Next Week, 400 Booths Will Make the Same Three Promises. That's the Real Reason Cyber Has the Lowest Quota Attainment in Software.
CrowdStrike grew revenue 26 percent last quarter and beat estimates. Palo Alto Networks grew 31 percent and beat too. AI is pulling a fresh wave of budget into cybersecurity, and by every top-line number the category has never looked healthier.
And yet cybersecurity has the lowest quota attainment of anything RepVue tracks. The broader cloud-software average has climbed back to its highest level in about two years. Cyber has barely moved. It still sits dead last, with only around 37 percent of reps hitting number. Record demand, more budget, and most reps still miss.
Next week more than 400 vendors set up in the Black Hat business hall and about 20,000 people walk it, and most of them leave more confused than they arrived. This piece covers why record demand and record misses are happening at the same time, what a buyer actually experiences on that show floor, why the real problem behind the quota number is sameness rather than demand or leads, and the one thing that has always separated the reps who make number from the ones who do not.
Record Demand Is Real. So Is the Quota Gap.
Start with the good news, because it is real. CrowdStrike reported $1.39 billion in revenue last quarter, up 26 percent year over year, ahead of what the Street expected. Palo Alto Networks reported $3.0 billion, up 31 percent, and beat on both revenue and earnings. The demand signal underneath those numbers is genuine, and AI is a big part of why, pulling fresh budget toward anything that touches security.
One honest footnote on the Palo Alto figure, because it matters to the argument. A meaningful slice of that 31 percent, roughly $388 million, came from the CyberArk and Chronosphere acquisitions rather than organic growth. Even the headline growth number is partly a consolidation story, which is a preview of the whole problem.
Now set that against the sales floor. RepVue's Cloud Sales Index, which aggregates quota attainment across hundreds of software companies and tens of thousands of reps, puts cybersecurity dead last among every sub-vertical it tracks, at roughly 37 percent quota attainment. In the most recent reading the overall cloud-software index climbed back above 43 percent, its highest level in about two years. Cyber stayed at the bottom, on both quota attainment and inbound lead sentiment. So the picture is not a rising tide lifting everyone. It is a category with record vendor revenue and the worst rep outcomes in software, at the same time.
Next Week, 400 Booths Will Make the Same Three Promises
Walk the Black Hat business hall next week and the disconnect stops being abstract. More than 400 vendors will be on the floor and about 20,000 people will move through it. A buyer stops at a handful of booths, sees the same three promises at most of them, half from companies that just got folded into somebody's platform, and by the time they get home it has all blurred together. They still cannot tell you what any of it would actually change about their own exposure.
This is not a failure of effort. The booths are staffed by good people with real products. It is a failure of legibility. When 400 vendors describe themselves in nearly identical language, the differentiation the buyer needs in order to choose does not exist on the floor. It has to be created in a conversation, one account at a time. And consolidation has made the sameness worse, not better, because logos that used to compete on their own terms now live inside the same three or four platforms and pitch the same suite story. I wrote about what that churn does to the buyer's in-flight decision in the first half of 2026 was the biggest consolidation stretch in cybersecurity history, and the show floor is where you can see it all at once.
The Problem Isn't Demand. It's Sameness.
That is the real problem behind the quota number. Not demand, the demand is there. Not leads, a 20,000-person floor is not a top-of-funnel problem. The problem is that when a buyer cannot tell the booths apart, the deal stalls in the middle, where most cybersecurity losses actually happen, in indecision rather than to a competitor. More budget does not fix a sameness problem. It just funds more booths making the same three promises.
It is the same trap I described in you cannot outpitch a category your buyer cannot define. Most reps read the buyer's confusion as a pitching problem and sharpen the deck, add a slide, tighten the demo. That makes the sameness worse, because a tighter version of the same promise is still the same promise. The buyer does not need a better pitch. They need someone to make their specific risk legible.
What Actually Separates the Reps Who Hit
The reps who make number in a market like this are not the ones with the tightest demo or the biggest booth. They are the ones who can take a specific buyer's situation and make the risk real enough, right there in the conversation, that the buyer feels like they have to move on it. Not the category's risk in the abstract. This buyer's exposure, in their environment, this quarter, named out loud while it still changes the decision.
None of that is new. It is the same fundamental that has always separated the reps who make quota from the ones who do not. A crowded floor just makes it impossible to hide from. When every booth sounds the same, the only remaining differentiator is the rep who can diagnose, and the gap between the reps who can do that and the ones who cannot stops being a rounding error and starts being the whole quota number.
