With AI and generative AI capabilities on the rise, a shift toward consolidation and platforms over point solutions is redefining the IT security market — as well as its leading vendors.
CISOs and other security execs often find themselves in a difficult position. Attackers are always getting better, and now they can use genAI to help craft ransomware emails or create deepfakes. At the same time, security practitioners are bombarded by vendors with an alphabet soup of solutions: SSE, SASE, ZTNA, DLP, CASB, SWG, SOAR, DEM, XDR, CSPM — the list goes on and on.
Enterprise customers have had it with point products. They want platforms that protect everything: end users, whether remote or in the office; devices, including IoT and OT; applications, including SaaS; data, at rest or in motion; development environments, on-prem or in the cloud. They want automation, they want analytics, and they want AI and generative AI.
The power players in security have gotten the message. Over the past year or so, significant vendor consolidation has occurred. Cisco bought Splunk. Broadcom bought VMware. Fortinet is buying Lacework. Strategic alliances have been forged. IBM and Palo Alto Networks. CrowdStrike and Cloudflare.
The vendors on this list have built platforms that offer cloud-based management and advanced data analytics, and that leverage AI and genAI to put real-time information at the fingertips of security professionals.
1. Cisco: Acquiring Splunk for AI
Why they’re here: Networking powerhouse Cisco has cobbled together — mostly through acquisition — a broad portfolio of security products. (Viptela for SD-WAN. Meraki for cloud management. Duo for authentication. Thousand Eyes for digital experience monitoring. AppDynamics for observability.) Some would say too broad, as Cisco has been criticized for having overlapping product lines. Cisco has addressed those concerns with the recent release of Cisco Security Cloud, which replaces point products with suites.
Power moves: Cisco made a major splash with the purchase of SIEM and data analytics vendor Splunk. The move gives Cisco an opportunity to combine its networking, security, and observability products with Splunk’s AI-based data analytics prowess to deliver full-stack security protection for enterprises.
By the numbers: $28B: The amount that Cisco paid for Splunk.
Outlook: Cisco’s security revenue in its most recent quarter was a healthy $1.3B (including revenue from Splunk.) Still, Gartner analyst Jon Forest says that security contributes only 7% of Cisco’s total revenue, so there’s certainly opportunity for growth. And Cisco has identified 5,000 of its customers who have no Splunk presence at all, which creates potential for cross-selling. Cisco CEO Chuck Robbins says that with Splunk in the Cisco fold, “We will revolutionize the way our customers leverage data to connect and protect every aspect of their organization as we help power and protect the AI revolution.”
2. Broadcom: It all comes down to execution
Why they’re here: When Broadcom announced its intention to purchase VMware in 2022, the focus was on VMware’s virtualization and hybrid cloud management platforms. But the combination of security vendor Symantec, which Broadcom purchased in 2019, and VMware’s security assets, creates the potential for a major player in security. The questions were: Is Broadcom going to sell endpoint security powerhouse Carbon Black (owned by VMware), as it initially indicated? And how is it going to handle overlapping product lines between VMware and Symantec when it comes to hot product areas such as SSE and SASE? In a surprising about face, Broadcom announced in March that it will keep Carbon Black, and will attempt to integrate Symantec and VMware security tools. It’s too early to tell if those tricky integrations will be successful, but the opportunity is there for Broadcom.
Power moves: Decided not to sell endpoint security vendor Carbon Black.
By the numbers: $49B: Amount Broadcom paid for VMware.
Outlook: At the recent Mobile World Congress in Barcelona, Broadcom announced its first integration: A single-vendor SASE offering that combines VMware’s VeloCloud SD-WAN and Symantec’s SSE. There are certainly more areas of potential integration. Forrester Research points out that both Symantec and Carbon Black have strong endpoint security offerings, and both have zero trust platforms. But Broadcom has stated its intention to devote significant resources to innovation and integration.
3. Palo Alto Networks: Platformization is the word
Why they’re here: Palo Alto Networks is one of the established power players in cybersecurity, from its roots as the creator of the application-aware firewall to its current leadership position based on what it calls “platformization,” the deployment of an integrated security platform. Palo Alto Networks is a Leader in Gartner’s Magic Quadrant for SSE, and a Leader in the just-released Forrest Wave for XDR.
Power moves: In May, Palo Alto announced a broad partnership with IBM that has many moving parts. Palo Alto will become IBM’s preferred security partner, with IBM pledging to train more than 1,000 of its security consultants on migration, adoption, and deployment of Palo Alto Networks products. Palo Alto will incorporate IBM’s watsonx large language model in its Cortex XSIAM. And Palo Alto will buy IBM’s QRadar SIEM tool, migrating QRadar customers over to Palo Alto’s security operations (SOC) platform.
By the numbers: 15%: Palo Alto reported revenue of $1.98B in its latest quarter, up 15% year-over-year.
Outlook: Palo Alto is betting that enterprise customers agree with its vision of an AI-based, all-in-one security platform. Palo Alto CEO Nikesh Arora says, “The security industry is at an inflection point where AI will transform businesses and deliver outcomes not seen before. It’s a moment to accelerate growth and innovation. Together with IBM, we will capitalize on this trend, combining our leading security solutions with IBM’s pioneering watsonx AI platform and premier services to drive the future of security platformization with complete, AI-powered, secure-by-design offerings.”
4. Microsoft: Making security a top priority
Why they’re here: Microsoft has taken the platform route and consolidated scores of individual tools into six product lines: Defender, Sentinel, Entra, Purview, Priva, and Intune. A leader in AI through its close alliance with OpenAI (the creator of ChatGPT), Microsoft has released Copilot for Security, a generative AI solution that enables security teams to simplify processes such as incident remediation and guided response. Microsoft has an SSE offering, and it was named a leader in the 2024 Forrester Wave for XDR platforms.
Power moves: In March, Microsoft announced that it had hired the co-founders of AI startup Inflection (Mustafa Suleyman and Karen Simonyan) to run Microsoft’s AI operations. In April, Microsoft announced its unified SOC platform designed to break down silos and deliver SIEM, XDR, SOAR, and other functions under one roof.
By the numbers: $20B: Microsoft says its security division generates $20B in annual revenue. And Microsoft puts the annual growth of its cybersecurity business at over 30%.
Outlook: Microsoft has suffered some high-profile, embarrassing data breaches recently that have been blamed on Chinese and Russian hackers. In response, Microsoft CEO Satya Nadella told analysts: “Security underpins every layer of the tech stack and it’s our No. 1 priority. We are doubling down on this very important work, putting security above all else, before all other features and investment.” And in an email to Microsoft employees, Nadella wrote: “If you’re faced with a tradeoff between security and another priority, your answer is clear: Do security.”
5. Fortinet: Security and networking under one roof
Why they’re here: Fortinet is unique among cybersecurity vendors for two reasons: 1. Fortinet is able to natively combine networking and security in a seamless platform. In fact, Fortinet is a leader in the latest Gartner Magic Quadrant for enterprise wired and wireless LAN networking. 2. Unlike companies that grow by acquisition and need to integrate new products into their portfolio, Fortinet builds its own chips, has its own operating system (FortiOS), and, for most part, develops products in-house, providing full integration from network switches to firewalls to SASE.
Power moves: Fortinet announced on June 10 that it has reached an agreement to acquire cloud security firm Lacework. Fortinet said that it will integrate Lacework’s CNAPP (cloud-native application protection platform) into its Unified SASE offering to create “one of the most comprehensive, full stack AI-driven cloud security platforms available from a single vendor.”
By the numbers: 7%: On May 2, Fortinet announced Q1 revenue of $1.35B, up 7% year-over-year.
Outlook: Fortinet is making a big push to take a leadership position in single-vendor SASE. Says CEO Ken Xie, “We are diligently executing on our strategy to capitalize on the fast-growing unified SASE and security operations markets while continuing to gain market share in secure networking.” In addition, Fortinet is trying to find the sweet spot between customers who want a consolidated platform, but are wary of vendor lock-in. Fortinet is now offering customers a suite of five platforms (hybrid mesh firewall, XDR, single-vendor SASE, SD-branch, and cloud email security) that they can choose from.
6. CrowdStrike: Cloud-native security platform built to protect cloud data
Why they’re here: CrowdStrike is a leader in Gartner’s 2023 Magic Quadrant for Endpoint Protection Platforms. It is a leader in the 2024 IDC MarketScape for worldwide managed detection and response services. And CrowdStrike is a leader in the 2024 Forrester Wave for Extended Detection and Response Platforms. IDC says, “There is a push ‘to the platform’ that is occurring in cybersecurity. This is worthy of mention as CrowdStrike has a wide depth and breadth of capabilities built into its Falcon platform that provides the technology muscle for its MDR offering. The added capabilities, such as its managed cloud workload protection (CWP) and its fully managed identity threat protection service, provide expert management, monitoring, protection, and optimization of identities and identity stores.”
Power moves: Acquired Flow Security, a leader in data security posture management (DSPM).
By the numbers: 33%: On June 4, CrowdStrike announced that revenue in its most recent quarter increased 33%, reaching $921M.
Outlook: CrowdStrike continues to innovate. It recently delivered a Falcon Next-Gen SIEM, and Falcon application security posture management (ASPM). The Flow Security acquisition is aimed at boosting CrowdStrike’s DSPM capabilities and fits into a broader strategy to deliver what CrowdStrike calls “the most complete data protection offering, from code to application to device to cloud.”
7. Cloudflare: Teaming up with CrowdStrike
Why they’re here: Cloudflare is a leader in secure content delivery network services, what it calls its “connectivity cloud,” with a unified platform of networking, security, and application delivery services. Launched in 2020, Cloudflare One is a fast growing platform for SASE and SSE services. Cloudflare was named a “Leader” in 2023 IDC MarketScape for zero trust network access (ZTNA), and is a Strong Performer in 2024 Forrester Wave for SSE.
