Eleven of 20 cybersecurity homepages we opened on 28 October 2026 scored zero on clarity: the first screen named no product category, no buyer and nothing concrete the product does. Four of those eleven led with an event, a webinar or a launch broadcast instead of the product. Only seven of 20 heroes named a category a buyer would search for.
Below are the nine tests, every measurement, and what the three top scorers, SentinelOne, Wiz and Vanta, do that others could copy. The tests are the same ones we used on B2B SaaS and legal tech homepages, so the samples compare directly.
The rubric: nine pass or fail tests
Each test passed scores one point, so each dimension scores 0 to 3 and the total is out of 9.
Clarity, three tests. C: the hero names a product category buyers already use. A: it names who the product is for, as a role, team or company type. S: it gives one concrete specific, such as named functions, a standard or a number. The basis is Nielsen Norman Group's first homepage guideline, which asks for a tagline that "summarizes what the site or company does", famous companies included.
Speed, three tests. Time to first byte of 0.8 seconds or less, web.dev's "good" line. HTML transfer of 155 KB or less, and of 78 KB or less: the 90th and 75th percentiles of mobile home page HTML in the Web Almanac's 2025 page weight chapter.
Demo path, three tests. A demo, sales or trial form one click or less from the first screen; five fields or fewer on its first step; and a stated call length or response time.
Clarity method. The hero means the headline, the line under it and any label directly above, read in a headless Chrome window at 1,024 by 768 pixels without scrolling. Where a carousel rotates, we scored the slide on screen when the page settled. Cookie banners were ignored. Abnormal's homepage would not render in our browser, so we read its hero from the served HTML.
Speed method. Five curl requests per homepage between 11:14 and 11:16 UTC from one connection in Serbia, taking the median time to first byte and the median gzip size of the HTML document. Huntress answered curl with a bot-protection page (HTTP 403), so its speed is n/a.
Demo path method. We followed the most prominent demo, sales or trial action and counted visible text boxes, dropdowns and text areas on the first step, in a rendered browser at 1,280 pixels wide. Hidden fields and consent boxes do not count. We submitted nothing. 1Password's form would not render on the day, so we used the nine fields we counted on its page three days earlier.
The scorecard: clarity and speed
Letters show which clarity tests a hero passed. Platform comes from our CMS check of 80 security vendors, run the same week.
| Site | Product | Platform | Clarity | Passed | TTFB (s) | HTML (KB) | Speed |
|---|---|---|---|---|---|---|---|
| CrowdStrike | Endpoint and XDR | Adobe Experience Manager | 0 | none | 0.24 | 56 | 3 |
| SentinelOne | Endpoint, identity, cloud | Next.js, Contentstack | 3 | CAS | 0.14 | 54 | 3 |
| Huntress | Managed SOC | Not identified | 2 | CS | n/a | n/a | n/a |
| Arctic Wolf | Managed detection | WordPress | 0 | none | 0.72 | 79 | 2 |
| Palo Alto Networks | Network and platform | Adobe Experience Manager | 1 | C | 0.33 | 122 | 2 |
| Fortinet | Network security | Adobe Experience Manager | 0 | none | 0.35 | 51 | 3 |
| Zscaler | Zero trust | Drupal, Next.js | 1 | C | 0.26 | 68 | 3 |
| Netskope | SASE | WordPress | 0 | none | 0.13 | 174 | 1 |
| Darktrace | AI threat detection | Webflow | 0 | none | 0.07 | 380 | 1 |
| Okta | Identity | Adobe Experience Manager | 0 | none | 0.09 | 44 | 3 |
| 1Password | Access management | Next.js, Contentful | 2 | CS | 0.13 | 36 | 3 |
| Wiz | Cloud security | Next.js, DatoCMS | 2 | AS | 0.14 | 103 | 2 |
| Orca Security | Cloud security | WordPress | 0 | none | 0.15 | 222 | 1 |
| Snyk | Application security | Next.js | 1 | S | 0.30 | 49 | 3 |
| Proofpoint | Email and data security | Drupal | 0 | none | 0.25 | 70 | 3 |
| Abnormal | Email security | Next.js, Contentstack | 0 | none | 0.31 | 80 | 2 |
| KnowBe4 | Security awareness | HubSpot CMS | 0 | none | 0.11 | 26 | 3 |
| Rapid7 | MDR | Next.js, Contentstack | 1 | C | 0.56 | 78 | 3 |
| Tenable | Exposure management | Drupal | 0 | none | 0.09 | 47 | 3 |
| Vanta | Compliance automation | Webflow | 2 | CS | 0.07 | 73 | 3 |
Source: Octo Agency, headless browser read and five curl runs per homepage, 28 October 2026; raw file OB-0164-cyber-scorecard-2026-10-28. Rapid7's HTML was 77.6 KB, Arctic Wolf's 78.9 KB.
