Security brands all sound the same too

The visual sameness of cybersecurity gets all the attention. The sea of blue, the padlocks, the plexus lines. It is easy to mock and easy to measure, and we measured it: almost 70% of the 77 startups we scored at RSA for our Cult Products Awards report use blue as their primary color. We covered what that visual convergence costs separately.

But run a different test. Strip the logos and colors away entirely. Take the words alone from ten security startup homepages and read them aloud. Could you tell which company is speaking at any point? Could you tell where one ends and the next begins?

Our research says no, and that gap is an opportunity hiding in plain sight.

Seventy-seven companies, one register#

Scoring tone of voice was part of the Radical Story pillar in our report, and the finding was blunt: nearly all 77 startups write in the same highly technical, professional, informative register. Very few distinct personalities anywhere on the expo floor.

Each company arrived at that voice for a defensible reason. The buyer is technical, so the copy is technical. The purchase is serious, so the tone is serious. The market punishes hype, so the register is flat. Every step of that logic is sound, and the collective result is a category where the words do no differentiating work at all. When everyone signals expertise the same way, expertise stops being a signal.

Founders will spend six figures on a visual identity and then hand the words to whoever is free that week. The report's data says the words are exactly as converged as the colors, which means voice is one of the cheapest untapped differentiators in the category.

The Wiz exception#

One company keeps coming up as the counter-example, and our report named it: Wiz. Touches of personality, including lines like "Shift happens," sit alongside bold, Apple-like copy. The result is credible and characterful at the same time.

That combination matters more than the humor itself. The category assumes a trade-off: you can be taken seriously or you can be interesting, pick one. Wiz demonstrates the trade-off is imaginary. Its personality does not undercut the engineering credibility; it frames it. A company confident enough to be playful about a serious subject reads as a company that knows exactly what it is doing.

The wrong lesson is to copy Wiz's jokes. "You've got to zag," Kelly Allen said on our podcast with Sara Carty of Unboring. "Copying someone doesn't help. Actually, copying competition doesn't help." You cannot be Wiz; what you can learn from them is brand. The lesson is that a distinct voice is available in this market, and almost nobody is claiming one.

Why everyone defaults to the Sage#

There is a reason the register converged, and it is not laziness. In archetype terms, cybersecurity gravitates naturally to the Sage: the expert, the analyst, the measured voice of knowledge. Trust is the currency of this industry, and the Sage is the archetype of trust.

The mistake is stopping there. A pure Sage voice is indistinguishable from 76 other pure Sage voices. The interesting work is pairing Sage trust with something bolder. In our archetype method, a brand voice is not one archetype but a weighted cocktail of about three, and the weighting is where the personality lives. The Sage stays in the mix, because the credibility is non-negotiable. What changes is what you blend it with, and the blend comes from your positioning: what you alone can say, said in a way only you would say it.

We have watched this work in practice. Hanah-Marie Darley and Henry Comfort of Geordie described on our podcast how the archetype exercise moved their messaging away from fear-led security talk toward Caregiver-led empowerment. It is a voice that matches what their buyers actually want. "Most of the security leaders that we talk to want to innovate. They want to say yes to the business," Comfort said. "But they're trying to be responsible. They're trying to be practical." The archetype did not decorate the strategy. It was the strategy, expressed in words.

That is the core discipline. Voice is not a copywriting flourish applied at the end. It is a strategic choice derived from positioning and archetypes, made once, and then spent everywhere the company speaks.

Competent is not the same as memorable#

Most cybersecurity copy is professionally written, expensively produced, and gone from the buyer's head before the tab closes. It is not bad. It is the verbal equivalent of a film score that does exactly what you expect and nothing more, which is a thing you never hum afterwards. We take that test seriously enough to run it in creative reviews, and it is set out in full in how bold is too bold.

The difference is not quality. It is distinctiveness. We put it this way: Marmite, not butter. Everyone eats butter and nobody talks about it. Some people hating your voice is the price of anyone remembering it. If you get no reaction, you are forgotten, and forgotten is the most expensive thing a startup brand can be. A voice that provokes nothing, risks nothing, and sounds like the category average is not a neutral asset. It is a silent one.

The boldness ceiling#

Bold has a limit, and the limit is practical rather than aesthetic. Our CISO research defines it precisely.

There is a real ceiling on this, and it is commercial rather than aesthetic. Deliberately irreverent brands can create measurable go-to-market drag, to the point where a buyer who likes you still cannot carry you into their own building. We set out the evidence and the ceiling in how bold is too bold.

Because security buying is a consensus sport, your website will be read by people who are not your audience, and it has to survive being forwarded to finance. So the test for any voice decision is this: can your champion forward your site to a finance stakeholder without wincing? Character that survives that forward is an asset. Character that does not is drag.

There is a second constraint from the same research: playfulness imposed on researcher-founders reads as fake. If the founding team is a pair of serious ex-agency researchers, a wisecracking brand voice will crack the first time a buyer meets them on a call. The voice has to be an amplified version of who the team actually is, not a costume. Where the ceiling sits for your specific brand is its own question, and we treat it fully in How bold is too bold.

Voice is a positioning decision#

Pull the threads together and the takeaway is uncomfortable for anyone hoping to fix this with a better copywriter. The words on your website converged for the same reason the colors did: nobody treated them as a strategic surface. A distinct voice is not written, it is decided. It starts from positioning, takes shape as a weighted blend of archetypes with the Sage as the base note, gets stress-tested against the forwardability ceiling, and only then gets written down.

Do that work and every sentence the company publishes becomes a differentiator that costs nothing extra to deploy. Skip it and you will sound like the other 76, no matter how good the writing is.