Peter Laakkonen has been walking the Black Hat floor for twenty years. This year he walked it wearing a Noir Dove badge instead of a vendor one, and that shift changed what he was looking for. Black Hat USA 2026 drew roughly 23,000 attendees across 460 exhibitors, up 15% from the prior year (Black Hat, August 2026). The growth was not the story. What the money was doing was. Several companies Peter had never heard of before walking past their booths had some of the largest, most expensive setups on the floor. Funded conviction dressed as market traction is common at this show. It is remarkably easy to mistake for product-market fit if you are watching from the wrong angle.
Summary
- Black Hat USA 2026 drew 23,000 attendees across 460 exhibitors, a 15% increase from 2025, with booth spend patterns that had no reliable correlation with company revenue or pipeline (Black Hat, August 2026).
- Pi Security, a San Francisco company that publicly exited stealth in June 2026 with $35M in backing, built one of the floor’s most elaborate booths — illustrating a structural shift: capital is now arriving before recognition, not after it (Pi Security press release, June 2026; Peter Laakkonen, Noir Dove field observation, August 2026).
- The highest-attended session was OpenAI’s security engineers walking through a frontier model sandbox escape, confirming that agentic AI behavior has replaced CTEM as the dominant technical category, a shift that compressed inside six months between RSAC and Black Hat (Peter Laakkonen, Noir Dove field observation, August 2026).
- Cybersecurity founders at $1M to $10M in real revenue should be at Black Hat regardless of budget. A private suite with pre-scheduled ICP meetings, active participation in sessions and hallways, or simply being present at the event and announcing it in advance consistently outperforms an expensive booth with no commercial foundation behind it. The booth decision and the attendance decision are not the same question.
TLDR
At Black Hat USA 2026, money bought attention and rarely bought clarity. Several heavily funded companies with limited revenue ran the floor’s most elaborate booths, while vendors who cut through 460 exhibitors all saying the same thing about AI did so by saying something specific, not something louder. For cybersecurity founders at $1M to $10M, the lesson from this floor is not “skip the show if you cannot afford a booth.” It is that the booth decision and the attendance decision are separate, and conflating them is the most expensive mistake a founder can make. A private suite with pre-scheduled ICP meetings, active participation in sessions and hallways, or simply showing up with a clear commercial narrative and a list of people expecting to meet you consistently outperforms an expensive setup with nothing specific behind it.
A San Francisco Company Built an Igloo at Black Hat and Nobody Knew What They Did
Pi Security exited stealth in June 2026, backed by $35M and investors that include CrowdStrike’s CEO personally. By the time Black Hat arrived in August, they had one of the most elaborate setups on the floor: snow sleds, an igloo, a snowman, no obvious connection to cybersecurity anywhere in the design.
Pi Security was not alone. Exaforce, past 100 employees and a Diamond Sponsor of the show, put up an equally prominent setup that generated little floor recognition despite the visibility. Separately, at least one other company on the floor threw a different party every night, opening bottles that retail around $1,500 and buying advertising space on the Sphere, the giant globe behind the MGM. Most people who saw that ad from the Strip almost certainly had no idea what the company did.
CrowdStrike did not have a booth this year, the first time Peter can remember. Their own annual event lands at the same resort a few weeks later. Their advertising still covered large stretches of casino resort walls and ran through the weekend after Thursday’s close. Saturday night on the Strip belongs to gamblers from LA, not security buyers.
The traditional read on a large Black Hat booth was straightforward: presence signals revenue and staying power. That signal has broken down. Capital is now arriving before recognition, not after it. For founders with real revenue and real customers, that shift rewrites the competitive context. The company with a fraction of your traction can now buy more floor attention than you, and spending to match them is the wrong response to the wrong diagnosis.
The Booths Were Theater. The Sessions Were the Signal.
Four hundred and sixty exhibitors, most of them saying some version of the same thing about AI and security. The real read on where the market is heading came from the sessions, and 2026 had a clear one.
