Security & Markets!

XDR Wars: Who Holds the Key?

Shubham Goel — Sun, 09 Apr 2023 11:44:27 GMT

Important: Before proceeding to read this post, please take a moment to read and understand the disclaimer at the end of the post.

Quick Sectional Links

The cybersecurity industry has undergone substantial changes in recent years, primarily due to the rise of sophisticated cyber attacks and threat actors. Consequently, security technologies, including Extended Detection and Response (XDR), have evolved from conventional products like EDR, EPP, and antivirus solutions. Organizations are bolstering their security defenses by moving to a more comprehensive solution. In this post, we will be covering the why, what and how of XDR and talk about three major cybersecurity companies, namely CrowdStrike ( ), SentinelOne (), and Palo Alto Networks (). In this post I tried to cover all three major vendors and highlight the positives of one over the other.

Additionally, this blog aims to delve into the features and benefits of these XDR solutions, as well as their distinct approaches to threat detection, response, and remediation. We will also explore how XDR fits into the broader cybersecurity landscape and why it is increasingly becoming a crucial tool for organizations seeking to proactively manage evolving threats.

XDR is an endpoint solution that combines advanced threat detection, comprehensive visibility, and coordinated response across multiple security layers, providing a holistic defense against sophisticated cyber threats that may span across endpoints, networks, cloud environments, and now applications. With its unified and proactive approach, XDR empowers organizations to detect, investigate, and mitigate cyber threats in real-time, providing a more resilient and adaptive defense against ever-evolving cyber threats. Here is a quick recap on how the industry evolved over the last few decades -

How does an XDR work?

I’ll try to explain it via analogy (If it doesn’t work for you, I apologies), imagine you are at Meta’s Menlo Park office. You might have seen the number of buildings and each building has its own physical security guard. In addition, there is a central location from where all the physical security activity is monitored and they have their response team working from that central location. Whenever someone enters any building, that building’s security guard will ask the visitor their name, reason, place, etc. all this information is sent to the central security office for further processing. In this case, each individual guard is monitoring the entire building and sends all the information to a centralized location.

Similarly, these XDR agents are individual security guards for the building sitting on individual hosts (laptop, server, cloud instance) and collect the telemetry of the machine and send it to a centralized cloud for processing.

This picture by Florian Roth perfectly summarizes the current state of XDR but I do see more use cases for XDR. I’ll cover those use cases in the technical section of this post.

Source - What is XDR by Palo Alto Networks?

Nir Zuk, founder and CTO of coined the "XDR" term during their Ignite'18 user conference and this image by is just an overview of XDR architecture . When we talk about the entire attack chain, endpoint is just one piece in the puzzle. A mature system would help the analyst understand the larger picture and hence the artifacts from other sources like network, cloud, apps and other data source would only complement the current detection & response. "X" in XDR stands for extended which translates to “everything” that can be ingested to a data lake and used to perform analysis on that data in a central location.

Why do you need an XDR?

XDR is an essential tool for organizations for several reasons. XDR solutions offer endpoint visibility, enabling real-time monitoring and analysis of endpoint behavior, which is crucial for identifying anomalies and threats. XDR solutions provide detailed information about threats and suspicious activities, which helps organizations investigate and remediate threats quickly. While XDR can be a valuable tool in enhancing an organization's cybersecurity posture and improving its ability to detect and respond to threats, it may not be a specific compliance requirement in and of itself. However, implementing effective cybersecurity measures, including XDR capabilities, can help organizations meet their compliance obligations by providing better visibility into potential security incidents, facilitating timely response, and mitigating potential impacts of security breaches.

Why do I care?

According to research from Ponemon Institute, approximately 70% of all breaches occurs from an endpoint. This is an interesting statistic as it highlights the importance of endpoint security layer and, more importantly, underlines the attack surface that endpoints presents. According to Verified Market Research, the global endpoint security market is expected to grow at a CAGR of roughly 7.87%, from $13.43B in 2020 to $24.7B by 2028.

Source - Verified Market Research - Endpoint Security Market Size And Forecast

TAM (Total Addressable Market) for these vendors is much more as they do offer different module and claim to have different TAM for each module. Some of the modules are Threat Intelligence, Vulnerability Management, and Identity Management and others and they always try to present themselves as a platform for security and not just endpoint security. Here are some TAM reports shared by CrowdStrike in their investor presentation -

Source - CrowdStrike Investor Presentation

Let’s look at some of the major players

Endpoint security is set to experience new challenges with ever-changing demands from enterprises. You can see from the image how quickly the industry changed; look at Gartner's magic quadrant from 2017.

Source - Gartner, Left - Gartner’s magic quadrant 2017, Right - Gartner’s magic quadrant 2022

This field is poised for even more risk, innovation and significant market shifts in the next few years. Therefore, vendors need to adapt to changed demands and threat landscape and keep innovating with incremental progress. Like other security areas, endpoint security has quite a few vendors. However, some major vendors in endpoint space are PANW 0.00, CRWD 0.00, $S, MSFT 0.00, Trend Micro ($TMICY), McAfee, Sophos, VMW 0.00 , Cybereason, BitDefender and some newer players like Cynet, Confluera (Acquired by XM Security). It makes a cogent argument to include all of them in the comparison; however, I have listed down three major players based on several reasons like market vision, features, positioning, leadership, revenue growth, customer count for XDR and 2022 Gartner's magic quadrant.

You might wonder why is included with comparatively low MQ rating (2022)?

PANW 0.00 is one complete vendor with all the pieces in place, and that too with solid execution. You look at the network, cloud and SOAR functionalities; it does make life easier for the end users. Additionally, they have solid innovation, research and leadership teams, and I'd bet my bottom dollar on them to eat a good market share from incumbent players like Cybereason (looking for a buyer), Trend Micro and VMW 0.00.

An ideal strategy for would be to compete with CRWD 0.00 and S 0.00 (As AND are still working on consolidation and is way ahead) but target the organization they can beat left, right and centre and simultaneously improve their current portfolio. CRWD 0.00 and S 0.00 are architecturally stable and more polished products in terms of XDR. It would be good to target customers who are in their renewal cycle and can't go with the incumbents due to the rising sophisticated attacks.

Technology

Pricing

SentinelOne: SentinelOne offers a flat rate for their endpoint security solution, which includes all features and functionalities. The pricing is based on the number of endpoints protected, with discounts available for longer-term contracts.
CrowdStrike: CrowdStrike offers tiered pricing based on the number of endpoints protected and the level of support required. They have multiple packages, and you can choose from the standard Falcon Prevent package or the complete Falcon Prevent package.
Palo Alto Network: Palo Alto Network offers a variety of pricing models for their endpoint security solution. The pricing is based on the number of endpoints protected and also offers a consumption-based pricing model.

GTM Strategy

SentinelOne: For years, SentinelOne has prioritized a partner-friendly approach in its go-to-market strategy, particularly with strategic partnerships like MSSPs. To enhance these relationships, they have developed capabilities such as multi-tenancy, automation, and role-based access control. Additionally, they are expanding their relationships from MSSPs to VARs (Value Added Resellers) and VADs (Value Added Distributors) across the world.
SentinelOne also recognizes the importance of the cloud in its go-to-market strategy and has seen significant customer interest in its cloud offerings and Wiz partnership. The company views cloud and endpoint sales as complementary and has had success with standalone cloud deals. By treating its endpoint and cloud businesses as competitive advantages, SentinelOne plans to continue growing across all these different vectors.

CrowdStrike: CrowdStrike's go-to-market strategy revolves around utilizing its technology and establishing strategic partnerships to extend its market coverage. Initially, the company aimed at the large enterprise sector and promoted the Falcon platform to such organizations, which delivers an extensive array of endpoint protection, threat intelligence, and response services. To reach out to the SMB market, CrowdStrike developed Falcon Go, a lightweight package designed exclusively for SMBs. Moreover, the company is exploiting its strategic association with Dell to provide the Falcon platform to Dell's customers worldwide. This partnership allows CrowdStrike to access a wider market, including small to medium-sized businesses, via various channels, such as traditional resell agreements on devices sold through Dell's direct sales team and as the cornerstone of Dell's managed cybersecurity services offerings.
Palo Alto Networks: For the last few years, Palo Alto’s strategy is to acquire innovative technology companies and integrate their products into their offerings. They focus on smaller to mid-sized acquisitions in the product category and utilize the expertise of the acquired companies' founders to drive growth. They have been successful with this approach and have developed a unique go-to-market approach. Additionally, they are focused on enhancing their go-to-market capabilities, particularly in cloud and Cortex total market capabilities and are working on product enhancements in XDR space. This will definitely give them confidence in opening up a large total addressable market in future quarters.

Customers

SentinelOne: In their fiscal fourth quarter 2023, SentinelOne gained approximately 750 customers, resulting in a year-over-year increase of around 50%, with the total number of customers reaching north of 10,000. Among some customers, SentinelOne closed a multi year eight-figure deal in Q3’23 which was the largest since inception.
CrowdStrike: CrowdStrike has a strong customer base and a steady growth in their numbers. They recently added 6,694 net new customers for the fiscal year and now the total count is 23,000+ paid customers. CrowdStrike also serves 556 of the Global 2000, 271 of the Fortune 500 and 15 of the top 20 U.S. banks. They also added an 8-figure net new ARR deal to their revenue last quarter. They are also the second fastest company to $2B ARR just behind Zoom communications (Covid Play).
Palo Alto Networks: Palo Alto Networks has close to 4500 customers for their Cortex platform and they also added multiple high 7-figure deals over the last quarter. They are also trying to pilot XSIAM (In simple terms, a SOC platform!) with few customers and trying to bundle it with XDR. Customers can only opt for XSIAM if they have XDR, so the company is attempting to upsell customers to purchase XSIAM due to its features and consolidation play, with the aim of generating more revenue by offering a bundled package to customers.

Acquisitions

SentinelOne: In 2019, SentinelOne acquired Scalyr, a log management and analysis platform, which was aimed at enhancing their cybersecurity solutions. In March 2022, SentinelOne announced the acquisition of Attivo Networks, a leading identity security and lateral movement protection company. Attivo Networks was a leader in Identity based prevention, detection, and response capabilities.
CrowdStrike: CrowdStrike made several acquisitions to enhance its capabilities. This includes the acquisitions of Humio, a log management and observability technology provider, and Preempt Security, a zero trust and conditional access technology provider. In September 2022, CrowdStrike acquired Reposify that provides an external attack surface management (EASM) platform that scans the internet for exposed assets of an organization to detect and eliminate risk from vulnerable and unknown assets.
Palo Alto Networks: Palo Alto Networks has made several acquisitions, including an Israel-based company named Secdo in 2018, which brings sophisticated EDR capabilities, including unique data collection and visualization. Later, they completed the acquisition of Demisto for Security Orchestration, Automation, and Response (SOAR) technology, PureSec for serverless security, Twistlock for container security, Zingbox for Internet of Things (IoT) security, Aporeto for Zero Trust Network Security, CloudGenix for SD-WAN technology, and Expanse for attack surface management. Additionally, Palo Alto Networks also acquired RedLock, a cloud security analytics company, in 2018 to strengthen its cloud security offerings. In 2020, they completed the acquisition of The Crypsis Group, a leading incident response, risk management, and digital forensics consulting firm. In February 2021, they acquired Bridgecrew, a developer-focused cloud security company and creator of the tool Chekov, and in December 2022, Palo Alto completed the acquisition of Cider Security, a leader in application security (AppSec) and software supply chain.

Financials

SentinelOne :

CrowdStrike :

Palo Alto Networks :

Summary :

Source - Charts from Finbox

Innovator’s Dilemma

One of the most critical challenges for the security industry is the innovation dilemma. You might remember a time when we had Avira, Avast, McAfee, FireEye, and a couple of others. These are great companies built for ages but they share a similar pain of innovation. Although, some of the companies were sold at a good sum, they had a great opportunity to be a part of this market.

Why can’t these companies disrupt themselves?

You take as an example, they had the finest mainframe computer, disrupted by laptops, ruled the market and was the talk of the town before being disrupted by , apple ruled the market with the launch of iPhone and Samsung started their phone offerings with android OS and captured a great share and so on and so forth.

The point is that there is always an external company that reads the market better than these incumbent exceptional companies. The problem is when you keep listening to your existing customers, you keep improving what you already have.

They are still innovating but only to improve the existing product(s). When small becomes big and you are spinning out of the growth stage, introducing processes, and bureaucracy, and adding more checks, you find yourself in a rabbit hole where it’s hard to move the building blocks. Therefore, it’s essential to zoom out and see how to remain small when you are big, how to stay nimble just as you were a startup and operate like (Yes, I’m biased), , , etc. and disrupt your own company and reinvent yourself before a disruption from an external one.

CrowdStrike vs SentinelOne

I have watched nearly all the public interviews featuring George Kurtz and Tomer Weingarten, and I must say they are exceptional leaders who have built outstanding companies. I have also spoken to several people from and read countless reviews praising Tomer's leadership, which is indisputable. I still believe that has an edge when it comes to the ecosystem. Having a background from Israel and IDF, with the camaraderie in the security community, they have a unique advantage in leveraging partnerships and opening more channels for cross-selling and upselling. Have the cashed in well? Not really, till now I don't feel industry has the same feeling about the technology behind the product. They still need to prove and communicate well the investors and buyers. The recent exclusive partnership with Wiz highlights their focus on making the software more stable, as many of their existing offerings overlap with Wiz. This partnership is beneficial for both and Wiz, as they are likely to face strong headwinds from increased competition in their respective spaces (XDR and CNAPP). While the recent departure of two executives has made headlines, I believe that $S has made some great hires recently, and the new leadership will steer the company to greater heights (you can get an org chart from here).

On the other hand, CrowdStrike has a strong distribution and marketing strategy led by George Kurtz and his team. CrowdStrike positions itself as a one-stop-shop for protecting against nation-state attacks, which is a powerful marketing message that resonates well with the security audience and investors (From CrowdStrike Recent Investor Call - “They hear George on the radio, they watch on TV, they know CrowdStrike”). In some cases, companies are reluctant to switch from CrowdStrike, as the saying goes, "if it ain't broke, don't fix it." The software is packaged well and easy for analysts to understand, making it a popular choice for many. There is enough space for the market to have both these vendors thrive for the next decade.

Can we see a new player in XDR?

It can be argued that the XDR market is saturated with strong market players, making it difficult for newcomers to enter. Nonetheless, I strongly believe that true XDR players are rare and distinguishable by their clear vision and capabilities. Success in this market depends on a solid team, a good product, and strong partnerships, which can help a new vendor gradually acquire market share. While there is room for new players with superior technology and strong market differentiators, such differentiation must be robust, as the migration process is critical for every business. No business would want to spend more money and, more importantly, a significant amount of time migrating to an average or mediocre XDR solution.

Hot Take!

It has been interesting to observe how the XDR industry has evolved over the past few years. With customers demanding more consolidated vendors, it would be challenging to establish dominance and capture the market share from these three vendors. Among the three, boasts the most sophisticated and superior technology, and with an EV/Sales ratio of approximately 8.8x, it appears to be undervalued in my opinion. However, recent departures and headwinds from longer sales cycles and IT spending cuts make it intriguing to monitor price movements in the next two quarters. Despite high marketing spend, they have struggled to convert campaigns into a compelling narrative. On the other hand, has effectively leveraged partnerships, recording top-tier revenue through its partners. They have also established themselves as one of the most successful AWS ISV partners for Amazon. With their new partnerships, such as with Dell, and new SMB opportunities, they present an exciting investment prospect. 's advantage lies in its large customer base and ability to upsell enterprise customers on XDR & XSIAM offerings. They are miles ahead in terms of being a platform security company with solid integrations with most of the vendors. In my view, these three vendors will continue to dominate the market for the next 3-5 years as customers demand more consolidated and efficient solutions. We are likely to witness more acquisitions and exclusive partnerships aimed at maintaining a competitive edge in the market. The decision to opt for superior technology, a better go-to-market strategy, or a larger market opportunity rests with the investors or the buyers.

As always, if you want the “meat” of the blog and need more in-depth information, feel free to reach out separately.

Disclaimer : The information provided by Security & Markets ("we," "us," or "our") on https://securityandmarkets.com/ (the "site") is for general informational purposes only. All information on the site is provided in good faith; however, we make no representation or warranty of any kind, express or implied, regarding the accuracy, adequacy, validity, reliability, availability, or completeness of any information on the site. The information published on this post is based on publicly available information obtained from online websites, quarterly reports, and resource documentations posted online. The author of this blog clarifies that there is no relationship or affiliation of the author's current or previous employer(s) with this blog. Under no circumstances shall we have any liability to you for any loss or damage of any kind incurred as a result of the use of the site or reliance on any information provided on the site. Your use of the site and your reliance on any information on the site is solely at your own risk. We recommend independently verifying any information obtained from the site before making any decisions or taking any actions based on it. By using the site, you acknowledge and accept this disclaimer and agree to use the information provided at your own risk.

Making your First Cloud Security Investment?

Shubham Goel — Fri, 03 Feb 2023 15:17:13 GMT

Quick Sectional Links -

With more and more companies moving their data center from on-prem to cloud, it has increased the importance of cloud security manyfold. Cloud-based solutions have brought numerous advancements in the industry and over the past 5 years, we have seen new vendors eating the pie with exorbitant valuations. Let’s learn more about the underlying technology and why security is important for the cloud. The reason for this blog is not only to cater to the security audience but provide insight to a wider audience including individual & institutional investors, software engineers, product managers, and all other folks who are interested in learning about this space.

What is Cloud Native Application Protection Platform (CNAPP)?

Gartner coined the term "CNAPP" in 2020 (After coining CSPM, CIEM, CWPP, etc.), and if we go by their own definition -

“CNAPPs consolidate multiple cloud-native security tools and data sources, including container scanning, cloud security posture management, infrastructure as code scanning, cloud infrastructure entitlements management and runtime cloud workload protection platforms.”

Simplifying what Gartner wrote - These suites of software are designed to protect cloud-based infrastructure, applications, and data. These will ensure user and device authentication, data and resource access control, and data privacy protection.

Source: Gartner (How to protect your clouds with CSPM, CWPP, CNAPP, and CASB)

Why do we need security in the cloud? Shouldn’t AWS/GCP/Azure/OCI provide it natively?

Let’s understand it via an analogy - When you buy the latest smart lock for your house, the smart lock provider will ensure that their patented ML/AI-based (Yikes!!) smart lock will provide the highest level of security. It’s on the user to configure that smart lock, keep different patterns for different users and monitor the activity of who is entering the house.

For example, if you put 0000 as your password, you can’t really blame the smart lock provider. If you forget to lock the door, it’s on you and not the provider.

Similarly, these cloud vendors (AWS/GCP/Azure/OCI) operate in a shared responsibility model where a cloud service provider is responsible for managing the security of the public cloud while the subscriber of the service is responsible for securing what is in the cloud. Over the years the move to the cloud has brought a wide range of security challenges. There is a huge rise in the usage of cloud resources which has made the environment remarkably complex and difficult to protect.

Why do I care?

The cloud security market is currently valued at $7.8B in 2022 and it is expected to grow at a CAGR of 19.9% to $19.9B by 2027 according to a report published by marketsandmarkets. Doesn’t seem that large right now but with the pace of innovation, offerings and move to cloud computing, it will definitely outpace that CAGR. If you zoom out and see how things are aligned, it is very similar to entering an EDR market in early 2012-13. That makes this entire industry interesting and something to watch out for next couple of years. Here is a small finding from Mckinsey on the total addressable market for the entire cybersecurity suite and how cloud security is still under 5 percent.

Source: Mckinsey (“New survey reveal $2T market opportunity for cybersecurity technology and service providers“)

What are the key components of CNAPP?

Going by the definition, CNAPP provides a more integrated approach that covers the entire app lifecycle from development to runtime protection. With CNAPP, you can uncover vulnerabilities in open source, find cloud misconfigurations, proactively detect threats, remediate in real-time, and tick your sheet with comprehensive compliance, and reporting.

Now that we have covered the what, why, and how parts, let’s talk about a few key components of the CNAPP security suite before we move forward. I wouldn’t be surprised if we have a new cloud security jargon this year and I would have to update this blog but as of now, these are some of the major components -

CSPM - Cloud security posture management identifies and remediates risk by automating visibility, uninterrupted monitoring, threat detection, and remediation workflows to search for misconfigurations across diverse cloud environments/infrastructures. CSPM determines whether all the cloud applications and services are configured and securely correctly.
IaC - Infrastructure as Code provides engineering teams with version control and continuous integration/continuous delivery (CI/CD) to the testing and deployment process. In simple terms, it is helping set up cloud infrastructure in a programming language. Why it’s important? In the old IT days, you would file a ticket with IT to get a server set up, and then after a few days, it is assigned to you. In this modern age, engineers can spin up their instance in a few seconds and whatever you do inside their space is a black box. IaC is all about the process of moving the security to the left i.e. earlier in the application development life cycle.
CWPP - Cloud Workload Protection Platform includes a cloud-native security strategy that is primarily used to secure workloads. The main use case for CWPP is to offer high security to workloads. What are workloads? Cloud-based workloads are applications, services, computing, or capabilities running on cloud resources for example VMs, Containers, Kubernetes, and Serverless.
CIEM - Cloud Infrastructure Entitlement Management technologies discover all identities and users, and their entitlements and enforce identity and access governance controls to reduce excessive entitlements and right-size privilege access across the multi-cloud infrastructure.
CDR - Cloud Detection & Response is relatively a newer term but does the same EDR job for the cloud. CDR gives an edge to security teams to control the visibility in the cloud and detect threats on the cloud in real time.

Let’s look at some big and upcoming players -

Let’s see how these companies are stacked against each other in terms of technology. I don’t think it’s fair to compare the features of company A vs B, I strongly believe it’s more relevant to compare the outcomes of feature A vs B. If you want greater visibility and can compromise on efficiency, maybe you do want an agent-based system. If you want to choose the vendor with the latest eBPF technology (Though you can have an API-based eBPF) but you cannot give up on the efficiency of the machine, maybe it’s not the right approach for the company. In short, not every feature is the end-all-be-all, you need to see how the industry trend is going (as an investor), does it align with your environment (as a buyer), does it provide value for your money, and so and so forth.

For example, not taking a dig but this report from one of the vendors cannot be consumed as is. Why? Customer segments are completely different what works for Customer A with a small environment will not be true for Customer B with a large IT presence. When you compare results from MITRE evaluation, it’s not a good idea to consume them at face value, there are other nuances to think about on how those detections are reported. Shrewd execs and investors take everything into consideration and evaluate all these matrices while investing or buying the product.

The reasons for choosing some of these companies are as follows -

Pure cloud security player (Mostly private players)
Provide all these key components of CNAPP
70% or more YoY growth

There are other notable players who are doing a great job in providing cloud security like Palo Alto Networks, Netskope, Ermetic, Uptycs (XDR + CNAPP), and Snyk (Fugue Acquisition). I have kept them outside of the scope for a head-to-head comparison (again, looking for pure cloud players only with the growth condition) but they do offer great products and something definitely to consider.

History & Financial

Technology Overview

Source: Data is sourced from Crunchbase, Pitchbook, Growjo, Gartner, Wiz, Orca, Aqua, Lacework, Sysdig

We have seen these numbers pop up for other B2B businesses but for a security company (Wiz) to achieve astronomical growth (100M ARR in 18 months) is a little odd. What did Wiz do differently?

In my opinion, there are a couple of reasons for their growth, they already had a strong team and had sold their first company to Microsoft for a reported $250M. The same team built the Microsoft Azure cloud security group to $1.5B revenue machine. Of course, a strong team doesn’t always guarantee success but what made them different was great technology. They are agentless, which makes it easier for companies to migrate and in their own terms “Wiz can be rolled out in minutes via an agentless, API-centered approach to seamlessly scan workloads and give organizations full visibility of their cloud environment.“ Wiz analyses the entire security environment via a graph database and it surfaces prioritized risks for development teams to fix. This gives an edge in faster processing as there are no complex joins to find the relationship between different entities. In simple terms, it is easier & faster to analyze the relationship between your container A and user A. Graphdb is useful in analyzing and setting the relationship between nodes & edges with anomalous behavior being all about nodes and edges. Aqua, Orca, Lacework, and Sysdig have come up with or plan to offer similar graph-based technology, so we will see how they align their offerings for the next few quarters.

Again, this is not an in-depth review for these company’s technologies and financials, this is just a brief introduction about them. If you want a detailed review, feel free to reach out separately.

How to find the right value?

You can go through the above metric and list down some of the key points for these companies and do your own due diligence. In this market, where the buzz is only around FCF, it is definitely not possible for these above-mentioned companies as they are still in the early phase. One of the key metrics that you can think of for cloud security companies apart from a solid founding team is to look for 2.5-3x YoY ARR growth, 110-130% net dollar retention, healthy gross margin (50-70%), and a good NPS score.

Again, please do your due diligence and look for other factors too.

Good Danger Zone?

Cloud is a beast when it comes to the attack surface, it's difficult to monitor with the amount of noise and hard to write behavior-based detections. However, cloud is one part of the entire attack chain, it could be a misconfigured container but it wouldn't be difficult for an attack to not move to endpoints to get more data from an executive's laptop and acquire more surface-level data. These vendors are solid in terms of cloud coverage and provide immediate ROI but the key for any security vendor is to cover all the bases. It’s difficult to predict anything but if history is any indication, if you only operate in your niche market and reduce your pace of innovation, there will be a new player to replace/fight you in the next 24-48 months. In contrast, look at how aged really well and started with a firewall as their core offering. In the last 5 years, while they were crushing the competitors ( & ), they saw a plateau of growth and ventured into other security areas, acquired companies and became leaders in a few, and ate a decent market share in all the core security businesses (Firewall/ZTNA, SASE, XDR, SOAR, CNAPP).

Vendors like , , have already made a move to observability space with their offering of Logscale, Scalyr (acquisition), and Cortex Data Lake.

Under pressure to innovate quickly! Who will be the winner?

In my opinion, all cloud security vendors operate in their own niche and can definitely thrive for a few more years. In order to fight in this market, Wiz/Orca/Aqua/Lacework/Sysdig need to produce cloud security innovations at an incredible pace or they will be consumed by a more unified vendor. The user persona for these products is simple and we should also think about making these platforms easy to use. If you have built the next-generation AI engine but an analyst cannot use it, it is probably of no use. It’s a tough market to survive and with security unification, it would be important to show the value and stack the offerings against bigger players ( , , & ) to produce a good fight or being acquired by the "bravo's" of the world.

Security Unification - method to integrate multiple security technologies into a single framework. There is definitely a tradeoff when it comes to unification, either you lose on the quality or you lose on time navigating between different vendors. Any company that can bridge the gap (tough to offer everything out there), will get a bigger piece of the pie for the next few years.

Hot Take!!

There could be an opportunity for companies like Tines, Swimlane, or a new vendor to make security software more relevant. If they make the right pitch and put more emphasis on how specialized software (PANW for firewall, CRWD for XDR, Wiz for Cloud, Symantec for DLP) is the only way to go, they can definitely squeeze in there and eat some market (TAM is small but it is meaningful). Their job would be to consolidate alerts, make sense of them, perform supervised and unsupervised learning, do additional filtering, and provide a prioritized list to the analysts.

I have tried to keep the blog as simple as it can get so that when you give your next CNBC interview or talk to your friends about security, you don’t react like Mark Minervini.

Disclaimer: I am not a financial adviser and neither this article should drift your choice to invest in one company over the other. Details listed on the blog are just for informational purposes, and shouldn’t be taken as investment advice and I do have investments in some of the companies mentioned here.