible, and a vendor who cannot be told apart gets compared on price. ### Seventy-seven companies, one voice The convergence is not only visual. Scoring tone of voice across all 77, we found nearly every company writing in the same register: highly technical, professional, informative. Very few distinct personalities. Read ten of these homepages aloud and you cannot tell where one company ends and the next begins. The public counter-example is Wiz. Touches of personality, including lines like “Shift happens,” sit alongside bold, Apple-like copy. The result is credible and characterful at the same time, which most of the category assumes is impossible. We explore the voice problem, and the archetype method for solving it, in Security brands all sound the same too. ### Written for professors, read by flies We ran Flesch-Kincaid grade-level analysis on each startup’s Home, About, Product, and Blog pages. The majority of sites require a post-graduate reading level. As hard to read as an academic paper. Now put that against how people actually use websites. Behavioral research using screen recordings, eye tracking, and heatmaps shows visitors skimming, scrolling fast, and clicking through. As our report put it, users behave much more like flies trying to find a way out of a room than PhD students in a library. That mismatch is a conversion problem hiding in plain sight. The buyer is technical, but the buyer is also busy, and dense prose does not read as intelligence. It reads as work. We unpack this finding in Your website reads like an academic paper. ### Built on rented ground On the technology layer, the category has standardized too. Most of the 77 sites are built on Webflow, with WordPress second, and HubSpot dominating the marketing stack. Whatever you think of any individual tool, the pattern is the point: an industry that sells control and ownership has largely built its own front doors on rented, closed platforms. ### Marketing aimed at the people who need it least The advertising and audience data told a consistent story. Just over half of the startups run paid ads at all. Among those that do, LinkedIn dominates by a distance, while Meta and Google sit largely untapped. More telling is where the effort points. At any moment, only a small minority of your market is ready to buy now. The much larger group knows the problem, or is starting to feel it, and is nowhere near a purchase. Yet most of the activity we scored aims squarely at the ready-to-buy-now group, pushing demo bookings at people who have not yet decided they trust you. That means 77 companies are competing for the same sliver of the market while the majority of future buyers hear from almost nobody. The startup that helps those buyers while they are still learning gets to define the problem on its own terms, months before any competitor shows up with a booking link. And the giving side is thin. Only 42% of the startups offer a genuine value exchange, something a buyer would actually want in return for their attention or details. The rest ask before they give. In a market where buyers are professionally suspicious, that ordering is backward. **Give value before you ask, because the buyers you help before they are ready are the ones who remember you when they are.** ### What the outliers teach everyone else Strip the scores away and the lesson from the top tier is simple. Token, Aim Security and Seal Security did not out-spend the middle tier. They chose one big idea, committed to it, and executed it well everywhere a buyer might look. The differentiation is designed, not bought. The encouraging part of this research is that the bar is low. When 70% of your competitors are blue, when nearly all of them sound identical, and when most of their websites read like journal submissions, standing out does not require genius. It requires a decision most of the category refuses to make. The full Cult Products Awards report contains the complete scoring, the pillar-by-pillar breakdowns, and more detail on every finding summarized here. --- # Pages ## AI visibility URL: https://yaya.co/glossary/ai-visibility AI visibility is how often, and how favorably, a brand appears in the answers AI assistants give. It replaces rank as the metric when a buyer asks a model for a shortlist rather than reading a page of links. Measuring it means running the buyer’s real prompts across the engines the buyer actually uses. --- ## About URL: https://yaya.co/about Yaya is a brand and website studio founded in 2019, working only with cybersecurity companies. Both founders work on every project. Clients include Twine, Aryon, Geordie, Zest, Kusari, Tenet and Aizome. --- ## Answer engine optimization URL: https://yaya.co/what-we-do/aeo Answer engine optimization (AEO) is the practice of making a company legible and quotable to AI answer engines so it is named when a buyer asks for a recommendation. Yaya builds it into the brand and website from the first commit for cybersecurity companies, covering positioning, machine-readable structure, structured data, llms.txt and the sources models cite. --- ## Answer engine optimization (AEO) URL: https://yaya.co/glossary/answer-engine-optimization Answer engine optimization (AEO) is the practice of making a company legible and quotable to AI answer engines so it is named when a buyer asks for a recommendation. It covers positioning, machine-readable site structure, structured data and presence in cited sources. Positioning, not markup, decides most of it. --- ## Book a meeting URL: https://yaya.co/book-a-meeting Book a call with Yaya’s founders to discuss positioning, brand, website and launch timing for a cybersecurity company. --- ## Brand architecture URL: https://yaya.co/glossary/brand-architecture Brand architecture is how the names in a company relate to each other: the parent brand, the products, and any sub-brands. For a security startup it usually answers whether a new capability is a feature, a product, or a company. A named product earns its name when it can be bought, sold, or asked for separately. --- ## Brand guideline URL: https://yaya.co/glossary/brand-guideline Brand guidelines are the documented standards for how a brand’s visual identity, voice and messaging are applied. They are decision memory that prevents each project from starting from guesswork, keeping a brand coherent as it grows. --- ## Brand narrative URL: https://yaya.co/glossary/brand-narrative A brand narrative is the story that explains why a company exists and why a buyer should believe its claims. It is the connective tissue between insight and brand identity, turning positioning from assertion into belief. --- ## Brand positioning URL: https://yaya.co/glossary/brand-positioning Brand positioning is the place a company deliberately occupies in a buyer’s mind relative to alternatives: who it is for, what it removes, and what it will not claim. It is a decision about what to give up rather than a statement of ambition. The test is whether a competitor could claim the same position without changing a word. --- ## Branding URL: https://yaya.co/what-we-do/branding Yaya builds cybersecurity brands: niche and positioning, messaging, naming, tone of voice and visual identity. The method is the Cult Products Framework, whose three pillars are Revolutionary Vision, Radical Story and Fanatical Followers. --- ## ChatGPT SEO URL: https://yaya.co/glossary/chatgpt-seo ChatGPT SEO is optimization to be cited by ChatGPT specifically, distinct from broader answer engine optimization targeting all AI systems. Because ChatGPT dominates business queries, being cited in its answers matters as much as ranking in search results. --- ## Contact URL: https://yaya.co/contact Contact Yaya about a cybersecurity brand or website project. Enquiries reach the founders directly. --- ## Cookie Policy URL: https://yaya.co/cookie-policy Every cookie yaya.co can set, named, with its owner and duration. One consent cookie, one analytics vendor, no advertising, no session replay. --- ## Cybersecurity branding agency in Tel Aviv URL: https://yaya.co/cybersecurity-branding-agency-tel-aviv Yaya builds brands and websites for Israeli cybersecurity startups. The team is in London and works the Tel Aviv to US corridor: positioning validated with the American buyers the company is actually selling to, then brand and website built to carry a launch. --- ## Events URL: https://yaya.co/events Yaya attends RSA Conference, Black Hat USA and the Gartner Identity and Access Management Summit. This page lists those events with notes from each, and explains how the cybersecurity conference calendar shapes launch timing. --- ## For investors URL: https://yaya.co/for-investors Specialist cybersecurity funds refer Yaya across their portfolios. One team, end to end, in ten to twelve weeks, with a process that manages the founder. --- ## Generative engine optimization (GEO) URL: https://yaya.co/glossary/generative-engine-optimization Generative engine optimization (GEO) is answer engine optimization aimed specifically at generative results such as AI Overviews and chat assistants. In practice the terms are interchangeable and the work is the same. It differs from classical SEO in target and measurement: citation rather than rank. --- ## Glossary URL: https://yaya.co/glossary A glossary of brand strategy, positioning and answer engine optimization terms as Yaya uses them, written for cybersecurity founders and marketing leaders. Each entry leads with a direct definition and states a position rather than repeating a dictionary. --- ## Home URL: https://yaya.co/home Yaya is a brand and website studio working only with cybersecurity startups. It builds positioning, messaging, visual identity and agent-native websites using the Cult Products Framework, and the two founders deliver the work themselves. --- ## How to rank in ChatGPT URL: https://yaya.co/glossary/how-to-rank-in-chatgpt To rank in ChatGPT means to be selected and cited as a source when a buyer asks a related question. Unlike search ranking, there is no visible position; the model selects sources based on domain authority, topical relevance, and how strongly the domain is associated with the topic. --- ## LLM SEO URL: https://yaya.co/glossary/llm-seo LLM SEO is a loose term for optimizing to be cited by large language models rather than ranked by a search engine. Answer engine optimization is the more precise name for the same work. It does not replace search: buyers still search and organic links still convert, but a generated answer now sits above them on most commercial queries. --- ## Modern Slavery Statement URL: https://yaya.co/modern-slavery Yaya Digital’s voluntary modern slavery statement. We sit below the Section 54 threshold and publish anyway, with the real risk named and what we check. --- ## Our Work URL: https://yaya.co/our-work Yaya’s case studies cover brand strategy, messaging, visual identity and agent-native websites for cybersecurity companies including Geordie, Twine, Aryon, Zest, Aizome, Tenet, Kusari, Hypernative, EveryCloud, BastionZero. Two clients reached the RSA Innovation Sandbox final and Geordie won it in 2026. --- ## Pricing URL: https://yaya.co/pricing Yaya does not publish prices. Work is delivered as the Cult Products Programme, in two shapes: the Cult Products Sprint and the Cult Products Classic. Every project is a fixed fee quoted against scope and agreed before work starts, payable up front or across a payment plan, with a percentage of the fee placed at risk against agreed outcomes. Engagements typically run twelve weeks. --- ## Privacy Policy URL: https://yaya.co/privacy-policy What Yaya collects on yaya.co, which processors see it, how long we keep it, and how to make us stop. Written from the site’s actual configuration. --- ## Rebranding URL: https://yaya.co/glossary/rebranding Rebranding is changing how a company presents itself through some combination of name, positioning, identity and messaging. In cybersecurity it is usually triggered by a pivot, a funding round, or a proposition that has outgrown the original brand. Cost is driven by how much remains undecided rather than how much has to be designed. --- ## Terms and Conditions URL: https://yaya.co/terms-and-conditions Terms covering yaya.co use. No account creation, no software licensing. Client work is governed by a separate agreement. --- ## Webinar URL: https://yaya.co/resources/webinar A free on-demand training for cybersecurity founders on selling to enterprise CISOs: why buyers avoid vendor conversations, and how proposition, brand and website change that. --- ## Website URL: https://yaya.co/what-we-do/website Yaya designs and builds websites for cybersecurity companies on React and a Sanity headless CMS, delivered as a codebase the client owns. Sites are agent-native: editable by AI agents over MCP and structured to be cited by answer engines. --- ## What We Do URL: https://yaya.co/what-we-do Yaya’s services span positioning and messaging, brand identity, and website design and build, delivered as the Cult Products Programme in two shapes: the Cult Products Sprint and the Cult Products Classic. The work is sold only to cybersecurity companies. --- ## llms.txt URL: https://yaya.co/glossary/llms-txt llms.txt is a plain-text file at the root of a site that tells AI crawlers what the site is and points them at the pages that matter. It is a convention rather than a standard. A generated stub is worse than none. A useful one names who you serve, what you do, what you will not take on, and the pages that answer real questions. --- # Case studies - [Aryon](https://yaya.co/our-work/aryon): Yaya took Aryon from stealth to launch in 2025 with a brand and website built around prevention rather than detection. Aryon has since raised a Series A. - [Geordie](https://yaya.co/our-work/geordie): Yaya built the brand and website for Geordie from inception in 2025, working with founders from Darktrace and Snyk. Geordie won the RSAC 2026 Innovation Sandbox a year later. - [Twine](https://yaya.co/our-work/twine): Yaya partnered with the ex-Claroty founders from inception in 2024 to brand and launch Twine, which builds AI digital employees for security teams. Twine reached the RSAC 2025 Innovation Sandbox final. - [Zest](https://yaya.co/our-work/zest): Yaya branded and launched ZEST Security out of stealth in 2024, then rebuilt the story for a relaunch timed to Black Hat. TechCrunch named ZEST one of the top cybersecurity startups of Disrupt 2025.