Research

Two Parts · Eight Fronts · Zero Vendor Sponsors · Methodology

State of Cyber Security Markets 2026.

An operator's read of the cyber security markets. Eight fronts, two parts, 2026.

By Yohay Etsion. Full research-author bio →

Head of Product (Fractional), AXIA · Creator of Product Org OS · Author of Leading the Charge (2023) and Vision to Value (coming 2026).

Three ways to read this report

  • For PE analysts and expert-network sourcing start with the synthesis chapters. Each part of the report ends with an investable-theses chapter where the cross-front pattern claims land, every claim grounded on a falsifiable test you can re-derive in 2027 from publicly observable signals.
  • For CISOs and operators tracking the market read the chapters in order across both parts. Each ends with a falsifiable test for 2027 that you can re-check against your own deal flow.

Before you start: read how we source and how to verify any claim → · see the full collateral map →

The Capstone · Start Here

One Force, Two Wars.

One report, not two. The same platform incumbents are winning across every front in both Parts, driven by a single force: the autonomous AI agent and the machine-vs-human identity inversion. Read this first for the whole arc, or last as the synthesis.

Grand Unification · Across Both Parts

The thesis that ties both wars together

Part 1 resolved on the data layer. Part 2 resolved on agent identity. The capstone shows why they are one report: the same force drives both, expressed as two different enforcement primitives.

Read the capstone → · 🎧 Listen on NotebookLM · PDF

Part 1: The Data Battlegrounds.

Chapter One · IRM

The Insider Risk Management Front

Microsoft Risky Agents is the bet that bends the IRM market. 60 citations across the platform-vendor moves, the agentic-AI extension, and the consolidation arc.

Read chapter → · 🎧 Listen on NotebookLM · PDF

Chapter Two · DLP

The Data Loss Prevention Front

AI-native DLP is the rebuild; legacy DLP is the deprecation. 103 citations covering the four-way vendor split, Cyberhaven's lineage thesis, and the Thoma Bravo data-security stack.

Read chapter → · 🎧 Listen on NotebookLM · PDF

Chapter Three · DSPM

The Data Security Posture Management Front

Six platform absorbs in fourteen months. Cyera's $9B Series F is the counter-thesis. 95 citations across the absorption chain, the gravity vendors, and the attention vendors.

Read chapter → · 🎧 Listen on NotebookLM · PDF

Chapter Four · Convergence

The Convergence Synthesis

DSPM is the absorption substrate. Thoma Bravo is the stack thesis. Agentic AI pulls enforcement back to the data source. Two cross-front Pattern Claims with named falsifiability.

Read chapter → · 🎧 Listen on NotebookLM · PDF

Part 2: The Platform Wars.

Synthesis · Platform Wars

The Platform Wars Synthesis

Cross-front capstone analogous to Part 1's Convergence Synthesis. How the platform incumbents consolidate across Fronts 5 through 8.

Read chapter → · 🎧 Listen on NotebookLM · PDF

Updates · The story since we published

The market has been answering.

A report is a set of falsifiable calls, and the weeks after publication are where they get tested. Our Cyber Radar tracks what the named companies actually do next. New public evidence, dated and sourced, added here as it lands. So far, several of the report's Pattern Claims have fresh support and none have been contradicted.

Update 01 · July 9, 2026 · ~3 weeks after publication

The Market Answered in 18 Trading Days

The identity deals we said would be about machines, not people, closed three times: SailPoint bought Entro Security, Cisco moved on WideField, Barracuda took Evo. Yale University announced it is leaving Forcepoint for Microsoft Purview, exactly the platform-bundle displacement we called. And "AI agents are the new insiders" went from our thesis to every vendor's own pitch. Every move is public and dated.

View the update (14-slide carousel) → · Read the full market-moves brief
Pre-Call Briefing Pack: the Pattern Claims and buyer choices across both parts →

A 60-minute pre-read for analyst and operator calls with Yohay Etsion. Part 1's three Pattern Claims (DSPM Absorption Chain, Thoma Bravo Data Security Stack, Agentic AI Pulls Enforcement to the Data Source) plus Part 2's six platform-war claims (the SOC bifurcation, single-vendor SASE, the Pre-Gravity Window, identity platform-absorption, the Platform Wars Synthesis, and the One Force, Two Wars capstone), each with buyer choices and the falsifiable tests to interrogate them. Download as PDF →

Want the longer reading-notes version? Read the Report Digest → (chapter-by-chapter recap with embedded diagrams). PDF →

How to verify any claim in this report → Sourcing rules. Verifiable Proxy Rule. Disclosure framework. Refresh cadence.

Master citations file: 596 unique citations, 68 cross-chapter. View citations.md →