Correlation isn't causation (except when it is), and only looking at one entity is the lazy example of p-hacking, but Zafran seems on shaky ground – either being acquired at a fraction of valuation, or seeing a tiny bridge investment as it glides to a different exit. Assuming these rumors reflect an underlying reality, what went wrong would probably fill a master's thesis. But I'll pick out one thing: their booths.
At Blackhat 2025, I wrote my initial State of the Security Vendors report. While I commented in the published report that:
A handful (11) of vendors focused more on the theme of their booth than on their messaging. I think it mostly isn’t helpful, even if it gets a lot of badge scans. These booths end up feeling overcrowded and unapproachable to serious browsers, so may be overlooked.
Of those 11, three had booth themes where I couldn't tell, at a distance, what they did. One of those three was Wiz, a name big enough that not blasting what their business was seemed like an entertainingly viral choice (one substantiated by hallway conversations with CISOs). Another was Torq – less well-known, but still big – going quite over-the-top with a play on its homophone, torque, with a giant monster truck.
And the third? Zafran, with Zafran High, a booth that was always packed with trick-or-treaters, but one which CISOs I spoke with didn't approach, and many hadn't heard of Zafran.
At RSAC this spring, there were 29 booths that were heavily theme-focused, and eleven of those were also impossible to decipher at a distance what they did. Zafran again made that cut, with their iconic Zafran Records (not to be confused with Broadcom's Legends Never Die) booth.
If you're a vendor at a conference, you should ensure that your booth's theme isn't louder than your company's message. Your booth doesn't have to be ugly or boring. But it needs to advance your brand, and get potential buyers to believe that the problem you solve is important, and once that your company is best positioned to solve.
It may be that all is well at Zafran, and the reporting is off-base. But with Blackhat around the corner, marketing teams should double-check that their investment is driving meaningful conversations (even if it's just between attendees talking about your message) and not just driving more badge scans from people who are never going to be buyers anyway.
