The cost of doing business at the RSA Conference

Each year, hundreds of vendors head to the RSA Conference in San Francisco, California, arguably the largest security gathering in the U.S. For many of those vendors, the show is a requirement, but there’s a steep cost involved. For smaller companies, the show can create a sink or swim environment.

The 2014 RSA Conference began like any other show. On Sunday, workers and booth staffers moved about in order to put the expo areas together before the floor opened for a preview on Monday night. Outside of the Moscone Center, where the RSA Conference is held, a group of people are standing around smoking, discussing their frustrations with the booth design and building process.

As it turns out, the events team for this vendor didn’t share the details of the extra costs associated with their presence at the show, and they’re concerned over budgets for the week, as well as the rest of the year. They’re a small vendor, so money is tight, but they’re hopeful the show will do some good.

The RSA Conference started in 1991. It was a small gathering then, but in 2014, nearly 30,000 people attended the show, and more than 400 vendors booked space on the expo floor. Saying that the show is massive only scratches the surface; it’s an industry powerhouse when it comes to sales and marketing.

Still, for some security vendors, having a presence at the RSA Conference can be a risky proposition, and money is the largest risk factor.

For example, despite what the Washington Post article would have one believe, $100,000 USD doesn’t get much at the RSA Conference, not if that’s all an organization has to spend for the year in their marketing budget. The Post made a point that “spending $100,000 on a big show to land a multi-million dollar deal is a bargain.”

This would be correct, if multi-million dollar deals were common at the show. But they’re not. The RSA Conference, and shows like it, are a good source for business partnerships between vendors, and a small amount of M&A (mergers and acquisitions) prospecting. Hard sales happen, but they are not all that common on the floor. At best, there is a moderate amount of lead generation, but unless those leads turn into sales, they don’t offer value. For the most part, the RSA Conference has become a good way for vendors to meet existing customers face-to-face.

In a conversation with CSO, one vendor at the show this year (who asked not to be named for this story), said the conference was a vendor love fest two years ago -- meaning booth traffic consisted of people working for other vendors and not potential customers. That’s changed some over time, but not much.

The almost obligatory requirement to appear at the RSA Conference for security vendors has created a premium on expo space. In turn, the demand has become a lucrative business opportunity for the conference itself, as well as the contractors who help with the show.

Based on sponsorship reporting and additional marketing offerings, the RSA Conference pulled in $5,460,000 USD in 2014. This figure includes the amounts paid by the show sponsors in the North hall, as well as the fees collected for additional marketing. The up-sell on marketing can include such things as street banners, placing a company’s logo on the conference badges or hotel room keys, sponsoring the press room, registration area logo placement, and much more.

The going rate for space on the expo floor was $82.50 per sq. foot, and the floor plan was created with 10′ x 10′ blocks as the formatted design, which are $8,250 each.

On 10′ x 10′ booths alone, the conference earned $1,179,750 USD in the South Hall; taking in another $1,336,500 USD on the next most popular size of 10′ x 20′, which are $16,500 each; and $1,980,000 USD on 20′ x 20′ booths that go for $33,000 USD.

[RSA boycott splits security industry on tactic’s effectiveness]

Vendors that didn’t pay for a sponsorship spot were packed into the South hall. This split is a good way to showcase the vendors who essentially footed the bill for the conference, but it also created an atmosphere of the “haves” and “have-nots.” Several vendors remarked about the split during the week. They accepted it as part of the game, but did so begrudgingly.

During our time at the show, CSO observed more foot traffic on average in the South hall, as that is where the majority of the vendors were. It’s also the location were all vendors were placed in previous years, so conference regulars were used to heading in that direction. So it wasn’t clear if the split had any impact, either positive or negative, on the show.

As mentioned, there’s a premium on floor space, and based on what was collected by the conference, it’s clear that vendors are willing to pay to play. But booth size is only part of the total cost. Once the booth order is placed, the vendor will need to pay for other obligated extras.

