Vendors / Product Companies
The vendor landscape mapped by category, with the scaled leaders, notable challengers, and M&A posture (net buyer, net target, or independent/IPO-track) for each. Figures are public-market or best-estimate.
Platform vendors (the consolidators)
These vendors drive the majority of large-cap M&A and set the "platformization" agenda.
| Vendor | Ticker / Owner | Posture | Notes |
|---|---|---|---|
| Palo Alto Networks | PANW | Aggressive buyer | Closed CyberArk ($25B, Feb 11 2026) — identity now platform-center; also Chronosphere ($3.3B), ProtectAI, Talon, Dig; "platformization" strategy |
| CrowdStrike | CRWD | Buyer | Falcon platform; module expansion via tuck-ins (Adaptive Shield, Flow) |
| Microsoft | MSFT | Bundler/buyer | Defender/Entra/Sentinel; competes by bundling into E5 |
| Cisco | CSCO | Buyer | Acquired Splunk ($28B, 2024), Robust Intelligence, Isovalent |
| Zscaler | ZS | Buyer | SSE/ZTNA leader; tuck-ins (Avalor, Airgap) |
| Fortinet | FTNT | Selective buyer | Network security + SASE; strong FCF |
| Check Point | CHKP | Buyer | Acquired Perimeter 81, Cyberint, Veriti |
| Broadcom (Symantec) | AVGO | Holder | Enterprise security as cash cow |
These platform vendors constitute the core buyer universe in cybersecurity M&A.
Disruption and the 2026 reset
The vendor landscape is being disrupted on four fronts at once. (Fuller treatment: see Valuation and AI Security.)
- Capital-markets reset. Public cyber stocks corrected ~12–17% in Q1 2026 (median name down ~18% over the year) despite meeting expectations (~14% 2026 growth guidance). Investors who paid 20x+ forward revenue recalibrated toward high-single-digit multiples; CrowdStrike had entered the year above 100x forward earnings. This is an AI-driven valuation reset — the market pricing model risk, not performance.
- Big Tech bundling. Microsoft now runs a ~$37B security business and bundles EDR, email, CASB, identity, and DLP into M365 E5 (plus free Security Copilot capacity from Ignite 2025). A consolidated E5 stack is pitched as ~3x cheaper than a fragmented architecture — aggregation that structurally disadvantages standalone point vendors.
- Platform over point. 93% of buyers now prefer capabilities delivered within a broader platform. The point-product model is squeezed from above (platforms) and below (buyer consolidation fatigue).
- SIEM displacement. Legacy SIEM (Splunk; QRadar SaaS nearing end-of-life 2026) is being displaced by cloud-native/bundled/cheaper rivals — Microsoft Sentinel (~44% TCO cut, bundled), Google SecOps, CrowdStrike LogScale, Palo Alto Cortex XSIAM. The per-GB pricing model is collapsing.
The "AI kills incumbents" thesis is not settled. Some evidence suggests established platforms are better positioned than AI-native challengers near-term, because they own distribution, data, and the customer relationship, and can absorb the disruption rather than be displaced by it — a falsifiable question rather than a settled conclusion.
For M&A, the reset acts as an accelerant: cheaper targets for cash-rich platforms, thinner mid-market exit liquidity (strategics waiting for further resets), legacy-SIEM carve-outs and migrations, and AI-native challengers becoming sell-side candidates. The bid-ask gap between 2025-anchored sellers and 2026-reset buyers eventually breaks toward buyers.
Network security & SASE/SSE
→ Full domain deep dive: Network Security & SASE.
Leaders: Palo Alto, Fortinet, Cisco, Check Point, Zscaler, Netskope, Cato Networks, Cloudflare, Versa. Challengers: Cato (independent, IPO-track), Aryaka. SASE/SSE is converging on platform players; standalone SWG/CASB are being absorbed. Posture: appliance incumbents racing to carry the firewall franchise into a cloud-delivered edge before cloud-native challengers take it.
Endpoint (EPP/EDR/XDR)
→ Full domain deep dive: Endpoint Security.
CrowdStrike, Microsoft, and SentinelOne hold ~48% of global endpoint share (late 2025). Others: Palo Alto (Cortex), Trend Micro, Sophos (TB-owned, +Secureworks), Trellix, Cybereason, Bitdefender. Posture: late-stage oligopoly; sub-scale EDR = targets.
Identity & access (IAM / PAM / IGA / machine identity)
→ Full domain deep dive: Identity Security.
- IAM/SSO/MFA: Okta, Microsoft Entra, Ping (TB), ForgeRock (merged into Ping).
- PAM: CyberArk (→Palo Alto $25B, closed Feb 11 2026), Delinea (TPG), BeyondTrust.
