Every year, Black Hat offers a snapshot of where cybersecurity is heading. This year, AI dominated the agenda, technical complexity continued to climb and brands competed for attention across crowded stages, booths, restaurant-takeovers, and media calendars. At the same time, there were a few noticeable absences from the show floor, despite that, two of the largest vendors in the space still earned post-show coverage (CNBC) — underscoring booth presence isn’t a requirement for ultimate visibility.
But the biggest takeaway for communications and marketing leaders was not about any single element. It was the growing gap between showing up and breaking through.
Our Highwire team was on the ground all week, embedded with clients on the show floor and logging tens of thousands of steps between Mandalay Bay's convention halls and the string of hotels hosting side events and meetings. A few of us also spent time at Ai4 across town, watching two of the industry's biggest conversations play out in parallel.
What struck us most wasn't just the size of the crowd, it's that Black Hat keeps getting bigger every year, with more sessions, more sponsors, more side events — including the inaugural healthcare summit — while the day somehow still has the same 24 hours. Reporters' schedules haven't expanded to match the scale, and neither has anyone's attention span. Squeezing a handful of high-value media conversations into an already packed week took more coordination and more flexibility than in years past. We increasingly heard from reporters that budget limited their ability to travel (while some confirmed they’d cover virtually). In fact, according to Highwire’s engagements and data, confirmed press attendance was down approximately 10% compared to 2025 press attendance (this is specifically press and not analysts or influencers).
This was somewhat counterbalanced by the nearby Ai4 conference, which brought new enterprise tech reporters to the city during the same time, and offered opportunities for expanded conversations especially with executive and AI security spokespeople.
At a conference where attentions are finite and nearly every company is speaking to the same trends, familiarity quickly becomes sameness. Generic AI messaging blends into the background. Executive commentary without a clear position adds to the noise. A booth or packed briefing schedule may generate activity, but activity alone does not build reputation or business momentum.
The brands that stood out made complex issues understandable, brought distinct perspectives to familiar conversations and created experiences with a clear purpose. Here are five lessons communications and marketing teams should carry from Black Hat USA 2026 into 2027 planning.
AI was everywhere at Black Hat, from autonomous agents and governance to infrastructure security, open-source models, and increasingly powerful Chinese models.
That ubiquity created a communications challenge: Simply talking about AI is no longer differentiating. Even legitimate technical innovation can struggle to attract attention when the story surrounding it sounds familiar.
The bar for an effective AI narrative is rising. Reporters and audiences want proprietary evidence, a surprising implication, a strong point of view, or a clear connection to an existing problem. Case in point, Sharon Goldman’s fast coverage on OpenAI’s surprise session on their Hugging Face incident garnered 2 million views according to Sharon and impactful reaction across the industry.
Communications teams need to move beyond what the AI does and explain what it changes. Does it alter the economics of an attack? Expose a new organizational weakness? Force CISOs to rethink an established practice?
One gut check can help: If you can replace your company’s name with a competitor’s and the story still works, it probably is not differentiated enough.
Black Hat’s major themes were easy to identify, which made it equally easy for executives to repeat the consensus rather than add something new. SecurityWeek's roundup of Black Hat USA 2026 vendor announcements ran four full installments, and AI or agentic security was the dominant thread across nearly all of them, from CrowdStrike's "Agents of Chaos" AI briefing to Palo Alto Networks' "Frontier AI era" PAN-OS update, Optiv's "Agentic Security Operations" launch, and Cyble's BlazeAI-powered release. When every major vendor is announcing an AI agent story in the same week, simply talking about AI stops being differentiating.
Saying that AI will change cybersecurity or that CISOs face mounting pressure may be accurate, but accuracy alone does not create thought leadership.
The stronger opportunity is to take a position:
A credible position gives audiences something to examine and remember. It helps an executive build ownership of a conversation rather than simply react to it.
That perspective still needs technical substance, but some of the best conversations we heard began with a simple articulation of a complicated problem. The communications opportunity is to preserve that technical depth while making the stakes immediately clear.
Being at the same event is not enough of a reason to request a media meeting.
At Black Hat, reporters balanced sessions, interviews, deadlines, and overwhelming outreach. With Ai4 taking place in Las Vegas during the same week, some were also splitting their time between conferences. Under those conditions, “our executive will be onsite” is logistics, not a value proposition.
Before setting meeting targets, communications teams should determine whether a meeting creates a genuine editorial opportunity. Meaningful news, original research, relevant expertise or a timely point of view can provide that reason. Executive availability by itself cannot.
Success should not be measured by how many briefing slots a team fills. The goal is to create the right interactions with the right reporters at the right moment. If there is no compelling reason to meet during Black Hat, save the conversation for a stronger news moment.
One of the clearest themes we heard from CMOs was growing pressure to justify the cost of sponsoring and exhibiting at Black Hat. Marketing leaders are questioning whether the traditional big-booth, big-party playbook still delivers the strongest return. Especially when brands expect costs to rise exponentially in the years to come.
A major show-floor presence can create value, but scale is not inherently strategic. Several CMOs pointed to smaller, curated experiences as some of their most valuable moments of the week.
One described an intimate dinner with approximately 25 cybersecurity marketing leaders as her favorite event. Its value came not from spectacle, but from structured, substantive conversation.
As conference costs rise, marketers should focus less on how big the brand can show up and more on where its investment can create the most valuable interactions. A smaller experience can outperform a larger activation when it brings the right audience together around a relevant idea.
A booth, announcement, or executive appearance should all be part of a trip to Black Hat. But none is a strategy on its own.
Every tactic should advance a larger business or reputation goal. That might mean establishing an executive’s point of view, generating customer proof points, building relationships with a new media cohort or creating content that carries a conversation beyond the event.
The work should not reset when Black Hat ends. Black Hat can create momentum for Billington in September, which can push the narrative further at Aspen Cyber Summit in November. Each milestone should deepen relationships, add evidence, and strengthen the company’s position.
No single conference is the main event. Each should leave the company better positioned for the next.
The lesson from Black Hat is not that cybersecurity companies need to talk more about the industry’s biggest trends. It is almost the opposite.
When everyone is talking about the same things, specificity, clarity, meaningful experiences, and a genuinely differentiated point of view become more valuable.
For communications and marketing teams, the opportunity is to replace activity with intention. Start with the reputation the company wants to build, the position its executives can credibly own, and the audiences that matter most. Then build the conference strategy around those decisions.
The brands that break through in 2027 will not simply show up. They will arrive with something specific to say and use every interaction to build momentum beyond the moment.
Learn how Highwire helps cybersecurity brands translate technical complexity into business relevance, elevate executive voices and shape consequential industry conversations.