Case Study
SpyCloud
From the dark web to the dark cosmos — SpyCloud’s 20×20 island at Black Hat 2025 turned the convention floor into deep space, wrapping identity threat intelligence in a cinematic starfield that made cybercrime disruption the most visually commanding story in the Business Hall
Pure Exhibits designed and built SpyCloud’s custom 20×20 island exhibit at Black Hat USA 2025 — Booth #4821 in the Mandalay Bay Convention Center Business Hall — creating a dark, dramatic destination that translated SpyCloud’s “We Disrupt Cybercrime” mission into an immersive cosmic environment. A massive backlit circular hanging sign, LED-trimmed structural perimeter, and starfield-graphic panels framed a four-sided messaging architecture communicating Holistic Identity Threat Protection across Detect, Prevent, Remediate, and Investigate workflows — while natural wood slat accents and tropical greenery softened the high-tech atmosphere for 20,000+ cybersecurity professionals navigating the industry’s premier annual event.
The Challenge
Commanding Attention in a Hall Full of Cybersecurity Giants
SpyCloud arrived at Black Hat USA 2025 with a category-defining challenge: how does an identity threat protection company — trusted by 7 of the Fortune 10, protecting 600+ global customers, and sitting on 875 billion+ recaptured identity assets — translate the invisible, underground world of darknet intelligence into a physical environment that cybersecurity professionals instinctively want to walk into? Unlike endpoint security vendors who can display dramatic real-time attack maps, or network security companies who can visualize firewall dashboards on massive LED walls, SpyCloud’s core value proposition lives in the criminal underground: recaptured breach data, malware-exfiltrated credentials, phishing intelligence, and session hijacking artifacts that most enterprise security teams never see until it’s too late.
The brief for the 20×20 island at Booth #4821 — positioned right by the main entrance — required an exhibit that could communicate a complete product workflow spanning four distinct capabilities (Detect Darknet Exposures, Prevent Identity-Based Attacks, Remediate Exposed Identities, Investigate Cybercrime), showcase deep technology integrations with platforms that Black Hat attendees already use (CrowdStrike, Okta, Splunk, Microsoft Sentinel, Google SecOps, and more), create enough visual drama to compete against Titanium and Diamond sponsors with budgets several multiples larger, and maintain accessibility for three distinct audience segments: the CISO evaluating vendor consolidation, the SOC analyst seeking faster identity exposure remediation, and the cybercrime investigator looking for darknet intelligence capabilities. Pure Exhibits had previously designed SpyCloud’s funnel-shaped booth at MRC 2023 — a creative concept that metaphorically represented SpyCloud’s data pipeline. For Black Hat 2025, the approach needed to evolve: from metaphor to magnitude.
“We disrupt cybercrime. We’re on a mission to stop account takeover, ransomware, session hijacking, and other identity-based cyberattacks — by making darknet data actionable before criminals can exploit it.”
— SpyCloud Mission Statement
The Creative Journey
Deep Space as Design Language
The Cosmic Canopy
The signature circular hanging sign — a massive backlit disc suspended above the island — served as both a wayfinding beacon visible from across the entire Mandalay Bay Business Hall and a brand manifesto in three dimensions. The outer ring carried SpyCloud’s battle cry “WE DISRUPT CYBERCRIME” in bold teal lettering against a black surround, while the inner face displayed the SpyCloud wordmark in clean white. Internally illuminated with LED backlighting, the sign created a gravitational pull effect: a bright focal point floating above the dark cosmic panels below, drawing foot traffic from multiple aisles simultaneously. The circular form — unusual in a convention hall dominated by rectangular hanging signs — reinforced SpyCloud’s position as a company that sees identity threats holistically, from every angle. Combined with the white LED perimeter lighting that framed the entire booth structure like a spacecraft airlock, the overhead installation created a cinematic entrance experience that attendees could identify from hundreds of feet away.
Four-Sided Messaging Architecture
The island’s four exterior faces were engineered as a sequential narrative. The front face led with “Holistic Identity Threat Protection” — the category-defining headline — establishing the what. Side panels introduced the how through SpyCloud’s four-step workflow: Detect (Darknet Exposures), Prevent (Identity-Based Attacks), Remediate (Exposed Identities), and Investigate (Cybercrime). The opposing face presented “Know More, Do Less” alongside use-case specifics including supply chain exposures, insider threats, and account takeover. A dedicated integration panel listed 12+ technology partners — CrowdStrike, Okta, Splunk, Microsoft, Google SecOps, and more — signaling enterprise-grade interoperability. Regardless of which aisle an attendee approached from, they encountered a complete fragment of SpyCloud’s story.