The highest-attended panel was a breaking-news presentation from OpenAI’s security engineers walking through a frontier model sandbox escape. Rogue agentic AI behavior and how to contain it. That was the topic no one wanted to miss. A second thread ran across several other sessions: how security teams defend in an era where frontier models can discover vulnerabilities and generate working exploits almost instantly, with close to zero skill required from whoever launches the attack. Fighting AI-driven attacks increasingly means running AI-driven defense. That idea showed up in booth conversations as often as it did in keynotes.
OT and critical infrastructure security received serious attention, framed around a genuinely hard convergence: geopolitical tension, AI-accelerated attack tooling, and infrastructure still running on decades-old systems, all at once. Multiple sessions pushed past endless vulnerability lists toward business risk. Fewer people were talking about patching everything. More were asking which exposures actually threaten revenue and how to build software that does not create the exposure in the first place.
One category stood out by its absence. CTEM was everywhere on the RSAC floor in the first half of 2026. At Black Hat it barely appeared. The vendors pushing exposure management had mostly moved past the framework, pitching autonomous and agentic remediation instead. A category that dominated the market conversation in March had been superseded by a new framing by August. That compression rate matters for any founder building positioning in this space.
Qualys Brought a Cricket Player. Manage Engine Pressed T-Shirts. Both Worked Better Than the Igloo.
The vendors who cut through were not the biggest spenders. Qualys had their CEO interview a cricket player and commentator at their booth. An odd choice in a country where cricket barely registers, but it created a specific, unexpected reason to engage. People stopped. People asked questions. Manage Engine ran their standard 20×20 setup with a T-shirt press, doing exactly what they always do. Torq put up an inflatable so large Peter still cannot explain the internal decision that led to it.
None of these approaches share a playbook. What they share is a reason to stop that is more specific than “we do AI security.” Qualys generated conversation. Manage Engine generated familiarity. Torq generated curiosity. Each of those outcomes requires something concrete at the center of the commercial narrative, not a category claim.
The economics on the floor were visible. Money bought attention. It did not buy clarity. A company could spend $500,000 on a booth and leave with no one knowing what the company actually did. Pi Security’s igloo was memorable. The question is whether anyone remembered what Pi Security does, and those are two different outcomes with very different revenue implications.
The founders who stood out for the right reasons said something specific enough that the comparison to every other AI-security vendor became unfavorable on first contact. That specificity requires a commercial foundation: a diagnosed ICP, a tested narrative, a consistent message across every function that touches the buyer. You cannot buy that foundation at Black Hat, and no booth budget produces it.
What Cybersecurity Founders Between $1M and $10M Should Do with This
Peter stopped at the booth of a company that had come out of stealth and closed a Series A right before the show. He talked to their VP of Sales. Early-stage customers, one of the fanciest setups on the floor. That is the uncomfortable part for founders sitting at $1M to $10M with real traction: you are being out-shouted by companies with less, and the instinct is to match the spend. Bigger booth. Louder party. More ad dollars.
That instinct treats a positioning problem as a budget problem. Those are different problems with different fixes.
The more useful question is not “how big should the booth be.” It is whether you need a booth at all.
Black Hat is a concentration of CISOs, security leaders, practitioners, and the people who influence their buying decisions, all in one place for four days. That concentration has value at any budget level. A booth is one way to access it. It is not the only way, and for a founder between $1M and $10M it is often not the highest-return one.
Consider the alternatives Peter watched work this year. A private suite at a nearby hotel, booked before the show, with a curated list of twenty meetings pre-scheduled with named ICPs. No booth cost. No T-shirts. No igloo. Twenty conversations with the right people, in a room where you control the environment and the agenda. That is a different outcome than twenty thousand badge scans from practitioners who will never buy.
For founders with a tighter budget, the floor itself generates conversations at effectively zero incremental cost. Sessions, hallways, evening parties, the shuttle from the airport, the coffee line at the Mandalay Bay. Announcing your attendance in advance on LinkedIn and in the security forums your buyers read, with a specific reason to meet you, converts that density into a list of people expecting to find you.
The point is this: if you are building a cybersecurity company targeting CISOs, security leaders, or practitioners in SMBs, enterprise, or government, you should be at Black Hat regardless of whether you have a booth, a suite, or any physical presence at all.
If your sales team cannot close a deal without you in the room, that is a commercial system problem. If marketing is targeting practitioners while sales pitches security leaders, you have an ICP definition that was never formally agreed between the two functions. If pipeline fills but stalls in legal and procurement, your multi-stakeholder narrative is missing a layer for every buyer who is not the CISO. Gartner research found that sales and marketing teams collaborate on only 3 of 15 commercial activities on average, and nearly half of CSOs report that their MQL definition differs from marketing’s (Gartner, CSO research, 2024). At Black Hat 2026, that misalignment was visible on the floor in both directions: in the booths that generated conversation and in the ones that generated impressions with no follow-through.
The question worth sitting with before writing the check for next year’s booth is not “how big should the booth be.” The question is whether the commercial system underneath the story is strong enough to compound when you put money behind it. If the story does not travel without you in the room, it will not travel with a larger booth either.
Frequently Asked Questions (FAQs)
Why did CTEM disappear from Black Hat 2026 after dominating RSAC earlier in the year? The category compressed faster than most vendors anticipated. By August, vendors pushing exposure management had already reframed their pitch around autonomous and agentic remediation, treating CTEM as a baseline assumption rather than a differentiating claim. Categories in cybersecurity collapse into assumed functionality quickly once the first wave of funded players establishes the vocabulary. The competitive conversation moved to what happens after exposures are identified, not whether to identify them.
How should a cybersecurity founder think about Black Hat presence if they are at $3M to $8M ARR? Go. The booth decision is separate from the attendance decision, and conflating them is the mistake. Black Hat is where your buyers concentrate for four days. Being there matters. How you show up is a budget and strategy question, not a yes-or-no question. At $3M to $8M, a private suite with twenty pre-scheduled meetings with named ICPs often outperforms a $200,000 booth with no pre-work. At a tighter budget, attending sessions, being active in the hallways and evening events, and announcing your attendance in advance on LinkedIn and security forums generates real conversations at near-zero incremental cost. The return on any of those approaches is determined by the clarity of the commercial narrative behind them, not the square footage of the setup.
What does it mean practically that capital is now arriving before recognition in cybersecurity? It means the booth-size heuristic has broken down as a buyer signal. A large presence used to indicate a company worth investigating. That is no longer reliable. For buyers, more screening is required before a conversation. For founders at $1M to $10M with real revenue, it means their competitive context now includes companies that are well-funded but pre-revenue, and distinguishing themselves requires a narrative specific enough that the comparison becomes unfavorable to the funded-but-unproven competitor on first contact.
If the commercial system is the real constraint, where does a cybersecurity founder start? Start with the diagnosis, not the fix. The most common error is treating a symptom as a root cause. CISOs going quiet after the first call is a symptom. Marketing generating MQLs that sales does not recognize as buyers is a symptom. The founder still closing most deals personally is a symptom. Each of those symptoms can point to a different structural cause, and the right fix depends on which cause is actually producing the symptom. Spending on a larger booth, a new campaign, or a new rep before that root cause is identified accelerates activity in the wrong direction.
Sources Referenced
- Black Hat USA 2026, Official Attendance and Exhibitor Data, August 2026 (23,000 attendees, 460 exhibitors, 15% year-over-year attendance growth)
- Peter Laakkonen, Cybersecurity Advisor, Noir Dove, Field Observation Notes from Black Hat USA 2026, August 2026 (Pi Security booth design, Exaforce Diamond Sponsor presence, party and Sphere spend by unnamed company, CrowdStrike wall advertising, Qualys cricket interview, Manage Engine setup, Torq inflatable, OpenAI frontier model sandbox escape session, CTEM absence)
- Pi Security, public stealth exit announcement, June 2026 ($35M raise, CrowdStrike CEO as backer)
- Exaforce, Black Hat USA 2026 Diamond Sponsor (SecurityWeek, Trace3 coverage, August 2026)
- Gartner, CSO research, 2024 (sales and marketing collaborate on only 3 of 15 commercial activities on average; approximately 49% of CSOs report MQL definition differs from marketing’s)
Talk to Noir Dove
If your pipeline is inconsistent and your commercial narrative does not hold without you in the room, the Black Hat floor made visible what is likely already costing you deals. Check our cybersecurity solution.
The diagnostic starts with what is structurally limiting your story, not with what you should spend next year.
