Black Hat USA: Why cybersecurity brands need to stop playing defence

A Las Vegas casino probably isn't the first place you'd naturally expect to find the best and brightest of the cybersecurity industry. Yet every year at Black Hat, thousands of security professionals descend upon Sin City to gather beside rows of slot machines and giant sportsbook screens inside Mandalay Bay Hotel and Casino. It's a fitting backdrop. Everything about the environment feels high-stakes.

‍

There's an interesting parallel between gambling and cybersecurity. In a casino, everyone knows the house always wins. In cyber, the equivalent mantra is “it's not if, but when”. Breaches are treated as a statistical inevitability, and that mindset has shaped how security companies communicate for years. When an industry believes it is fundamentally fighting a battle it can’t fully win, its messaging naturally becomes defensive. Instead of taking a clear, confident position, brands tend to lean on technical claims, incremental product updates, and risk-averse messaging. Babel’s opinion? Playing it safe is probably the riskiest move you can make.

‍

Refreshingly, the opening sessions at Black Hat seemed to align with our way of thinking.

‍

From playing defence to setting the pace

‍

Speaking about cyber power in the age of AI, the US National Cyber Director, Sean Cairncross, summed up the choice facing the industry with a simple phrase: “you're either on your heels or on your toes”.

‍

The message was clear. Rather than waiting to respond to attacks, the US government is shifting towards actively shaping adversary behaviour through deterrence. Attackers need to know their actions carry consequences. They’ve moved from a reactionary position to an active, bold and confident stance.

‍

Cybersecurity vendors call for action over reaction, yet often find themselves on the back foot when it comes to standing out from the industry noise. If even government bodies, which can be notoriously slow-moving, are changing their posture, should security brands still be communicating as if they're permanently on the back foot?

‍

The real risk is sounding like everyone else

‍

Walking the show floor, one thing quickly becomes obvious: everyone is saying roughly the same thing. You can take your pick of brands and you’ll hear something along the lines of ‘powered by artificial intelligence’, ‘engineered by agentic AI’, or ‘autonomous security’. Almost every stand promises faster detection, smarter automation or more efficient operations. The terminology changes slightly, but the stories rarely do. The result is a sea of technically competent brands that are increasingly difficult to tell apart. In this ‘sea of same’ there are no winners.

‍

That's also a symptom of an over-reliance on performance marketing. Most campaigns focus on the small percentage (5%) of buyers actively evaluating vendors today, while doing little to build familiarity with the much larger audience (95%) that won't be buying for months or maybe even years to come. A great way to rapidly run your pipeline down to zero. 

‍

The brands that do stand out aren't necessarily the ones making the boldest claims. They're the ones with a distinctive point of view and a story people remember. Emotion sells because, until machines actually take over decision-making, buyers are still human, and 87% of them still buy from brands they're familiar with, according to babel's latest research - The Mental Av-AI-lability Index. So, marketing to the 95%, and building familiarity and human connection for the long term is vital to brand success. 

‍

Where “Brave” fits in

‍

At Babel, we often talk about the importance of bravery in PR and marketing.

‍

For us, being brave isn't about creating controversy or chasing attention. It's about having the confidence to take a clear position, tell a memorable story and build a brand that stays front of mind long before someone enters a buying cycle.

‍

That doesn't mean abandoning performance marketing or technical credibility. Both matter. But they're most effective when they're supported by a strong brand that buyers already know, trust and recognise.

In practice, that means a few simple shifts:

• Have a point of view. Don't just respond to industry trends—help shape the conversation.
• Take a clear position. Strong brands are remembered for what they stand for, not just what they sell.
• Stay consistent. Consistency builds familiarity, trust and mental availability over time.
• Talk about outcomes, not just features. Technical capabilities matter, but buyers are far more likely to remember the problems you solve than the specifications you list.

‍

Final reflections

‍

The biggest takeaway from Black Hat last month wasn't another AI announcement or product launch. It was the contrast between an industry that's becoming more proactive in its approach to security and many brands that still communicate as if they're playing defence.

‍

If governments are recognising that shaping behaviour is more powerful than simply responding to threats, there's a lesson for marketers too. The brands that will win won't necessarily be those with the longest feature lists or the loudest AI messaging. They'll be the ones that build a distinctive position, communicate it consistently and give buyers a reason to remember them.

‍

In a market where everyone is promising the future of cybersecurity, the biggest risk may simply be sounding like everyone else.

‍