The LED Theater Effect
White LED strip lighting framed every structural edge of the booth — top, bottom, and vertical corners — creating a continuous glowing outline that transformed the dark cosmic panels into what felt like a viewport into deep space. The contrast was deliberate and theatrical: where most cybersecurity booths use LEDs as accent lighting on dark surfaces, SpyCloud’s LED perimeter defined the booth’s entire architectural silhouette against the convention hall. The effect was especially dramatic at distance, where the bright white frame made the booth read as a self-contained environment rather than a collection of panels — a contained universe of cybercrime intelligence glowing against the ambient noise of the Business Hall floor.
Warmth Within the Cosmos
Inside the dark cosmic shell, Pure Exhibits introduced an unexpected counterpoint: vertical natural wood slat panels that created a warm, textured interior contrasting sharply with the space-themed exterior. The wood slats — visible through the booth’s open entry points — functioned as both a decorative accent and a privacy partition for demo stations and meetings happening within. Green tropical plants in white pots flanked the entry points, adding organic life to the technological environment. White bar stools lined the branded reception counter for comfortable, extended conversations. The material contrast was strategic: the dark, dramatic exterior drew attention and communicated cybersecurity authority, while the warm interior communicated that SpyCloud’s solutions — despite operating in the darkest corners of the internet — are accessible, human-centered, and designed to simplify rather than intimidate. Large flat-panel displays and adjustable-arm monitors throughout the interior ran live product demonstrations, allowing booth staff to walk attendees through real-time darknet exposure checks and identity threat remediation workflows.
The full 20×20 island exhibit at Booth #4821 — a dark cosmic environment framed by white LED perimeter lighting, featuring the signature circular “We Disrupt Cybercrime” hanging sign, starfield-graphic panels communicating Holistic Identity Threat Protection, natural wood slat accents, branded reception counter, and multiple live demo stations that brought SpyCloud’s identity threat intelligence platform to the Black Hat USA 2025 Business Hall floor.
Gallery
The Booth in Detail
Booth Walkthrough
Experience the Booth
A full walkthrough of the SpyCloud 20×20 custom island exhibit at Black Hat USA 2025 — showcasing the signature dark cosmic starfield panels, the massive circular “We Disrupt Cybercrime” backlit hanging sign, LED-framed structural perimeter, four-sided messaging architecture spanning Detect, Prevent, Remediate, and Investigate workflows, natural wood slat interior accents, technology partner integration wall featuring CrowdStrike, Okta, Splunk, and Microsoft, branded reception counter, and the full scope of SpyCloud’s Holistic Identity Threat Protection platform brought to life at Booth #4821 on the Mandalay Bay Convention Center Business Hall floor.
Impact & Results
By the Numbers
From the Criminal Underground to the Convention Floor. Cybercrime Disruption Made Visible.
Black Hat USA 2025 brought 20,000+ cybersecurity professionals to the Mandalay Bay Convention Center for the industry’s most technically demanding week. For SpyCloud — the company that pioneered the identity threat protection category and now protects 7 of the Fortune 10 — the 20×20 island at Booth #4821 needed to accomplish something that few cybersecurity exhibits even attempt: make the invisible visible. SpyCloud’s platform continuously ingests identity artifacts from the criminal underground — recaptured breach credentials, malware-exfiltrated session tokens, phishing target lists, and stolen authentication cookies — then transforms that raw criminal data into automated defensive action. It’s a product that operates in spaces most security teams can’t access and acts at speeds most human analysts can’t match. The challenge was translating that into a 400-square-foot physical experience.
The dark cosmic design language was the answer. Where Pure Exhibits had previously built SpyCloud a funnel-shaped exhibit at MRC 2023 to represent the company’s data pipeline, the Black Hat 2025 booth took a more atmospheric approach: the starfield panels and deep-space graphics created an environment that felt like peering into the underground itself — vast, dark, and filled with signals that only SpyCloud can decode. The teal/mint accent color cut through the darkness with precision, highlighting the four-step workflow (Detect, Prevent, Remediate, Investigate) that transforms criminal intelligence into enterprise protection. The massive circular hanging sign acted as a gravitational anchor — “We Disrupt Cybercrime” rotating above the booth like a mission statement written in light.
The technology integration wall — displaying partnership logos for CrowdStrike, Okta, Splunk, Microsoft Defender, Microsoft Entra ID, Microsoft Sentinel, Google SecOps, Cortex XSOAR, Elastic, Tines, Ping Identity, and Active Directory — answered the enterprise buyer’s most critical question before it was asked: does SpyCloud work with what we already have? Inside the booth, live demonstration stations let attendees check their own darknet exposure in real time, while the natural wood slat accents and green tropical plants created pockets of warmth within the cosmic shell — a design choice that reflected SpyCloud’s own product philosophy: operating in the darkest corners of the internet, but delivering outcomes that are clear, automated, and human-centered. In a show hall where white-and-wood booths like Appdome’s chose brightness as their counter-strategy, SpyCloud embraced the darkness — and made it glow.