For a 20′ x 20′ booth, a vendor will need to be prepared to pay local freight ($800 USD) and then booth property rental fees that cover carpet, additional shipping, graphics, and lighting, which are $22,000 USD. To install the booth, and later dismantle it, the vendor will pay an additional $6,800 USD, which we’re told is a rather cheap as far as price goes.

The price for material hanging, sign labor and electrical work will hit about $15,000 USD. Audio and Visual needs, which for one vendor included 6 monitors and a sound system, adds another $5,000 USD. Lead retrieval software, needed if the goal is to scan badges at the booth, adds another $1,500 USD. Extras, such as offering coffee to booth vendors from a cart, will tack on another $5,600 USD for two days.

So in all, excluding the coffee, a vendor with a moderately-sized booth should expect to spend at least $84,100. But there’s more. Other things like trash cans and network drops come at an additional fee too. Finally, the cost to transport, house, and feed the booth’s staff for the week is another consideration, and if there’s plans to give anything away (shirts, pens, etc.), that’ll press the budget harder.

While there’s a real crunch for smaller firms, costs such as those detailed above don’t come close to hindering the larger security vendors. For example, including the cost of sponsorship and marketing, Juniper spent at least $405,000 USD for their appearance at the RSA Conference this year.

[RSAC 2014: Experts discuss the harsh realities of incident response]

However, even companies like Juniper will pay the required extra fees, as well as any additional costs associated with parties, hosted dinners, or the like. Plus, the larger the booth, the larger those fees will be.

So considering the high cost for a single show, do those fees get passed on to the customer? In some cases, yes it will, but most vendors believe this is a bad business practice and said it isn’t a common occurrence. Event budgets are separate from the other business costs and shifting money from R&D for example, is just a bad idea.

Still, none of the vendors CSO spoke with would go on record with a flat denial. So on some levels, it’s a clear case of the more a vendor is forced to spend, the higher product prices will go. It’s also important to note that while the RSA Conference may be the largest show, it isn’t the only game in town. Many vendors attend several shows a year to support their marketing efforts, each one with their own unique costs.

Caught between a rock and a hard place each year, some organizations are faced with a dilemma; blow the budget on the largest show in the U.S., and hope there are residual gains because of it, or skip the show and risk the year’s sales cycle.

Martin McKeay, Security Evangelist for Akamai, put this thought process in perspective earlier this year.

“Any vendor that’s mid-size or larger in the security field has to be at the RSA conference. In many cases, this conference is the keystone for the whole marketing effort of the year,” he said. “Quite frankly, if you’re a security vendor and you don’t have a presence at RSA, you’re not really a security vendor and everyone knows it.”

Smaller booth space is available at the RSA Conference, but smaller booths don’t see that much traffic, so it’s a catch twenty-two. Mirroring McKeay, the aforementioned anonymous vendor said that having a presence at the RSA Conference was a show of force. “If you’re not at RSA, that says something about you.”

But what about attending the show and opting for a smaller booth?

“You get a little visibility being a small player at RSA, but if you don’t have the partnerships, or existing industry ties, RSA isn’t the best use of your marketing budget,” the vendor explained.

In fact, a company would be better off focusing on lead generation to develop said relationships before focusing on attending the show. They could also opt to attend the conference, but focus on face-to-face meetings instead of the expo hall. If there is a bit more in the budget, hosing a dinner or cocktail party is another networking option.

When all is said and done, the decision to attend an event such as the RSA Conference boils down to the overall value it provides. However, given that attendance is almost required, it comes as no surprise when the RSA Conference organizers report that 85 percent of the vendors re-sign their contracts year-over-year. They have to if they want to seriously compete.

For most vendors, the cost of attending a show like the RSA Conference is simply part of the cost of doing business, for others it’s a gamble, but one that many of them are willing to take.

Perhaps the RSA Conference has grown too big. What started as a small conference created to advance and improve the art and science of information security, seems to have turned into a massive business designed to sell the art and science of information security first, with improvements and advancements becoming more of an afterthought.

This is why the demand for secondary security conferences (e.g. BSides events) is growing. Security practitioners are looking for conferences that are less about sales, and more about solving the problems that haunt them at work, networking with peers, and educating themselves and others if possible.