Signal v. Noise in the RSA Innovation Sandbox

Last updated in August 2026

This post was originally created in collaboration with Rami McCarthy. He writes a lot of great technical posts, so you should follow him and read what he writes.

Last updated August 2026

Behind the headlines and hype of the RSA Conference lies one of the industry's best predictive machines. The Innovation Sandbox has become synonymous with being a launchpad for new unicorns and breakaway companies in the industry.

But not everything that glitters goes public.

For those who follow the newsletter, RSAC is a great opportunity to catch up on the latest trends in funding, innovation, and success stories within the cybersecurity industry. Return on Security closely monitors emerging funding events and helps cybersecurity professionals stay up to date on industry trends. Sign up here.

BSidesSF traditionally holds its event right before the RSA Conference. Last year, we had the opportunity to chat with multiple founders at the conference as they prepared to pitch at the RSA Innovation Sandbox.

This contest, originally presented as the “Innovation Station” back in 2005, identifies up to ten innovative new startups and gives them the chance to make a 3-minute pitch to a panel of judges.

As of 2019, only seven finalists had closed their doors. Clearly, being a finalist can help a startup gain traction, and the group has had many successes. Phantom Cyber founder Oliver Friedrichs attributes (on The Decibel Podcast) some of that company's success to their win:

However, after 21 contests and 208 unique companies filling 212 finalist slots (a few companies competed in more than one year), we have enough meaningful data available to answer the following question:

The average Venture Capital (VC) fund works on a 7-10 year lifecycle. VCs look to return proceeds to their General Partners (GPs) on this timeline, which generally creates exit pressure on startups.

As a result, we can expect the majority of RSA Innovation Sandbox finalists (those from the first decade) to have reached this milestone. In the VC-backed startup landscape, rapid growth, fundraising, and eventual exit value are often proxies for success.

Here is the entire history in one picture. Every finalist, every year, one dot per company, colored by where they ended up. Gold rings mark the winners:

The RSA Innovation Sandbox clearly impacts companies in the competition and the wider cybersecurity ecosystem.

To illustrate the economic scale, let’s look at the 21 contests from 2005 to 2026. The finalists in the RSA Innovation Sandbox have (so far):

_{*Google’s acquisition of Wiz closed in 2025 at $32 billion, the largest cybersecurity acquisition ever. Fun fact: Wiz did not win the competition in their year.}

Being in the sandbox seems to at least guarantee a path to high levels of funding and a strong likelihood of being acquired. What is harder to quantify are the knock-on effects of what it means to even be in the competition.

Success often begets success in the cyber world. Simply being finalists in the competition will give these companies greater appeal and leverage when raising future funding rounds, conveying expertise to potential customers, and bolstering future exit plans.

Just look at Talon Cyber Security, a remote browser isolation platform and winner of the 2022 RSA Innovation Sandbox competition, which was acquired by Palo Alto Networks for $625.0 million. (more)

Even a “near success,” of being in the sandbox competition but not winning, still has a positive halo effect for all of the above.

Also of note, the three youngest cohorts (2024 to 2026) sit near the bottom of the funding table, ahead of only the 2007 class. That is age, not weakness. As the exit data later in this post shows, a class needs years before its story is legible.

It’s also important to note that not every company that participates in the sandbox competition is a newly formed startup. While the startups in the competition are still squarely in the “early stage” range, not all early-stage traction is created equally.

Some companies will have been around for a few years, while others will be approaching their 10th year. Additionally, and more importantly for future success, some companies in the competition will already come in with a few million in ARR, a list of big-name customers, and the knowing nod of Product-Market Fit signals.

This competition is as exciting as the cyber industry is competitive. Speaking of competition, let’s look at the winners.

This is what most people are looking for, so here is a running list of the winners for each year that the RSA Innovation Sandbox has been running.

Note that there was no Innovation Sandbox in 2008 for undisclosed reasons.

It’s obvious on its face that the RSA Innovation Sandbox crowns solid companies. The winners rarely “fail” (i.e., go bankrupt, shut down, etc.), consistently go on to secure future funding, get acquired, and vastly outperform the statistics (around two-thirds) on startup failure.

Three such notable companies at the time of refreshing this piece:

IPO has been the name of the venture capital game since the beginning, as well as achieving the elusive 10- to 100x returns. Jason Lemkin from SaaStr offers a stellar explanation of the 10x rule:

So does the trophy itself pay? On fundraising, mostly yes. The winner out-raises the median of their own cohort in 13 of 21 contests:

But what about exits? Winning barely moves the needle.

The winners are acquired at 57.1%, while the other nine finalists are acquired at 58.1%. While the judges pick a winner, the market buys the whole cohort.

