Market Structure & Sub-Segments
The cybersecurity market is organized around what is being protected and how. Funding and analyst taxonomies converge on six top-level domains, each containing multiple consolidating sub-segments. Vendor detail lives in Vendors, and segment sizing (and why headline TAM figures disagree) is covered in TAM & Market Sizing.
The six domains (analyst-standard taxonomy)
- Network Security — firewalls, NGFW, IDS/IPS, NDR, SASE/SSE, ZTNA, microsegmentation.
- Endpoint Security — EPP, EDR, XDR, mobile/IoT, device management.
- Identity & Access Management (IAM) — SSO, MFA, IGA, PAM, CIEM, non-human/machine identity, identity threat detection (ITDR).
- Data Security — DLP, encryption, DSPM, data classification, tokenization, backup/recovery.
- Application Security — SAST/DAST, SCA, API security, software supply chain, ASPM, secrets management.
- Security Operations — SIEM, SOAR, threat intel (TIP), MDR/XDR services, vulnerability management, attack surface management (ASM), BAS.
Cross-cutting layers that don't fit one box: Cloud Security (CSPM, CWPP, CNAPP, CIEM), GRC (governance, risk, compliance, TPRM), OT/ICS Security, Email/Collaboration Security, and the fast-emerging AI Security (model security, AI-SPM, prompt-injection defense, AI governance).
Consolidation map
| Sub-segment | Consolidation stage | Dynamics | relevance |
|---|---|---|---|
| Platform / XDR | Late, oligopoly forming | CrowdStrike, Palo Alto, Microsoft, SentinelOne absorbing point tools | Targets = point vendors being rolled up |
| Cloud security (CNAPP) | Mid, hot | Wiz→Google ($32B) reset the bar; Palo Alto, CrowdStrike acquiring | High multiples; sell-side opportunity |
| Identity (IAM/PAM) | Mid → late | Palo Alto–CyberArk ($25B); machine identity exploding | Strategic premiums; many sub-scale targets |
| SecOps / SIEM | Active reshuffle | Google–Mandiant/Chronicle, Cisco–Splunk, Exabeam–LogRhythm | Legacy SIEM displacement = carve-outs |
| MDR / managed services | Early-mid, fragmented | 40k+ MSSPs in US; roll-up thesis intact | Prime buy-and-build white space |
| OT/ICS security | Early | Armis→ServiceNow ($7.7B); Dragos, Claroty independent | Scarcity of scaled assets |
| Email security | Late | Proofpoint (TB), Mimecast (Permira), Abnormal scaling | Barracuda's home turf |
| GRC / TPRM | Fragmented | Many sub-$50M ARR tools; AI rewriting the category | Roll-up + displacement |
| AI security | Nascent | ProtectAI→Palo Alto; land grab underway | Early sell-side; founder-led |
| Exposure mgmt / ASM / BAS | Early-mid | Tenable, Rapid7 consolidating; Pentera, Cymulate scaling | Acquirer demand rising |
The platformization thesis
A dominant structural force is platform consolidation: large vendors (Palo Alto's "platformization" strategy, CrowdStrike's Falcon platform, Microsoft's bundling, Cisco) are converting best-of-breed point markets into modules of an integrated suite. This creates a predictable deal pattern:
- Platforms buy capabilities to fill module gaps (drives strategic premiums).
- Point vendors face a "sell or be commoditized" clock as bundling erodes standalone demand.
- Sub-scale vendors ($5–50M ARR) become acqui-hires or distressed sales if they miss the window.
White space & emerging categories (watchlist)
- Non-human / machine identity — workloads, agents, secrets outnumber humans 50:1; CyberArk, Aembit, Astrix.
- AI security & AI governance — securing models, agents, and AI-SPM; ProtectAI, HiddenLayer, Lakera, Robust Intelligence (Cisco).
- Data security posture (DSPM) — Rubrik, Cyera, Varonis, BigID.
- Browser security — Island, Talon (Palo Alto), Seraphic.
- Autonomous SOC / agentic security — the 2026 frontier; ties directly to The Agentic Edge thesis.
Drill-downs under this chapter: TAM & Market Sizing — sizing each segment and why headline TAM figures disagree; The Six Domains Explained — what each domain defends, how its vendors earn revenue, and its consolidation stage; Industry History — the five eras (AV → perimeter → endpoint/cloud → zero-trust → agentic) and the migrating control point; Geographic & Regional Breakdown — where demand lives (US & Europe) versus where supply is built (US & Israel), and the cross-border M&A flows between them.
Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.