26 · Sub-Segment Deep Dives · The Business of Cyber Security

The consolidation life cycle — where each category sits

Where a category sits on the consolidation life cycle — not just what it does — determines how value is captured and who captures it. Every category runs the same arc: a new threat opens a pool (nascent), startups rush in (early/fragmenting), demand migrates fast and a few leaders pull away (mid/filling, hot), the field hardens (late/oligopoly), and the function is absorbed into the platforms (aggregated). At the edge, point products win, and the play is to build a moat or sell into scarcity; in the hot middle, the contest is for category leadership; at the mature end, competition is on distribution, not novelty. The same growth rate means different things at different stages. (This chart mirrors Book Ch. 7 — The Landscape, Category by Category.)

Identity (IAM / PAM / IGA / machine identity / ITDR)

Margin: high (software). Migration: filling fast — identity is the new perimeter; agents explode non-human identity. Structure: strong, but platforms aggregating.
Stage: mid→late. Signature deal: Palo Alto–CyberArk ($25B). Leaders: Okta, Microsoft Entra, CyberArk, SailPoint, Delinea, BeyondTrust; machine identity: Aembit, Astrix, Token, Oasis.

Cloud security (CNAPP / CSPM / CWPP / DSPM)

Margin: high. Migration: the canonical filling pool (workloads → cloud). Structure: strong for scaled leaders; high aggregation appetite.
Stage: mid, hot. Signature deal: Google–Wiz ($32B). Leaders: Wiz, Palo Alto Prisma, CrowdStrike, Orca, Sysdig, Aqua, Cyera (DSPM).

Security operations (SIEM / SOAR / TIP / autonomous SOC)

Margin: mixed (consumption-priced SIEM lower). Migration: violent reshuffle — legacy SIEM draining, cloud-native/agentic filling. Structure: being aggregated into platforms.
Stage: active displacement. Signature deals: Cisco–Splunk ($28B), Exabeam+LogRhythm. Leaders: Splunk (Cisco), Microsoft Sentinel, Google SecOps, CrowdStrike (NextGen SIEM/Charlotte AI), Cortex XSIAM.

Endpoint (EPP / EDR / XDR)

Margin: high. Migration: mature/stable. Structure: oligopoly (CrowdStrike, Microsoft, SentinelOne ~48% share).
Stage: late. Leaders: CrowdStrike, Microsoft, SentinelOne, Palo Alto Cortex, Sophos, Trend.

Network & SASE/SSE/ZTNA

Margin: high (software shift). Migration: appliance draining → SASE filling. Structure: converging on platforms.
Stage: mid→late. Leaders: Palo Alto, Zscaler, Fortinet, Cisco, Check Point, Netskope, Cato, Cloudflare.

Application & software-supply-chain security

Margin: high. Migration: filling (DevSecOps, supply chain, AI code). Structure: fragmenting then consolidating (ASPM).
Stage: early-mid. Leaders: Snyk, Checkmarx, Veracode, Semgrep, Endor, Chainguard, Socket; API: Salt, Noname (Akamai).

Data security (DLP / DSPM / encryption / resilience)

Margin: high. Migration: filling (DSPM, AI data risk). Structure: moderate; incumbents re-rating on AI.
Stage: mid. Leaders: Varonis (Atlas), Rubrik, Cyera, BigID, Cohesity; backup re-cast as cyber resilience.

OT / ICS / IoT security

Margin: mixed (infra-heavy). Migration: filling (critical-infra threat + regulation). Structure: strong (scarce scaled assets).
Stage: early. Signature deals: ServiceNow–Armis ($7.75B), Mitsubishi Electric–Nozomi (~$1B, Jan 2026), Accenture–Dragos (~$4B, Jun 2026). Last marquee independent: Claroty (Nozomi, Armis, Dragos all acquired); Forescout (Crosspoint-owned).

GRC / TPRM / compliance automation

Margin: high (software). Migration: filling (regulation, personal liability). Structure: very fragmented → roll-up rich; AI-disrupted.
Stage: fragmented. Leaders: Vanta, Drata, OneTrust, Archer, SecurityScorecard, BitSight, UpGuard.

Exposure management (VM / ASM / BAS / PTaaS)

Margin: high. Migration: filling (continuous validation, AI red-teaming). Structure: consolidating; productizing services.
Stage: early-mid. Leaders: Tenable, Qualys, Rapid7, Pentera, Cymulate, HackerOne (Agentic PTaaS), NetSPI.

AI security (security for AI)

Margin: high. Migration: fastest-filling pool — but young. Structure: high appeal, high aggregation risk.
Stage: nascent land-grab. Signature deals: Palo Alto–Protect AI (~$700M), Cisco–Robust Intelligence (~$400M). Leaders: HiddenLayer, Lakera, Prompt Security, Noma, Zenity. See AI Security.

Email & collaboration security

Margin: high. Migration: mature; AI-native re-rating. Structure: largely aggregated into platforms.
Stage: late. Leaders: Proofpoint (TB), Mimecast (Permira), Abnormal, Barracuda (KKR), Microsoft.

Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.