- IGA: SailPoint (TB; re-IPO'd 2025), Saviynt, Omada.
- Machine/non-human identity (hot): Aembit, Astrix, Token Security, Oasis.
- ITDR/CIEM: Silverfort, Authomize (Delinea).
Cloud security (CNAPP / CSPM / CWPP / DSPM)
→ Full domain deep dive: Cloud Security.
Wiz (→Google $32B) is the defining asset. Others: Palo Alto Prisma, CrowdStrike, Orca, Sysdig, Aqua, Lacework (absorbed by Fortinet), Cyera (DSPM), Rubrik. Posture: most active M&A zone; highest multiples in the industry (~21x revenue).
Application & software supply-chain security
Snyk (independent, large private), Checkmarx (TPG/Hellman & Friedman), Veracode (TA), GitLab/GitHub (DevSecOps), Semgrep, Endor Labs, Chainguard, Socket. API security: Salt, Noname (→Akamai), Traceon. ASPM consolidating rapidly.
→ Full domain deep dive: Application & Software Supply-Chain Security.
Data security (DLP / DSPM / encryption / backup)
Varonis, Rubrik, Cohesity (+Veritas), Cyera (DSPM leader, ~$12B Jun 2026), BigID, Sentra, Forcepoint (TPG), Zscaler (Avalor), Cyberhaven, Securiti. Backup/recovery increasingly counted as "cyber resilience."
→ Full domain deep dive: Data Security.
Security operations (SIEM / SOAR / TIP / vuln mgmt / ASM)
→ Full domain deep dive: Security Operations & SIEM.
- SIEM: Splunk (Cisco), Microsoft Sentinel, Google SecOps (Chronicle), Exabeam+LogRhythm, Securonix (Vista), Sumo Logic (Francisco), Devo, Gurucul, Panther.
- Vuln/exposure mgmt: Tenable, Rapid7, Qualys (Gartner EAP Leaders), Pentera, Cymulate, SafeBreach (validation/BAS), XM Cyber (Schwarz), Axonius (CAASM).
- Threat intel: Recorded Future (→Mastercard $2.65B, 2024), Mandiant (Google), GreyNoise.
- ASM: Censys, runZero, watchTowr, CyCognito.
→ Full exposure-management deep dive: Exposure Management, VM & CTEM.
Email & collaboration security
Proofpoint (TB; bought Hornetsecurity $1.8B, Dec'25), Mimecast (Permira), Abnormal Security (~$200M ARR, +100% YoY, $5.1B), Barracuda (KKR-owned), Cloudflare Area 1, Microsoft Defender for O365, Sublime, Material. Posture: structural demand (#1 attack vector), architecture flipping SEG→ICES, under Microsoft's E5 bundle; AI-native challengers (Abnormal) re-rating the category.
→ Full domain deep dive: Email & Collaboration Security.
Barracuda is a KKR-owned email and network security vendor and an active strategic acquirer in SMB and mid-market security.
OT / ICS / IoT security
Armis (→ServiceNow $7.75B), Nozomi (→Mitsubishi Electric, completed Jan 28 2026, ~$1B), Dragos (→Accenture majority, Jun 2026, ~$3.25B; runZero + NetRise folded in), Claroty, Forescout (Crosspoint). Posture: consolidation accelerating — three of the largest independents (Nozomi, Armis, Dragos) exited inside six months, drawing an industrial OEM, a workflow platform, and a services giant. Claroty is now essentially the last marquee independent and re-rates on scarcity; OT/IoT visibility is a strategic multi-horse race with platforms, services giants, and automation OEMs entering.
→ Full domain deep dive: OT/ICS & Cyber-Physical Security.
GRC / TPRM / compliance automation
Vanta, Drata, OneTrust, Archer (Cinven), ServiceNow GRC, SecurityScorecard, BitSight, UpGuard, Hyperproof. Posture: fragmented, regulation-driven, AI-disrupted — roll-up rich.
→ Full domain deep dive: GRC, Compliance Automation & TPRM.
AI security (security FOR AI)
Protect AI (→Palo Alto ~$700M, now Prisma AIRS), Lakera (→Check Point, Nov'25), Robust Intelligence (→Cisco AI Defense), Prompt Security (→SentinelOne ~$250M), Aim Security (→Cato ~$300–350M); remaining independents HiddenLayer, Zenity, Mindgard, Aurascape, WitnessAI, Noma, Pangea, Lasso. Posture: a category being bought faster than it is built — five platform acquisitions in ~12 months; AI-SPM absorbing into CNAPP, runtime/agent security the contested frontier tied to The Agentic Edge.
→ Full domain deep dive: AI Security (Security FOR AI).
Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.