Power moves: Bought BastionZero, a zero trust infrastructure access platform, to further strengthen remote access to core IT systems for customers of Cloudflare One.
By the numbers: 30%: Cloudflare’s revenue for the first quarter of 2024 was $378.6 million, an increase of 30% year-over-year.
Outlook: On May 30, Cloudflare announced a strategic partnership with CrowdStrike designed to combine their platforms to help enterprise customers achieve vendor consolidation across its cybersecurity infrastructure. Specifically, the deal combines cloud-native, zero trust protection and connectivity from Cloudflare One with AI-native cybersecurity from CrowdStrike Falcon’s cybersecurity platform, including its Next-Gen SIEM. CrowdStrike and Cloudflare are leveraging channel partnerships to deliver a fully integrated solution to global customers from a single API. The goal is to deliver the full-scope capabilities SOC teams need to detect and respond to attacks across network, devices, endpoints, cloud, identity, data, and applications.
8. Zscaler: Zeroing in on zero trust
Why they’re here: A leader in Gartner’s latest Magic Quadrant for secure service edge, Zscaler is an innovator in the second wave of vendor cybersecurity — a company that doesn’t build its own firewalls, but built a cloud-based platform designed to secure enterprise traffic. The company’s Zero Trust Exchange protects users, workloads, and devices by applying zero trust principles along with advanced machine learning and AI. The platform also now extends to IoT devices, as well as OT systems.
Power moves: Bought startup Avalor. The vendor’s data fabric allows security teams to aggregate, normalize, deduplicate, and track risk data from discovery to remediation. Also bought AirGap Networks, which enables Zscaler to introduce zero trust network segmentation inside branches, campuses, and factories for servers and IoT/OT devices.
By the numbers: 2 billion: Number of phishing attempts that Zscaler’s platform blocked in calendar 2023.
Outlook: Zscaler Chairman and CEO Jay Chaudhry says the company’s advantages are its cloud-based architecture, the way its offerings are constantly evolving, and its speed of innovation. Along those lines, Zscaler recently introduced its Zero Trust SD-WAN, an offering that applies genAI to application security, and is expanding AI functionality into risk-based business insights and unified vulnerability management.
9. Netskope: Leveraging AI and genAI
Why they’re here: Netskope is a leader in the 2023 IDC MarketScape for network edge security-as-a-service (NESaaS) and ZTNA, and is cited as a leader in the 2024 Forrester Wave for security service edge (SSE) platforms. IDC analyst Chris Rodrigues says, “Our thorough assessment of Netskope’s strategy and capabilities led us to recognize the company as a Leader in both the NESaaS and ZTNA. Netskope leverages its extensive cloud architecture to offer a ubiquitous, performant, edge-delivered zero trust access model across all users and devices. Netskope’s deep level of expertise in CASB inline and API protection is a key differentiator for organizations that are concerned about the risks represented by managed and unmanaged SaaS applications.”
Power moves: Bought digital experience monitoring startup Kadiska.
By the numbers: $500M: On June 3, Netskope announced that it had reached $500M in annual recurring revenue.
Outlook: Netskope lays claim to being the industry’s first SSE vendor to leverage generative AI for SaaS security, the first genAI-powered CASB, the most advanced DLP, all running on the Netskope One platform. The company is poised to take advantage of growth in the SSE and SASE markets. Says Sanjay Beri, co-founder and CEO, “Netskope was founded on the idea that the entire enterprise strategy for protecting critical data from threats depends on how well security and networking adapt to a cloud-first, AI-ready world. As cloud and SaaS app adoption soared, businesses began changing their unreliable legacy technology stacks to reduce risks, lower costs, and implement modern architecture. We correctly anticipated that a converged, optimized platform approach would be needed to accomplish this, an opportunity now known as SASE.”
10. Wiz: Startup with a whizbang cloud security platform
Why they’re here: Wiz addresses a key pain point for CISOs: With everything moving to the cloud, how do I keep track of it and secure it? The Wiz cloud security platform offers prevention, detection, and response for data, workloads, application development environments, containers, Kubernetes, and so on, across multicloud environments. The Wiz offering has created quite a buzz: The company raised $1B in 2024 alone, at a valuation of $12B.
Power moves: Bought startup Gem Security, which specializes in real-time cloud detection and response.
By the numbers: $350M: Founded in 2020, privately held Wiz reported that it achieved $350M in annual recurring revenue in 2023.
Outlook: Wiz is hot. No question about it. The company has burst on the scene with a bold strategy of selling to the largest enterprises. The question is whether the company can continue its torrid growth rate. Assaf Rappaport, co-founder and CEO, isn’t lacking in confidence. He says, “Consolidation is the future of the security industry. With cloud infrastructure growing at an accelerated pace, not to mention the broad adoption of AI applications, the world’s largest organizations require consolidated, cloud-native security platforms to effectively address a wide and ever-changing range of security needs. We’re creating a powerful real-time solution for SOC and Cyber Defense teams to combat emerging threats and building the world’s leading cloud security platform.”
