Category creation in cybersecurity and resilience

Category creation in cybersecurity means naming and legitimizing a problem the market has no budget line for yet, then getting buyers, competitors, and analysts to use that name. It takes eighteen months to three years, and it is the right move only when no existing category describes you accurately enough to win deals.

Most companies that set out to create a category should not. The exercise is long, costs more than a repositioning, and fails quietly: you end up with a name only your own team uses, in a market that files you under something else anyway.

It is worth doing when the buyer has the problem, has no budget line for solving it, and the existing categories describe you inaccurately enough to lose you deals.

What has to be true before you try

• The problem is real and recurring, and buyers can already describe it without your help.
• No existing category holds it. If you fit an established one, being unmistakably specific inside it is cheaper and faster.
• You can fund three to six quarters of consistent language before the market reflects it back.
• There is an analyst path. Someone in the research community is already circling this problem space.
• A second company would benefit from the category existing. A category of one is a product name.

That last condition surprises people. Categories become real when competitors adopt the language, because that is what convinces a buying committee the problem is legitimate rather than vendor invention.

The sequence that works

• Name the problem before naming the solution. Buyers fund problems they can defend internally.
• Prove it with evidence they cannot dismiss: their own data, practitioner research, named customers.
• Give the category a name that is boring, descriptive, and repeatable by someone who has not read your site.
• Brief analysts early and repeatedly, in their language, without asking for anything.
• Publish consistently in the same frame for long enough that consistency becomes the signal.
• Recruit others. Partners, associations, and even competitors using the term is the point, not a threat.

How you know it is working

Three signals, in order of appearance. Practitioners use the term in conversation without prompting. A competitor adopts it in their own marketing. An analyst uses it in a published note or a Hype Cycle entry. When the third happens you have a category; before that you have a campaign. We wrote about that moment in when an analyst adopts your category and when the name gets adopted.

What it costs

Budget for consistency rather than volume: a narrative, a small body of proof, an analyst cadence, and the discipline not to change the language when the team gets bored of it. The most common cause of failure is a company abandoning its own term two quarters before the market would have repeated it.

Adjacent markets where this comes up

Operational resilience, third-party risk, AI governance, and capability intelligence are all spaces where the category question is live right now, because the operational problem is ahead of the budget line. That is the condition category creation is for.

Questions people ask

How long does category creation take?
Eighteen months to three years for the market to reflect the language back, with earlier signals from practitioners and partners. Shorter timelines usually mean the category already existed.

What is the difference between category creation and repositioning?
Repositioning changes how you are understood inside an existing frame. Category creation changes the frame. Repositioning is faster, cheaper, and correct far more often.

Can a small company create a category?
Yes, and small companies do it more often than large ones, because consistency matters more than budget. What a small company cannot do is create one while also changing its story every quarter.

Should we trademark the category name?
Generally no. A term you own legally is a term competitors cannot adopt, and adoption is the mechanism that makes a category real.

Related

• The category design playbook — the full method.
• Naming a category — how to choose the term.
• Case study: iluminr — Capability Intelligence, named and analyst-recognized.
• Case study: Fusion Risk Management — operational resilience narrative.
• Category design and go-to-market services — the engagement behind this work.