We scored the 77 cybersecurity startups exhibiting at RSA. Here is what we found.

Every founder exhibiting at RSA believes their startup stands out. The economics of the event depend on it: the booth, the travel, the demo stations, the week of the team's time. So we decided to test the belief with a scoring system instead of an opinion.

For our Cult Products Awards report, we scored all 77 startups exhibiting at RSA's Early Stage Expo and Next Stage. This article is the summary. The full report carries the detailed scores and breakdowns, and it goes further than we can here.

How we scored#

Judges assessed every startup against the three Cult Products pillars.

Revolutionary Vision covers the strategy layer: how narrow and well-chosen the niche is, how real the differentiation is, and whether the company communicates from the customer's problem rather than its own feature list.

Radical Story covers the brand layer: the quality of the visual identity, the avoidance of category tropes, and the tone of voice.

Fanatical Followers covers the audience layer: SEO, digital advertising, and how well the company builds a relationship with buyers who are not ready to purchase yet.

The three pillars matter because they force the assessment beyond aesthetics. A beautiful identity wrapped around an undifferentiated proposition scores poorly on Revolutionary Vision. A sharp niche with a generic brand scores poorly on Radical Story. A strong company invisible to buyers who are still researching scores poorly on Fanatical Followers. Same pillars, same judges, all 77 companies. Here is what came out.

Three tiers, not a spectrum#

We expected a smooth distribution. We got three distinct tiers.

At the top, a handful of genuine outliers. Token led the scoring with 73 points, with Aim Security and Seal Security close behind on 69 apiece, and Reality Defender also among the named standouts. What the outliers share is not budget. It is a big idea executed well, consistently, across identity, messaging, and digital presence.

In the middle, the largest group: well-executed and undifferentiated. These are professional brands built by competent people, and almost nothing distinguishes one from the next. This is the crowded tier, and it is crowded precisely because it is where the safe decisions lead.

At the bottom, clear underinvestment. This tier worried us most, because several of these companies have brilliant propositions that look less premium and less trustworthy than they actually are. The product is ahead of the brand, and the brand is taxing the product.

One more thing the top tier proves: the outliers took risks, and the risks made them look more credible, not less. Taking risks can increase trustworthiness. The middle tier's caution is not buying the safety it thinks it is.

A sea of blue#

The color data is the finding people quote back to us. Almost 70% of the 77 startups use blue as their primary brand color. The secondary colors barely widen the spectrum. If you want to look like everyone else, be blue.

We have written separately about why the category converged on one visual grammar and what it costs. The short version: buyers half-remember vendors within days, sameness makes retrieval impossible, and a vendor who cannot be told apart gets compared on price.

Seventy-seven companies, one voice#

The convergence is not only visual. Scoring tone of voice across all 77, we found nearly every company writing in the same register: highly technical, professional, informative. Very few distinct personalities. Read ten of these homepages aloud and you cannot tell where one company ends and the next begins.

The public counter-example is Wiz. Touches of personality, including lines like "Shift happens," sit alongside bold, Apple-like copy. The result is credible and characterful at the same time, which most of the category assumes is impossible. We explore the voice problem, and the archetype method for solving it, in Security brands all sound the same too.

Written for professors, read by flies#

We ran Flesch-Kincaid grade-level analysis on each startup's Home, About, Product, and Blog pages. The majority of sites require a post-graduate reading level. As hard to read as an academic paper.

Now put that against how people actually use websites. Behavioral research using screen recordings, eye tracking, and heatmaps shows visitors skimming, scrolling fast, and clicking through. As our report put it, users behave much more like flies trying to find a way out of a room than PhD students in a library.

That mismatch is a conversion problem hiding in plain sight. The buyer is technical, but the buyer is also busy, and dense prose does not read as intelligence. It reads as work. We unpack this finding in Your website reads like an academic paper.

Built on rented ground#

On the technology layer, the category has standardized too. Most of the 77 sites are built on Webflow, with WordPress second, and HubSpot dominating the marketing stack. Whatever you think of any individual tool, the pattern is the point: an industry that sells control and ownership has largely built its own front doors on rented, closed platforms.

Marketing aimed at the people who need it least#

The advertising and audience data told a consistent story. Just over half of the startups run paid ads at all. Among those that do, LinkedIn dominates by a distance, while Meta and Google sit largely untapped.

More telling is where the effort points. At any moment, only a small minority of your market is ready to buy now. The much larger group knows the problem, or is starting to feel it, and is nowhere near a purchase. Yet most of the activity we scored aims squarely at the ready-to-buy-now group, pushing demo bookings at people who have not yet decided they trust you. That means 77 companies are competing for the same sliver of the market while the majority of future buyers hear from almost nobody. The startup that helps those buyers while they are still learning gets to define the problem on its own terms, months before any competitor shows up with a booking link.

And the giving side is thin. Only 42% of the startups offer a genuine value exchange, something a buyer would actually want in return for their attention or details. The rest ask before they give. In a market where buyers are professionally suspicious, that ordering is backward. Give value before you ask, because the buyers you help before they are ready are the ones who remember you when they are.

What the outliers teach everyone else#

Strip the scores away and the lesson from the top tier is simple. Token, Aim Security and Seal Security did not out-spend the middle tier. They chose one big idea, committed to it, and executed it well everywhere a buyer might look. The differentiation is designed, not bought.

The encouraging part of this research is that the bar is low. When 70% of your competitors are blue, when nearly all of them sound identical, and when most of their websites read like journal submissions, standing out does not require genius. It requires a decision most of the category refuses to make.

The full Cult Products Awards report contains the complete scoring, the pillar-by-pillar breakdowns, and more detail on every finding summarized here.