As Wade assured everyone last time, we are back with some more analysis on the long history of RSA Conference exhibitors and the burning question of “Is the cybersecurity market becoming more or less diversified over time?” If you haven’t read that previous post, I’d encourage you to stop reading this one and go give it a glance. It has cute anecdotes about innocent questions, good references to other historical analysis of the RSA Conference, and of course more than a few very pretty pictures.
Because some population of readers won’t go read that previous post here is a quick summary. The RSA Conference organizers have given the folks at the Cyentia Institute a chance to look over meticulously collected data from vendors from more than two decades of the RSA Conference. This is a bit different from work we’ve done in years past because it focuses on exhibitors and how they present themselves at the conference and not the talk track.
In that analysis we noticed a few things. First, the conference itself has consistently grown over the years1, with the number of vendors packed into the halls of Moscone topping 700 in 2019. With a bit of statistical wizardry called RAKE, we extracted keywords and phrases from exhibitor descriptions. What we saw was an expansion in the number of different keywords exhibitors are using over time, indicating that our industry is expanding the language it uses as it addresses new topics.
While we hinted at what those keywords actually were in that last post2, we stopped short of actually listing them. Wait no more! Here are the most popular keywords and phrases for 24 years of RSAC vendors.
Figure 1
View Full Size
There is some comfort in the fact that ‘security’ is the most popular keyword (left side of Figure 1) for exhibitors to utter in their self-descriptions, though possibly also some disquiet that only a little less than half of exhibitors use it on average. Nothing else attains more than 20% status, and the list is a grab bag of cybersecurity and technology words. The keyphrases (right side) also provide a mix of words that just “feel right” for security. The usual suspects show up, with “threat management” and “vulnerability assessment” being the biggest players. A few more… ahem… marketing terms are popular such as “global leader” and “management/software solutions”, but we can’t fault exhibitors for selling themselves and their products.
What’s perhaps more interesting are the few blasts from the past mixed in there, particularly “smart card” and “digital signature”, two terms rarely employed in more recent years. So how has our security language evolved over the years? We can look at the top 10 over time in Figure 2.
Figure 2
View Full Size
It’s a testament to the ability of our industry to evolve and face new challenges that some of the things that were 🔥🔥🔥 in the early 2000’s have dropped completely from view within a decade. It’s a little tough to see from the plot above, but some of these have stood the test of time and some haven’t. Let’s take a more time-centric view in Figure 3, where we look at anything that appeared in the top 5 over the years and see its trajectory.
Figure 3
View Full Size
Some terms are transcending time here. “Access management” has been a constant refrain through the years and, despite a dip in the mid-twenty teens, continues to be a hot topic. “Data protection” and slightly more recently “data loss prevention” have consistently been important to exhibitors in the last 10 years and given the continuous collection of user data will continue to be in the future.
There are also more than a few ‘flashes in the pan’ as well. “Authentication platforms” was the 4th highest most uttered keyphrase in 2008 and didn’t break the top 10 in any other year. Similarly, “virtual private networks” and “certificate authorities” seem to have run their course. This raises the question: What other technologies of yore were once all the rage and are now unheard of? To do this we devised our own particular measure we are dubbing “Pan flashiness,”
PN =
That is the ratio of the average percentage of exhibitors using a term, excluding the year of its maximum use, divided by that maximum year. Simply if the term is consistently popular or unpopular it’ll have a low PN value. If a term is very popular for a year or two but is low on average, it’ll have a high PN value.
Figure 4
View Full Size
Let’s take a trip down memory lane, shall we? Remember in the late 90s and early 2000’s when we distinguished between “extranet” and “intranet”? Remember when “mobile applications” were something distinct and not just part of the security landscape? The same might be said for the “Internet of Things”–as an industry we’ve just accepted that there are these endpoints that require management, not that they are distinct special things requiring special security.
We’ll let the reader pore over Figure 4 and reorient our discussion a little bit. We came here to ask whether security is growing as a field or coalescing around some ideas. We’ve seen phrases can come and go, but does that coming and going add up to a bigger diversity of topics? One last piece of analysis will give us some evidence that the answer is “Yes”.
We pull one last statistical model out of our pocket to analyze this pile of text: Latent Dirichlet Allocation (LDA)3, an algorithm for topic modeling. You can think of topic modeling as an automatic way of organizing pieces of text–e.g., a newspaper divided into a sports section, local events, arts, finance, and comics. Topic modeling achieves this organization automagically through some clever stats. So, the question is how many ‘sections’ should our newspaper of exhibitors have, and are the number of sections expanding? LDA does the organizing, and we’ll use another algorithm4 to figure out just how many sections there should be. Figure 5 tells us the answer.
Figure 5
View Full Size
Figure 5 indicates that the number of topics covered by exhibitors has expanded from about a dozen in the first 15 years to 20 in the most recent full in person conference (2019). An expanding field indeed.
We don’t have a crystal ball5 to determine what words and phrases will test the time and which will fade. And we can’t tell what Next Big ThingTM every exhibitor on the floor will be talking about next year. But if this analysis is any indication, it’s likely that the cybersecurity field will continue to expand.
[1] Save for a few hiccups like a global financial crisis and a pandemic.
[2] Seriously go take a look, there are some gorgeous visuals in there.
[3] Blei, David M., Andrew Y. Ng, and Michael I. Jordan. "Latent dirichlet allocation." The Journal of Machine Learning Research 3 (2003): 993-1022.
[4] Griffiths, Thomas L., and Mark Steyvers. "Finding scientific topics." Proceedings of the National academy of Sciences 101.suppl 1 (2004): 5228-5235.
[5] Or do we? No… we don’t :(