I study cybersecurity trust signals in their go-to-market. You wanna know how I do it? I mystery shop them. That’s right, I go through their website, drip, booth, commits, docs, everything that’s external. You know why? Because that’s how a buyer experiences these companies so guess what? If I know you can sell, then you might be worth backing. If you can’t, well…
BSidesSF and RSAC are back to back which means anyone who is going to both will have to eat six days of conference.
This was my first set of cybersecurity conferences.
I am also an introvert.
An introvert in cybersecurity? You don’t say.
I just need you to understand the scene here.
Anyway, my research is in how trust develops in high-trust verticals.
What’s a high-trust vertical? Any vertical where failure is existential, so things like FinTech (compliance nightmares), HealthTech (bureaucracy nightmares), Cybersecurity (everything nightmares).
That means instead of going to sessions, with the exception of my volunteer resume shifts, oh and eating, I spent the rest of my time talking to startups. Seriously, I just started at one end and spoke to everyone until they started packing up. I think I missed a couple, but still, it was a lot.
BSides was lovely. The conversations I had were amazing, everyone was super knowledgeable and crazy helpful. I had people really go out of their way to support me, and honestly, you want to talk about community? Turns out it starts with a B.
RSAC by contrast, was my own personal nightmare. Having been absolutely mislead by the magic of BSides, I was completely unprepared for the circus known as RSAC. The entire bottom floor of the expo was like a cybersecurity Las Vegas. There was a boxing ring, a giant skeleton, lights and noise everywhere. Elvis and Jack Sparrow were around. Multiple times I would stop and think “This is still a cybersecurity conference right?”
If you know anything about these kinds of conferences, the real action is during all the after parties, but vetting all these things takes time and is tiring. I got home between 8PM-1AM regularly. Multiply that by six days and it’s as fun as it sounds. Did I mention I’m an introvert?
By the last day, I was ultra tired. It’s hard because I really love what I do and I love my research but that shit is still tiring.
It was on this tiring last day that I encountered them. Their messaging was unclear, they had more swag than information, and the video montage they had in the back also didn’t have any information about their product. The worst part, they said they do [REDACTED] on the back wall under their name and [REDACTED] on the one doc they had on display on their counter. When I spoke with the GTM person, they gave me a vague description of what the company did, and honestly, it’s not on me, the buyer, to have to work so hard to understand your messaging. Given the conflict between their marketing, vague description from the GTM person themselves, and their abundance of swag and no actual marketing docs, I decided to pass on continuing this conversation. The person asked to scan my badge, tried to offer me an extra piece of swag in addition to my one piece to which I declined and then didn’t think about again until reviewing my notes.
I could not even tell you what their name was because they were so forgettable.
Luckily, or maybe not so luckily, the BDR reached out and when I looked them up oh wow there they were with more inconsistencies. The BDR used their own email address but signed it as the co-founder who said it was great to meet at RSA except that we did not meet. They then go on to make multiple claims, but don’t have anything to back it. That’s a lot of inconsistencies in one email and if you can’t QA an email, what else are you not QAing?
I’m giving these guys a lot of chances, but mostly because it’s part of my research so I go to their website. Their email claims to have companies onboarded but there are no logos or case studies on their site. I’ve seen super sus cybersecurity websites before, and alarm bells have been ringing through every layer. Their ICP was essentially “everyone” and when your ICP is “everyone” it’s really “no one.” If you don’t know who you’re for, I’m not going to know either.
Here’s the thing. I’m studying these companies and I’m already irritated because this felt like a gigantic waste of time. Imagine if I was an actual CISO or security leader with buying power who is sifting through all of this on day 6 of their cybersecurity conference tour.
One thing I did notice, was that they were consistent across the board. That’s extra dangerous.
I’m just a researcher, which means I’m not their target audience now, but the thing is I might be working with someone who is. Influence works in a lot of ways.
But it wasn’t all terrible.
One of my favorite companies from RSAC was StrongestLayer in the Early Stage Expo.
Walk past their booth and you might miss them. Stop and ask a question and you won’t forget them.
Clear messaging
Here’s the Status Quo
Here’s our differentiator
Here’s the COST AND TIME SAVINGS
Here’s the proof
I asked about false positives and they hit me back with AN ACTUAL CASE STUDY putting them at a 0.4% false positive rate. I know that this is probably their best case, but the 2-4% on their website is still very impressive. I was so impressed I actually said, “holy fuck” on the expo floor. Full disclosure: their pitch structure mirrors my own framework, so take that as you will. But the data speaks for itself. That being said, I have only vetted their booth and website. There are a lot more signals to evaluate beyond booth and website. You have to do your own work when verifying a company.
Here’s the thing.
Buyers are tired.
After six days and hundreds of booths, they are extra tired.
You have no idea in what state or what stage a buyer’s first encounter with you is going to be. That means you have to be good on every layer.
Giving me all the information I need upfront is gold.
Making me work for it, in the middle of all this, earns a block.
It’s a lot, I know.
But if these guys are doing it, then it means it can be done.
Good luck out there,
And don’t waste time.
Strategy matters.
But trust moves markets.
With heart,
— Rhea Lynn Mascarinas
Cybersecurity GTM Researcher | QuietConversion
© 2026 QuietConversion. All Rights Reserved.
Miss Me With That Weak Ass GTM: A Day in the Life of a High-Trust Buyer