The hard part is that diagnosis is a real-time job, not a research project. The facts that make a buyer's risk legible move constantly. Which of their vendors just got acquired, what the acquirer's roadmap implies for overlap, where a renewal is about to get repriced, which option in their evaluation just lost independence. By the time a rep reconstructs all of that after the call, the moment to use it has passed. The buyer needed it live, while they were asking the question.
That is exactly what we built KillChain Overwatch to do: surface real-time competitive intelligence and sales coaching at the moment of the call, so a strong rep can make a specific buyer's exposure legible while it still moves the deal. It is a force multiplier for strong reps and built for cybersecurity AEs, the people who already know how to sell and now have to sell into a floor where 400 vendors say the same thing. If you carry a number this year, the question is not whether demand is there. It is what has actually let your reps stand out when the buyer cannot tell the booths apart.
The takeaway is simple. The record revenue and the record misses are the same story told from two ends. Demand keeps rising, the floor keeps getting more crowded and more identical, and the deals go to whoever can cut through the sameness and make one buyer's risk real in the moment. That has always been the job. Next week just makes it impossible to hide from.
FAQ
How can cybersecurity have record demand but the lowest quota attainment in software?
Because demand and differentiation are different problems. Vendor revenue is growing, with CrowdStrike up 26 percent and Palo Alto Networks up 31 percent in their most recent quarters, and AI is pulling fresh budget into the category. But RepVue's Cloud Sales Index still puts cybersecurity last among all sub-verticals at roughly 37 percent quota attainment, even as the overall cloud-software index reached its highest level in about two years. The money is there. What is missing on the sales floor is a way for the buyer to tell nearly identical vendors apart, and that is what stalls deals in the middle.
What is cybersecurity's quota attainment rate right now?
RepVue's Cloud Sales Index measured cybersecurity quota attainment at about 37 percent, the lowest of any sub-vertical it tracks. In the most recent reading, cybersecurity remained dead last on both quota attainment and inbound lead sentiment while the broader cloud-software average climbed back above 43 percent, its highest in roughly two years.
Why do so many cybersecurity vendors look the same at Black Hat?
Two reasons stack on top of each other. First, scale: more than 400 vendors on one floor describing themselves in overlapping language flattens real differences. Second, consolidation: logos that used to compete independently now live inside the same handful of platforms and pitch the same suite story, so even the differentiation that used to exist has been folded into a shared narrative. The result is a buyer who sees the same three promises at most booths and cannot tell what any of it changes about their own exposure.
How do cybersecurity reps stand out when every booth makes the same promises?
Not with a tighter pitch, which only makes the sameness worse. The reps who win take a specific buyer's situation and make the risk real in the conversation: this buyer's exposure, in their environment, this quarter, named while it still changes the decision. That is a diagnostic skill, and because the relevant facts move constantly, it works best when the rep can access competitive intelligence live, in the call, rather than reconstructing it afterward.
References
- CrowdStrike Holdings, Inc. First Quarter Fiscal 2027 Financial Results (Form 8-K, filed June 3, 2026). Total revenue of $1.39 billion, up 26 percent year over year from $1.10 billion, ahead of consensus estimates of roughly $1.36 billion. SEC EDGAR
- Palo Alto Networks. Palo Alto Networks Reports Fiscal Third Quarter 2026 Financial Results (June 2, 2026). Total revenue of $3.0 billion, up 31 percent year over year, beating revenue and earnings estimates; approximately $388 million of the growth was attributable to the CyberArk and Chronosphere acquisitions. Palo Alto Networks
- RepVue. Cloud Sales Index, Q2 2025. Cybersecurity recorded the lowest quota attainment of any sub-vertical at 37.35 percent. RepVue
- RepVue. Cloud Sales Index, Q3 2025. Overall quota attainment across the index closed above 43 percent, the highest level since Q2 2023; cybersecurity remained the lowest sub-vertical on both quota attainment and inbound leadflow sentiment. RepVue
- Black Hat USA 2026. Business Hall. The Business Hall features more than 400 solution providers and startups; the conference draws on the order of 20,000 attendees. Event runs August 1 to 6, 2026, Las Vegas. Black Hat
*Written by Jonathan, co-founder of KillChain Sales. Former offensive security operator, now leading go-to-market for an AI competitive intelligence platform built for cybersecurity AEs. If you carry a number and you are watching your reps disappear into a floor where every booth sounds the same, join the waitlist or connect on LinkedIn.*