Being in the competition at all is the real market signal, but the trophy is just icing on the cake.

On the acquisition front, 58% of the 212 sandbox finalist slots were acquired between 2005 and 2026. Sandbox finalists are acquired at 2.8 times the rate of the market they come from.

M&As, whether they are strategic roll-ups or private equity buyouts, are the most common path for both winners and non-winners.

What about IPOs?

On the IPO front, the public markets demand more. The price of admission, the level of competition, and economic challenges have changed a lot in the last 20 years.

Looking at other cohorts of the sandbox contest, there are currently only a handful of companies that have gone on to be publicly traded:

Very few of the public cybersecurity companies still operating at the time of writing this post have competed in the RSA Innovation Sandbox, which is an interesting difference.

While having a successful IPO is one measure of success, it’s no longer the only measure. Of the five finalists ever listed, three were later taken private, so even the IPO road tends to end in M&A.

Taking the flip side of the M&A equation, we see a strong concentration of power. The early heavyweights in the cybersecurity and computing industry were the most aggressive in acquiring RSA Sandbox finalists and made out like bandits.

Here is the buyer league table:

Four finalists were bought more than once, and each of those deals credits its buyer. BlackBerry keeps its 2018 Cylance purchase even though Arctic Wolf owns Cylance today. Skybox Security was bought three times (Providence, then CVC, then Tufin took the assets)

How things probably felt in retrospect:

There was also an instance of a sandbox finalist acquiring another sandbox finalist (very meta):

The buy side has grown up too. 23 finalists have made 47 acquisitions of their own, with $2.4 billion disclosed. SentinelOne alone has bought seven companies.

A Sandbox class takes about a decade to get bought up. Among the finalists that have had their full ten years, 61% were acquired within a decade of competing, and 71% have been acquired to date. The last ten years of cohorts have not yet had their decade. As they age, the headline should climb toward the 70s.

And for the companies that do sell, the clock is short. The median time from the Sandbox stage to a sale is 3.3 years, and 91% of all sales occur within 10 years of competing. Nobody simmers for 15 years and then sells. If a company is going to exit, it exits fast.

In any event, just being in the game gives you a leg up. Being a finalist gets you into an “elite club” with a “vibe tailwind” that is more valuable than any funding round.

That may not last forever, though, as some significant changes arrived in 2025, and the industry has mixed feelings about it.

Let’s take a quick walk down memory lane to set the stage for the 2025 changes.

Back in March 2022, the private equity firm Crosspoint Capital Partners acquired the RSA Conference, backed by Clearlake Capital Group and Symphony Technology Group. The transaction involved purchasing a significant interest in the RSA Conference from RSA Security and making the conference an independent, standalone business.

Given the conference's enormous appeal, this move makes a lot of sense. Fast forward two years after the acquisitions, however, and a new private equity playbook began to emerge.

In November 2024, Crosspoint Capital Partners announced a new rule. Starting in 2025, the top 10 finalists in the Innovation Sandbox competition must accept a $5 million investment to take part. Being selected as a finalist now automatically comes with this funding requirement.

This investment will use a Simple Agreement for Future Equity (SAFE), popularized by Y Combinator, with no cap and includes pro-rata rights and information rights. While this gives startups a lot of money and flexibility, it comes with new strings attached:

Carta has the best breakdown of the pros and cons of using SAFE agreements for anyone who wants to go deeper.

This mandatory investment is a controversial but predictable move for the RSA Conference. As backers of the mega security conference, it makes sense from a business perspective to tap into the huge benefits that competitors see. But it won’t be without its complications and mixed feelings.

Some founders and investors may see this as a “pay-to-play.” This might scare off startups that don’t want outside money. It also affects those who are cautious about dilution and investor rights. Some may also see this as a way to artificially prop up companies that might not have otherwise survived as long without that investment.

It’s too early to tell, but the big question now is: will other conferences, like the Black Hat Startup Spotlight Competition, follow suit?

A common theme has emerged among entrants to the RSA Innovation Sandbox throughout its history.

Data, privacy, and GRC pitches (data discovery, classification, DLP, encryption, and compliance) top the list across all 21 contests, with endpoint and network pitches close behind.

Data Protection being the top product category to enter the competition makes sense because, at the end of the day, isn’t protecting data what the cyber industry is all about?

Another way to assess the RSA Innovation Sandbox is to look at the finalists who did not win. Bessemer Venture Partners coined the concept of an “anti-portfolio,” publishing a list of potential investments that they passed on that later became “tremendously successful companies.”

Looking through all 208 unique finalists from 2005 to 2026, a dozen have already been differentiated by their success. In chronological order:

Looking over the Sandbox’s legacy so far, there are a few takeaways: