SAN FRANCISCO — CyberArk ( CYBR ) CEO Udi Mokady surveyed the crowd. A man decked in a traditional Native American headdress passed the booth — his movement highlighted by the nearby fire-truck-red semitrailer that Fortinet ( FTNT ) rolled in as its booth, and Palo Alto Networks ‘ ( PANW ) towering blue signage. Tweeted photos show a bright orange fox touting social media security firm ZeroFOX. Open-source manager Black Duck Software handed out “No ducks” T-shirts. And the entire event was overshadowed by a Terminator-Darth Vader mash-up mascot. “A lot of CEOs don’t even walk the floor,” Mokady told IBD at the annual cybersecurity RSA Conference in San Francisco’s Moscone Center convention hall. “But there are a lot of meetings that set the tone for the year, (there are) relationships happening behind closed doors.” If the RSA Conference sets the tone for the cybersecurity industry , 2016 will be marked by roaring noise — mostly in marketing. But execs tend to agree the overarching themes for the year will center on technological leaps and possible collaboration. Platform, Platform, Platform “Platform” is a buzzword for a reason, Needham analyst Scott Zeller wrote in a research report after Palo Alto Networks last month crushed Wall Street’s Q2 expectations. The broad-based platform approach works in security. But Palo Alto wasn’t the only vendor lauding its platform-centric approach at the RSA Conference. An overwhelming majority of companies — IBM ( IBM ), FireEye ( FEYE ) and Fortinet included — touted their platforms. Consumers are confused, Fortinet threat researcher Derek Manky told IBD. That’s where third-party testing comes into play. Fortinet calls it a “security fabric,” which integrates Fortinet’s firewall with threat intelligence data from FortiGuard researchers. “We can say how good we are, but there are a lot of third-party vendors that are doing validation of security,” he said. A recent test by NSS Labs ranked Fortinet’s FortiGuard 3200D and Check Point Software Technology ‘s ( CHKP ) 13800 NGFW Appliance as top products, blocking 99.6% of all exploits. The lab examined 13 leading products comprising 96% of the next-generation firewall market. Palo Alto Networks’ PA-7050 scooted in with 95.9% effectiveness, trailing a Juniper Networks ( JNPR ) offering and two Cisco Systems ( CSCO ) products with a respective 98%, 96.5% and 96.3% scores. Confusion is lending itself to the advent of software-as-a-service (SaaS) offerings, former iSight Partners CEO John Watters told IBD. FireEye acquired iSight in January for $275 million and retained Watters and much of the iSight leadership team. Watters sees SaaS making a play for the platform market. “The big trends line is customers are moving from best-in-class niche product to best-in-class platform,” he said. “And they’re moving from a self-serve model to an as-a-service model.” That shift benefits FireEye. New FireEye-as-a-Service billings nearly doubled in 2015 vs. 2014, CFO Michael Berry told analysts during the company’s Q4 earnings conference call in February. Data Sharing … Or Not Palo Alto Networks, Fortinet, Intel ( INTC ) Security and Symantec ( SYMC ) are leading a sector push to share threat intelligence data across the map. In 2014, the quartet became odd bedfellows in a security collaboration dubbed “the Cyber Threat Alliance.” Davis Hake, Palo Alto Networks director of cybersecurity strategy, told IBD the group’s goal is to reduce the noise generated by low-level, easy-to-launch attacks. “We take that data back out, and we work to democratize it with the rest of the security community,” he said. “It allows us to understand, across the community, attackers’ game plans against all of these other entities.” Palo Alto Networks CEO Mark McLaughlin, on the company’s recent earnings call, said the days of monetizing threat data are over. A company’s value stems from its overall platform, he says. Watters disagrees: “All the people that are driving sharing are people who don’t have a bunch of intellectual property,” he said. “Everybody is filling up each other’s in-boxes with all the same stuff. It’s all the machine-generated event data.” ISight fits into a detection hole in FireEye’s model, he explained. “We detect … everything that leads up the time they hit enter on the keyboard,” he said. “As soon as they hit enter, we went blind because we didn’t have attack surface monitoring.” FireEye’s incident response leg, Mandiant, sees the attack itself, watching how hackers escalate privileges, jump firewalls and burrow through systems. ISight detects the attack prep and follows the fallout on the black market. That intelligence is proprietary, Watters said. Because of that, FireEye doesn’t need to reboot its software every several years; the software is updated every hour. Fortinet makes a similar boast, noting its FortiGuard research updates systems every five minutes. Big Data, Internet of Things and AI Artificial intelligence (AI) won’t look like Haley Joel Osment in the 2001 Steven Spielberg flick. Rather, machine-learning will be bolstered by data-heavy Internet of Things devices, Sol Cates, chief security officer for encryption specialist Vormetric, told IBD. The trend could boost the chip sector. Tesla Motors ( TSLA ) partner Nvidia ( NVDA ) forged alliances with Facebook ( FB ) and Chinese Internet major Alibaba ( BABA ) during Q4 for speedy intelligence chips, Nvidia CFO Colette Kress said during last month. Just as “platform” is a commonplace buzzword, so too are Big Data, the Internet of Things and the cloud, Cates says. But they’ll also be integral to future technology — and that’s either a boon or a bust for the cybersecurity industry. AI generates two big questions for the sector, Cates said. “How do we protect the sensitive data going in? And how do we harness it for security?” he asked. The problem is, the cybersecurity industry often trails innovation. “We have to figure it out after the fact, and we’re not yet experts on it.” IBM, which just acquired Resilient Systems , plans to push machine-learning to accelerate automated penetration testing, Marc van Zadelhoff, the company’s security general manager, told IBD. Penetration testing — purposefully probing a system for vulnerabilities — will become more and more necessary in the security world as the BYOD (bring your own device) trend opens more endpoints. Gemalto exec David Etue argued during an RSA lecture that software updates could right the likely-to-occur wrongs as the cybersecurity sector tackles the Internet of Things market. “If we get this right, this puts us in a position for long-term success,” he said. Fortinet’s Manky says wrangling the Internet of Things and protecting Big Data will be more complicated than that. Industry experts estimate 20 billion-30 billion Internet-capable devices will come online in the next four years. “That generates a lot of noise, and there’s a lot of traffic, you need to inspect all of that,” Manky said. “Anything and everything is a target now. … If you think of any device that has an Internet connection, it’s got memory, it has a processor and a connection, and that’s all hackers need to go after (it).”