The scorecard: demo path and totals
| Site | Form | Clicks | Fields | Timing stated | Demo path | Total |
|---|---|---|---|---|---|---|
| CrowdStrike | Contact sales | 2 | 8 | No | 0 | 3 |
| SentinelOne | Demo | 1 | 8 | No | 1 | 7 |
| Huntress | Demo, multi-step | 1 | 5 | No | 2 | 4 of 6 |
| Arctic Wolf | Demo | 2 | 5 | No | 1 | 3 |
| Palo Alto Networks | Contact sales | 2 | 9 | No | 0 | 3 |
| Fortinet | Contact sales | 1 | 8 | No | 1 | 4 |
| Zscaler | Demo | 1 | 3 | No | 2 | 6 |
| Netskope | Demo, behind a chooser | 2 | 9 | No | 0 | 1 |
| Darktrace | Demo, multi-step | 1 | 1 | No | 2 | 3 |
| Okta | Contact sales | 1 | 8 | No | 1 | 4 |
| 1Password | Contact sales | 1 | 9 | No | 1 | 6 |
| Wiz | Email field in hero | 0 | 1 | Yes, 30 min | 3 | 7 |
| Orca Security | Demo | 2 | 7 | No | 0 | 1 |
| Snyk | Demo | 2 | 8 | No | 0 | 4 |
| Proofpoint | Demo | 1 | 8 | No | 1 | 4 |
| Abnormal | Demo | 1 | 7 | Yes, 30 min | 2 | 4 |
| KnowBe4 | Demo | 1 | 7 | No | 1 | 4 |
| Rapid7 | Demo | 1 | 8 | Yes, within 48 hours | 2 | 6 |
| Tenable | Demo, behind a trial chooser | 2 | 4 | No | 1 | 4 |
| Vanta | Email field in hero | 0 | 1 | No | 2 | 7 |
Source: Octo Agency, rendered browser read of each form, 28 October 2026; no form was submitted. Fields counts the first step only. Netskope's and Tenable's forms load in a pop-up, so we counted their published Marketo form definitions.
Clarity: the homepage has become a news feed
The biggest pattern is not vague copy. It is that the top of many security homepages is now a rotating promotion slot. CrowdStrike's first screen was a webinar on the PHP2Shell vulnerabilities, co-branded with OpenAI. Fortinet's carousel had landed on a Security Operations Summit with a date and a "Reserve your spot" button. Darktrace's hero was a launch broadcast. Orca's was a virtual event called the Builder Exchange. Palo Alto Networks showed a slide for one product, Cortex XCOR, which passed the category test only because it calls itself an observability platform.
That suits a returning customer. A first-time visitor from search learns nothing about what the company sells. CrowdStrike's title tag, "We Stop Breaches with AI-native Cybersecurity", is clearer than anything on its first screen.
The rest lean on mood. Arctic Wolf's "Super Instinct Meets Super AI", Abnormal's "We Stop Attacks Others Can't" and Tenable's animated "Tenable sets protection in motion" all score zero. Okta's first screen at 1,024 pixels was a photograph and two navigation buttons; its headline sits below the fold.
AI is everywhere. At least 17 of 20 heroes mention it. That alone does not hurt: SentinelOne opens with "The World Runs on AI. We Secure It." and still scores 3, because the line under it names endpoint, identity, AI and cloud protection and says the platform is for defenders.
Buyers are almost never named. Only SentinelOne and Wiz said who the product is for. Wiz's paragraph says it enables "security teams to operate at AI speed". Huntress came closest to a small-business positioning with "Enterprise-grade cybersecurity for all businesses", but "all businesses" does not count as a buyer.
Specifics sit just out of reach. KnowBe4 puts four strong proof points directly under its hero, including 70,000 customers and 12 security awareness agents, but its headline and subheading name neither a category nor a buyer. Moving one of those bullets into the subheading would add two points.
Vanta's hero is the model of a short one: "Get your compliance together", then "SOC 2, ISO 27001, HIPAA, and 35+ frameworks", automated and monitored. A buyer knows the category and the standards in under ten words.
Speed: fast servers, a few very heavy documents
Time to first byte separated nobody. All 19 measured homepages answered within 0.8 seconds, with a median of 0.15 seconds. Arctic Wolf was slowest at 0.72 seconds; its five runs ranged from 0.53 to 1.06. web.dev notes that TTFB is not a Core Web Vitals metric in itself, so this measures the server, not what the visitor feels.
Document weight is where the spread is. The median homepage sent 70 KB of compressed HTML, against the Web Almanac's 33 KB median and 78 KB 75th percentile for mobile home pages. Twelve of 19 came in at 78 KB or less. Three went past 155 KB, and we decoded each to see why:
| Site | Compressed HTML | Uncompressed HTML | Largest inline parts |
|---|---|---|---|
| Darktrace | 380 KB | 1,926 KB | 759 KB inline SVG, 443 KB inline CSS |
| Orca Security | 222 KB | 1,020 KB | 628 KB inline SVG |
| Netskope | 174 KB | 1,600 KB | 1,047 KB inline CSS |
Source: Octo Agency, curl fetch of each homepage and byte count by element type, 28 October 2026
None of this is exotic. Moving the large SVGs to image files and linking the stylesheet so it can be cached would put all three near the sample median. Darktrace and Vanta both run on Webflow, which we build on, so read this with our bias in mind: Vanta, on the same platform, sent 73 KB. The platform did not decide the weight; the build choices did.
Our B2B SaaS website speed statistics cover the field data side for a wider set of software sites.
Demo path: security forms are long, and two clicks is common
Thirteen of 20 sites put a form one click or less from the first screen. Wiz and Vanta put an email field in the hero itself, so the first step is already on the homepage.
The menu costs a click. At 1,024 pixels wide, CrowdStrike, Arctic Wolf, Palo Alto Networks, Orca and Snyk collapse their navigation into a menu, and none has a demo button in the hero, so a form takes two clicks. At 1,280 pixels, Palo Alto's "Demos and Trials" button is visible. Netskope and Tenable add a chooser page: Netskope's "Get Started" opens a list of four options, and Tenable's "Try" opens a product grid before the demo pop-up.
Seven or eight fields is normal here. The median first step asked 7.5 fields, against five in our SaaS sample. Ten of 20 asked eight or more; Palo Alto, Netskope and 1Password asked nine. Seven passed the five-field test, and three of those, Darktrace, Wiz and Vanta, start with an email address alone. Our web form conversion statistics cover what each extra field tends to cost.
The best published field-count data is thin and comes from a vendor. Factors.ai, which sells analytics, reports that demo forms with four to six compulsory fields had a 51% success rate, against 41% for one to three and 30.60% for seven or more, from what it describes as over 50,000 web sessions. Read it as a reason to cut the seventh and eighth fields, not to add a fourth.
Almost nobody says what happens next. Wiz and Abnormal both promise a 30-minute personal demo. Rapid7 says it will be in touch within 48 hours to schedule the session. Proofpoint and Netskope say "shortly" and Fortinet says "soon", which do not count. Darktrace promises a callback to book a one-to-one demo but gives no timing. Chili Piper, which sells scheduling software, reports from nearly 4 million form submissions that letting buyers book straight after the form lifts booking from 30% to 66.7% on average. Our demo request conversion rates post covers the rest of that funnel.
How cybersecurity compares with B2B SaaS and legal tech
The same nine tests ran on 24 B2B SaaS homepages on 18 October and 20 legal tech homepages on 21 October. Our post 24 B2B SaaS websites scored on clarity, speed and demo path has the full SaaS scorecard; the legal tech one is 20 Legal Tech Websites Scored on Speed, Clarity and Demo Path.
| Measure | Cybersecurity, 20 sites | Legal tech, 20 sites | B2B SaaS, 24 sites |
|---|---|---|---|
| Median total, of 9 | 4 | 5 | 5 |
| Hero names a category | 7 of 20 | 9 of 20 | 14 of 24 |
| Hero names the buyer | 2 of 20 | 8 of 20 | 7 of 24 |
| Clarity score of zero | 11 of 20 | 6 of 20 | 3 of 24 |
| Median time to first byte | 0.15 s | 0.10 s | 0.34 s |
| HTML over 155 KB | 3 of 19 | 1 of 19 | 9 of 23 |
| Median first-step fields | 7.5 | 6 | 5 |
| Call length or response time stated | 3 of 20 | 3 of 19 | 3 of 23 |
Source: Octo Agency scorecards, 18, 21 and 28 October 2026. The SaaS speed figures are one curl run; the others are medians of five.
Security vendors are the least likely of the three to say what they sell or who it is for, and they ask the most of a visitor who wants a demo. Our reading, not a measured finding, is that these homepages are tuned for existing buyers and large sales teams.
What this means for a cybersecurity website
Run the tests on your homepage and two competitors; each site takes about 30 minutes.
1. Read the first screen as a stranger, carousel included. If the slide on screen is an event, either give the event a smaller strip and keep a product headline above it, or make sure the line under it names the category.
2. Name the buyer once. Security teams, IT at a small business, compliance owners, developers: two words in the subheading cover the audience test.
3. Weigh the HTML. Anything over 155 KB usually hides inline SVG, inline CSS or embedded data.
4. Walk the demo path at 1,024 pixels. If the navigation collapses, put a demo button in the hero. Cut the first step to five fields or fewer, and add one sentence on call length if you can keep the promise.
When we build a security vendor's marketing site in Webflow, we would run these nine tests on staging before launch, as we would for any B2B site. Our marketing website service explains how we scope that work.
