Cybersecurity has never suffered from a shortage of villains. For years its advertising departments kept a small theatrical company on retainer: the figure in a black hoodie, the glowing red lock, the malicious spider creeping across an unfortunate laptop. David Howell found the cast tiresome. In 2017, while leading corporate marketing at Forcepoint, he helped launch a campaign that replaced the costume drama with people. The idea was plain enough to feel radical: if human behavior sits at the center of security, perhaps humans ought to appear in the picture.
Howell called the campaign “Protecting the Human Point.” It focused on the moments when people meet sensitive data and intellectual property, and on the intent behind their behavior. The creative work was bright, positive and conspicuously short on lurking criminals. “People are central to how we approach cybersecurity,” he wrote at the time. It was both a brand statement and a useful summary of the career that followed.
Now chief marketing officer at Boston-based Legit Security, Howell is dealing with a character more complicated than the hoodie. AI coding agents are productive, obedient and occasionally reckless. They can write software at a pace that makes old development cycles look courtly. They can also reproduce insecure patterns, expose secrets and enlarge the pile of findings that application-security teams must sort. The marketing challenge is to explain where speed needs judgment without casting AI as hero or villain.
“Context rules all.”David Howell, writing about Legit Security’s move into agentic AppSec, 2026
A career built at the change of vocabulary
Howell’s route to this problem began in public relations. Starting in 1999, he worked at Citigate Cunningham and then WE Communications before moving in-house to RSA Security. At RSA he crossed from public relations into product marketing, the point where a story has to survive contact with a product sheet, a sales conversation and a skeptical buyer. A former colleague later described him as a “go-to guy” who was driven, coachable and demanding but fair.
Raytheon widened the frame. Howell held roles spanning public relations, integrated marketing, global communications and branding, and marketing for the company’s cyber-products business. A short turn at Leidos sat inside that period. Then came Forcepoint, where the human-centered campaign made his philosophy unusually visible: technical credibility did not require creative gloom.
The language changed. The job remained translation.
RSA, Raytheon, Forcepoint, ZeroNorth, ThreatX and Legit Security form a tour through the market’s changing priorities.
After Forcepoint and a period of consulting, Howell joined ZeroNorth in 2019. The company occupied the then-young territory between development and security. His brief included differentiated DevSecOps positioning, a multi-channel marketing engine and alignment across the leadership team. Recruiting a product marketer offered a small example of his operating style: the search began with a sharply defined profile and a value proposition for candidates, then filtered for relevance before interviews. Less theater, more fit. Harness acquired ZeroNorth in 2021.
ThreatX was next. As CMO from late 2021 through 2023, Howell helped the company sharpen its place in web-application and API protection and build a digital-first demand engine. When he joined, he said his goal was to build on the foundation already there and push the brand higher. The phrase “build on” matters. Howell’s public work rarely treats a rebrand as an act of corporate amnesia. Heritage is raw material.
The CMO as coach, literally
A list of Howell’s volunteer roles reads like the calendar of someone who keeps spare whistles in the glove compartment. He has coached youth football, basketball and soccer in Natick, managed a fourth-grade Destination Imagination team through STEAM challenges and handled social media for a youth soccer organization. In 2026 he joined the board of Natick Youth Football.
The connection to his office work is not mystical. Coaching makes priorities public. Roles must be understood, feedback must be usable, and the group has to survive a poor play without turning it into a philosophy of doom. Howell’s account of a 2023 ThreatX offsite stressed customer focus, team over self, respect, listening and openness to contrarian viewpoints. These are sensible values. They are also practical instructions for getting a mixed team of product marketers, security practitioners, content specialists and customer leaders through a debate.
Then there were the 27 sixth graders from Dorchester who visited ThreatX’s Boston office for a career day. Four workshops introduced sales, coding, messaging and marketing. Howell helped with the marketing session and reported that the students absorbed the ideas quickly. He also recorded the day’s other firm result: the pizza was a hit. There is an executive lesson here, though he mercifully did not call it one. A complicated industry becomes less forbidding when people open the door and explain the work.
Listen to understand. Welcome a healthy critique. Keep the customer in the room, even when the customer is not in the room.
Show the person affected by security. Leave the stock-photo hacker to enjoy his hoodie in private.
AI arrives, carrying a very large backlog
Howell joined Legit Security in January 2024. The company had begun with software-supply-chain security: mapping repositories, pipelines, secrets and the other machinery touching the software-development lifecycle. As application security posture management became a distinct market, that map supplied context. A finding marked critical by a scanner might matter less than a reachable flaw in a business-critical service. Security teams cannot fix everything; deciding what deserves attention is the job.
AI multiplied the urgency. More code could now enter the factory, and attackers gained automation of their own. Legit’s answer expanded in stages: an AI Command Center in 2024, broader AI discovery and context in 2025, autonomous remediation agents in June 2026, and VibeGuard 2.0 that August. The company’s newer pitch begins at the developer endpoint, where coding agents operate, then follows code through production. It aims to discover AI tools, apply policy, prioritize risks and validate fixes.
Howell’s role is to make this sequence cohere. His August essay announcing Legit’s refreshed identity begins with continuity rather than novelty. The software-factory map came first; contextual prioritization grew from it; agentic security is the next demand on the same foundation. “Your brand is how you look, how you sound, how you act, how you respond and how you are perceived,” he wrote. In this telling, a rebrand makes the outside description catch up with the inside work.
A category changes when its vocabulary becomes useful. Howell’s recurring move is to replace a symbol of fear with a reason to act.
That does not make the work modest. “Agentic AppSec” is an ambitious category claim, and claims have to earn their nouns. Legit’s June launch said its remediation agents could prioritize vulnerabilities with organizational context, generate fixes, validate them and open pull requests across affected repositories. In August, the company positioned VibeGuard 2.0 around securing coding agents where code is created. Marketing must establish what these agents do without allowing “AI” to dissolve into glitter.
Howell’s older campaigns offer a clue to the method. Forcepoint focused on the moment a person met data. ZeroNorth focused on security inside modern development. ThreatX focused on applications and APIs exposed to attack. Legit now focuses on the moment an AI agent creates or repairs code. Each frame chooses a point of action. Each gives an abstract market a place where something happens.
Credit, shared in public
CMOs are professionally adjacent to spotlights, but Howell’s posts tend to widen the beam. His ThreatX offsite recap named six colleagues. His account of the VibeGuard launch video’s 2026 Communicator Award of Distinction credited content leader Suzanne Ciccone, producer Tim Bradley and the Pennant Video team. His ZeroNorth recruiting testimonial praised the search partners. This may simply be good manners. Good manners, unlike brand frameworks, require no diagram and remain curiously difficult to automate.
The same instinct shapes his stated aspiration for Legit: make agentic AppSec the default way security teams keep pace with AI-led development, so they can move quickly and securely. The formulation rejects the lazy choice between innovation and control. It also places the outcome with the team doing the work, not with the acronym on the slide.
Cybersecurity’s imagery will change again. The hooded hacker already looks like a prop from a touring production. AI’s shimmering robot brains will eventually join it in the cupboard. Howell’s career suggests that the durable story will be less cinematic: a person, a decision, enough context to choose well, and a team prepared to act before the alarm becomes the plot.