Why Buyers Remember Solving a Demo, Not Watching One

Key Takeaways

• Security demos fail on format, not product. A passive walkthrough loses buyers fast, because watching is the one job people are worst at holding.
• A demo that floods the room is the same mistake as a SOC that floods the analyst. Too much visibility, not enough action.
• Buyers retain what they figure out. Active, hands-on learning beats passive viewing, confirmed across 225 studies in a 2014 PNAS meta-analysis.
• Investigation-style demos build trust and convert. Letting a buyer solve an attack gives them proof they found, not a claim they have to take on faith.

I recently sat down with Upwind Solutions Architect, Evan Grace to learn more about his process. After some intros, he told me about his new hobby, hydroponics. For those who don’t know, hydroponics is a method of growing plants without soil. This was unbelievable to me but after Evan explained his deep dive into videos, setup guides, any research he could get his hands on, I began to conceptually understand. But he went on to explain that to really understand hydroponics, you have to get your hands dirty. His trail of deceased plants can attest to this. 

This had me thinking about the way the security industry treats demos. Defensive security isn’t always intuitive, yet we treat the teaching of it as if buyers don’t need to get their hands dirty. 

A security demo works best when the buyer investigates an attack instead of watching one. Buyers remember what they solve for themselves, which is why hands-on, investigation-style demos hold attention and earn trust where passive walkthroughs lose both.

I’ve sat through a lot of security demos. Leading a company in this space and spending a few years working with hundreds of security teams will do that to you. And the pattern is almost always the same. We keep trying to make the demo better by making it slicker. Tighter story, better pacing, a more dramatic attack, one more thing that lights up red on the screen. Yet, the buyer still drifts.

I’ve learned over time that the fix isn’t more polish, it’s to meet people where they’re at. 

That sounds like more work for them, but it’s actually the opposite. I’ll elaborate on this because the data here is interesting and I think it’ll change how you run your next demo.

Nobody tunes out because the product is weak

Watch most security demos and you see the same thing every time. The first attack lands and people are with you, but by the third attack, eyes go to phones or minds start to drift. This isn’t because a product is weak. It’s because the buyer’s only job in the room is to sit and be impressed, and that’s a job nobody is good at for very long. 

It’s also a job buyers are openly trying to quit. Gartner surveyed 646 B2B buyers in 2025 and found that 67 percent would rather buy with no sales rep involved at all, and 70 percent want a fully digital, self-service path. That’s not a knock on salespeople, it’s a clear signal about how people want to engage. They want to get their own hands on the thing and play around. By Gartner’s own count, buyers spend only around 17 percent of the entire buying journey actually meeting with any vendor, and most of them would shrink that number if they could. Not to mention, buyers have more access to information now. All they have to do is go ask their neighborhood chatbot what it thinks about any given sector of vendors and they can have a full breakdown in seconds. By the time a real practitioner talks to a salesperson, they have done a solid portion of their research. 

So when you sit a buyer down and ask them to watch a demo, you’re working against the exact instinct they walked in with. Attacks are all hands on deck in real life, but spectacle is passive by design. Or think of it like this: a demo with a wall of features and flows  is a fireworks show. Nice to look at, forgettable by the time people reach their cars in the parking lot.

The interactive demo industry has measured this for years, and the gap is large. Demand Metric’s content research found interactive formats convert roughly twice as well as passive ones. Arcade’s own benchmark puts interactive demos at about seven times the click-through of a plain walkthrough video. These are industry and vendor numbers, so hold the exact figures loosely. The direction is the part that holds, and it lines up with what Gartner documents about buyers, who increasingly want to vet a product themselves before a rep is ever in the room. Simply put, there’s a difference between watching someone cook and cooking yourself.

There’s a trust layer underneath this, and it should worry every vendor. Gartner found that 69 percent of B2B buyers run into inconsistencies between what a company says on its website and what its sellers say out loud. Read that again. Most buyers have already caught vendors contradicting themselves, so most of them have stopped taking the pitch at face value. When you tell a skeptical buyer your product stops an attack, you’re spending trust you may not have. When you let them watch it stop the attack and then allow them to prove to themselves how, you are not asking for trust at all. You’re handing them the evidence to build their own trust with your product.

You can have the best risk narrative in the category and still lose the room, because the room was never the problem. The problem was in the role you handed them from the beginning. Let them cook.

The demo and the alert queue fail the same way

This part may sting a little because it’s the same mistake the industry has spent years making inside the product itself.

A loud demo and a noisy alert queue are the same miss. Both bury a person in events and ask them to be impressed instead of helping them understand. The buyer who checks out at attack three is the same human, in the same posture, as the analyst who checks out at alert three hundred.

This is the thing a lot of security tools got backwards. They were built with too much of a security mindset and not enough of an operations mindset, so they shipped a deluge of dashboards and findings and called it visibility. Too much visibility, not enough action. The actual job runs the other way. It’s cutting three thousand findings down to the handful that matter and telling someone exactly what to do about them. A demo is that same job, just performed live.

And we have the numbers on what all that noise does at scale. Vectra AI’s 2026 research puts the average organization at nearly 3,000 security alerts a day, with about 63 percent of them never getting touched.

The 2025 SANS Detection and Response Survey found 73 percent of security teams now rank false positives as their single biggest detection problem, up sharply from the year before. Microsoft and Omdia’s 2026 State of the SOC report put it plainly: roughly 46 percent of all alerts turn out to be false positives, so nearly half of an analyst’s day produces no security value at all. Pull the surveys together and roughly 40 to 60 percent go uninvestigated, for the dumbest possible reason, which is that there are simply too many of them to look at.

Sit with that for a second. If a flood of events loses trained defenders inside a real SOC, where the stakes could not be higher, what makes anyone think a flood of events will hold a buyer’s attention in a calm room where the stakes are zero?

A demo that drowns people and calls it value has the same flaw as a product that drowns people and calls it visibility. Volume is not understanding, it never was. The passive demo is just the smaller, friendlier version of the problem we’re all supposed to be solving. Which is why how you run a demo quietly tells the room how you actually think about defense.

So flip it and hand them the keys.

Flip the whole thing. Why not?

Don’t narrate the attack for them, let them work it as it surfaces. Then hand over the keys. Here is what’s running, something got in. Want to see if you can spot how?

Now the buyer isn’t just watching. They’re working the problem out. They follow a thread, hit a wall, find the open port, trace what moved where and when. There are a few questions guiding them under the hood. Which port did they come in through? What was the authentication on the API they hit? What moved laterally after that? But it never feels like a quiz, because nobody is standing over them with a red pen. It feels like the good kind of puzzle, the one you don’t want to put down.

The security world already knows this format inside out. It’s a capture-the-flag challenge, or CTF, and these have been a staple of how the industry trains people for years, because they work. A SANS Internet Storm Center writeup followed a team whose lectures and workshops kept failing to land, with people tuning out and retention sliding. They switched to capture the flag style challenges and watched recall and real on-the-job application climb. A participant who had done both said the hands-on version was far more memorable than the classroom one. Academic studies of CTF in the classroom find the same thing: higher engagement, better retention, learners describing the work as more interactive and more motivating than the passive version sitting right next to it.

This isn’t a thought experiment. It’s already how Evan’s team runs a demo. He described it to me like this: