The Consolidation & Aggregation Thesis
Cyber is consolidating in a specific, readable pattern: fragmented supply, structural demand, and a profit pool migrating toward platforms that can aggregate the customer relationship. Applying Ben Thompson's aggregation lens resolves the 400+ deals a year into a small number of nameable, priceable forces.
In 2025, disclosed cyber M&A reached roughly $96B across 400+ deals — a ~270% increase in disclosed value year-over-year — and 2026 opened faster still: the $32B Google–Wiz close (Mar 11, 2026) and the $25B Palo Alto–CyberArk close (Feb 11, 2026) alone accounted for roughly $57B of disclosed value in Q1 2026. (Reported quarterly totals vary widely by source and methodology; the two megadeal closes by themselves exceed most published Q1 figures.) As of mid-March 2026, strategic corporate buyers accounted for over 90% of cyber deal value — a sharp inversion from the PE-led pattern of 2024. (Lyrie Research, 2026; TechCrunch, Mar 11 2026) The central question is whether this is a cyclical M&A spike or a structural consolidation with years left to run. The evidence points to structural, with the strategic-buyer dominance a key indicator.
Why the industry is structurally fragmented (the supply side)
Consolidation requires something to consolidate. Cyber's supply side is fragmented to a degree almost no other software category matches, for reasons that are generative, not accidental — which is why the fragmentation keeps regenerating even as the platforms consolidate it.
Three engines keep producing new vendors. First, the threat surface expands faster than any single vendor can cover it — every new technology layer (cloud, then containers, then SaaS, then AI agents) opens a new attack surface and, with it, a new category and a new crop of specialists. Second, venture capital funds the long tail relentlessly: cyber drew ~$3.8B of VC in Q1 2026 alone, +33% YoY (GlobeNewswire, Apr 2 2026), and the Israeli foundry model industrializes company formation (see Ecosystems & Talent). Third, buyers historically rewarded best-of-breed — CISOs bought the best tool for each problem, which sustained dozens of viable point vendors per category. The result, by 2026, is a market with thousands of vendors, most sub-scale, in categories that overlap — exactly the condition aggregation theory predicts will resolve through consolidation.
The vendor-count paradox (and its resolution). The strongest counter-fact is Richard Stiennon's IT-Harvest census, which tracks the field vendor-by-vendor and finds the total number of cybersecurity vendors keeps rising every year — past 3,750 — even through the record M&A wave. At the population level, the industry is fragmenting, not consolidating. Both are true, and holding them together is the whole thesis: consolidation concentrates revenue, profit, value capture, and the individual enterprise's own vendor list, while the count of companies in existence keeps growing, because the three supply engines above spawn new categories at the modular edge faster than the core absorbs the old ones. Consolidation is a claim about where value pools, not how many logos exist. Anyone who measures the thesis by counting vendors is measuring the wrong variable; the right ones are revenue share, profit share, and the shrinking number of platforms a given buyer actually pays. (This is the empirical evidence for the "pulsing" end-state — see Synthesis and Book Ch 29.)
Aggregation theory, applied to cyber (the demand side)
The supply side explains what there is to consolidate; aggregation theory explains who captures the value when it does. Ben Thompson's framework: in a value chain, the player that owns the end-customer relationship, faces zero marginal cost to serve the next unit of demand, and enjoys demand-side economies of scale (each new customer makes the product better/cheaper for the next) wins disproportionately — it aggregates demand and forces suppliers to commoditize beneath it. In cyber, the aggregator is the platform: PANW, CRWD, Microsoft, Zscaler, Cisco. It owns the CISO relationship, sells the next module at near-zero marginal cost (it's already deployed in the account), and improves with scale (more telemetry → better detection → more customers). The three forces driving aggregation in cyber, in order of force:
CISO vendor fatigue. The average enterprise runs dozens of security tools; integration cost, alert noise, and procurement overhead now exceed the marginal value of the next best-of-breed point product. The buyer wants to consolidate — a demand-side pull the platforms didn't have to manufacture. This is the single most important shift of 2024–26, because it flips the historical best-of-breed bias that sustained the long tail. But the pull is not unqualified: the same CISO trading tool sprawl for a platform also takes on lock-in, weaker renewal leverage, and concentration risk — routing critical controls through one vendor is its own exposure, with the July 2024 CrowdStrike outage the reference case (see 24e). This is why best-of-breed never fully dies — the CISO consolidates the commodity layers and keeps a specialist where a miss is unacceptable — and why consolidation is a negotiated trade from the buyer's seat, not a rout.
Platform gross-margin leverage. Selling module #6 into an account that already has modules #1–5 is near-100%-gross-margin revenue with near-zero incremental CAC. That economic asymmetry lets the platform outbid any standalone vendor for the same revenue — the acquirer can pay an above-market multiple because the revenue is worth more inside its bundle than as a standalone. It is the engine under PANW's ~$8.1B+ NGS ARR and CRWD's $20B-ARR-by-FY36 ambition (see Platform Wars).
The data/AI flywheel. Demand-side economies of scale in their purest form: more customers → more telemetry → better models → better detection → more customers. As security becomes AI-mediated, the platform with the most data compounds an advantage a point product structurally cannot match — and this flywheel is precisely what makes the agentic-SOC race a platform race (see Profit Pools, Agentic SOC).
The consolidation engine — how the forces compound
The exhibit puts the loop together: fragmented, VC-funded supply feeds a market where structural demand and CISO fatigue pull toward platforms; platforms aggregate the customer, capture the migrating profit pool, and use platform multiples + gross-margin leverage to acquire the long tail — which clears fragmentation, even as the expanding threat surface regenerates new fragments at the edge. It is a flywheel with a leak: the platforms consolidate the center faster than the edge regenerates, so the center concentrates over time.
What the thesis predicts — and the falsifiable bear case
If the thesis holds, three things follow, and each is testable. (1) Strategic buyers stay dominant — already true at >90% of value (mid-Mar 2026); a reversion toward PE-led volume would signal the platforms are full or capital-constrained. (2) Acquisition targets cluster in the fast-fragmented edges — cloud, identity, AI-security, OT, managed services — not the mature center; the deal log (see 11) confirms this. (3) The valuation gap between platforms and point products widens — platforms re-rate on aggregation, the tail compresses toward "feature" multiples (see Public Trading Comps).
The bear case — what would falsify the thesis: (a) Regulatory backlash. If antitrust scrutiny (a Google–Wiz-style review that doesn't clear, or action against Microsoft's security bundle) raises the cost of platform consolidation, best-of-breed re-fragments and the loop stalls. (b) The Microsoft bundle is the bear case for everyone else. The most powerful aggregator may be Microsoft, giving away "good enough" security inside E5 — which consolidates demand onto Microsoft rather than onto the pure-play security platforms, hollowing the very companies this thesis treats as winners. (c) The AI layer disintermediates the incumbents. If the agentic-SOC outcome layer commoditizes into the model providers (OpenAI/Anthropic) rather than the security platforms, the profit migrates past the consolidators entirely — the platforms spent a decade aggregating a customer relationship the AI labs then capture. The base case is structural consolidation with years to run; the genuinely unresolved question is which aggregator wins the AI turn — and that is where 2026's largest strategic disagreements (and biggest deals) sit. (See The Bear Case.)
→ Cross-references: Economics, Profit Pools, Pricing & Business Models, Platform Wars, M&A Deals & Comps, Public Trading Comps, Sub-Segment Deep Dives, The Bear Case.
Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.