ProductBeacon — State of Cyber...
ProductBeacon — State of Cyber Security Markets 2026, Front 5: The SOC Platform War

Disclosure: This is ProductBeacon's independent, impartial market research, based solely on publicly verifiable signals, published on the open web. No vendor sponsors, no paywalled data, no analyst-firm reuse. It reflects ProductBeacon's independent view and is not investment advice. Full independence and sourcing methodology: Methodology →.

By Yohay Etsion · Head of Product (Fractional), AXIA · Creator of Product Org OS · Author of Leading the Charge (2023) and Vision to Value (coming 2026)

AXIA is an AI-powered data-security (Insider Risk Management / DLP) company.

5.1 The Playing Ground

5.1 The Playing Ground

The Detection & Response segment is where an organization watches its own systems for signs of compromise and acts on what it sees. Three product categories make it up. Endpoint Detection and Response (EDR) instruments laptops, servers, and workloads to record process behavior and detect attacker activity on the device itself.1 Extended Detection and Response (XDR) widens that lens beyond the endpoint, correlating signals from email, identity, network, and cloud into a single detection.2 Security Information and Event Management (SIEM) ingests logs and events from the entire estate, stores them, and runs correlation and analytics to surface threats and satisfy retention requirements.3

The strategic story of 2026 is the collapse of these three into one buying conversation: a unified "next-generation SOC" platform that promises detection, investigation, and response on a single data and workflow plane.4

What this segment is not matters as much as what it is. It is not vulnerability management — finding unpatched software before an attacker does is a prevention discipline, not a detection one. It is not pure network detection and response (NDR), though SOC platforms increasingly consume NDR signals. And it is not data-security or DLP: the SOC platform asks "is something attacking us right now?", not "is sensitive data leaving the building?" Those are adjacent fronts, each with its own core question.

The shared foundation. The SOC platform's defining primitive is the unified case timeline — the single chronology of what happened, in what order, across every system, that an analyst works from end to end. As the report's taxonomy frames it, EDR/XDR/SIEM platforms increasingly consume signals from other fronts: Insider Risk Management, DLP, Data Security Posture Management, Secure Service Edge, and Identity. They then present a unified case workflow over all of them.5 The same incident can originate as an insider exfiltration (IRM), a blocked transfer (DLP), an over-privileged access path (DSPM), an anomalous egress (SSE), or a privilege escalation (Identity). The SOC platform owns the orchestration of the case across those origins; the per-front platforms own the depth in their own lane. I read this division — orchestration depth versus depth in a single lane — as the fault line that decides who wins the best-of-breed-versus-platform argument. I return to it throughout this chapter.

Three buyer misconceptions are worth retiring before we map the market. The first is that "XDR replaces SIEM." It does not, cleanly. XDR correlates a curated set of high-fidelity sources well. But the compliance-grade log retention and arbitrary-source ingestion that SIEM provides remain a distinct requirement, which is precisely why the platform leaders are building data lakes underneath their XDR rather than retiring the SIEM tier.4

The second is that "more telemetry means better detection." Volume without curation raises both cost and analyst noise. The analyst-facing metric is signal quality, not gigabytes ingested, and the entire repricing tension described below flows from telemetry volume being a cost driver rather than a value driver.6

The third is that "the SIEM is just a log store." Treating it as passive storage misses where the product value — and the vendor lock-in — actually live: in the correlation, the detection-engineering, and increasingly the AI-investigation layer riding on top.7

Where the SOC Platform Sits in the Cyber Stack PRODUCTBEACON — STATE OF CYBER SECURITY MARKETS 2026, FRONT 5 SINGLE-LANE DEPTH, NARROW TELEMETRY CASE DEPTH ACROSS BROAD TELEMETRY SINGLE-SIGNAL DETECTION BROAD INGEST, SHALLOW WORKFLOW Telemetry Breadth (sources unified) → Single source Endpoint + Identity + Network + Cloud + Email + Logs ↑ Detection / Case Depth Analyst-grade case timeline Raw alert / log EDR deep on the endpoint lane SIEM log ingest + retention XDR curated cross-domain IRM · DLP · DSPM SSE · Identity adjacent fronts — signals consumed SOC PLATFORM unified case timeline EDR + XDR + SIEM, one plane The fault line: orchestration depth vs. depth in a single lane SOC platform — owns the case across origins (what happened, in what order, everywhere) Per-front specialists — own the depth inside their own lane (EDR on the box, SIEM on the log)

The vertical axis is how deeply a platform reasons over a single data type; the horizontal axis is how many telemetry sources it unifies. SOC platforms claim the upper-right — broad ingestion plus a case timeline deep enough for an analyst to work — while per-front specialists hold the depth corners in their own lanes.

5.2 The Terrain

5.2 The Terrain

Market sizing — three lenses, deliberately not averaged. There is no single "SOC platform" number, because the segment is an aggregation of overlapping categories that analysts size separately. Read three lenses side by side rather than collapsing them.

On the endpoint lens, the EDR market is estimated at roughly USD 6.3 billion in 2026, projected to near USD 18.7 billion by 2031 at about a 24% CAGR. A broader Endpoint Protection Platform framing runs higher, around USD 7.2 billion for 2026.8 On the SIEM lens, 2026 estimates cluster between roughly USD 8.4 billion and USD 12 billion, depending on whether managed services are folded in. Marketsandmarkets puts the core SIEM market at USD 8.39 billion in 2026, growing to USD 13.67 billion by 2031 (~10% CAGR); Mordor Intelligence sizes it at USD 12.06 billion.9 On the XDR lens, the youngest and most contested category, 2026 estimates range widely — from roughly USD 2 billion to USD 2.6 billion in conservative framings, up to high-single-digit-billions in aggressive ones, with growth rates above 20% on every estimate.10

The honest summary: the SIEM line grows in the low teens, while the EDR and XDR lines grow two to three times as fast. The gap between those growth rates is itself the market story — spend is migrating from passive log retention toward active, correlated detection.

Buyer trends. The dominant procurement shift is consolidation. Buyers who once assembled best-of-breed EDR, SIEM, and SOAR from separate vendors are increasingly evaluating a single platform that does all three, motivated by tool-sprawl fatigue, the cost of integration engineering, and the promise of one analyst workflow.11 This is not universal — regulated enterprises with heavy compliance-retention obligations still keep a dedicated SIEM — but the center of gravity in mid-market and growth-stage buying has moved decisively toward the platform pitch. A second buyer trend is the rise of managed and co-managed operations: the SOC-as-a-service and MDR adjacencies are growing because the analyst-talent shortage makes a fully self-run SOC impractical for most organizations.12

Technology trends. Three are reshaping the segment. The first, and loudest in 2026, is the agentic SOC analyst — AI that does not merely surface alerts but autonomously gathers cross-stack evidence, builds attack timelines, and proposes or executes remediation. SentinelOne's Purple AI is the clearest production example: the company reported Purple AI attached to over half of all licenses sold in its fourth fiscal quarter. SentinelOne shipped one-click agentic Auto-Investigation at general availability while keeping an analyst-in-the-loop governance model.13 Smaller entrants such as Dropzone AI push the same thesis from the autonomous-analyst edge.14

The second trend is data-lake architecture: rather than pay SIEM-tier prices to retain every log, platforms are splitting hot analytics from cheap long-term lake storage. Microsoft's Sentinel data lake is the reference implementation, with lake-only ingestion for Defender advanced-hunting tables now generally available. It sits under a Defender portal that Microsoft is positioning as the single SOC plane with embedded Security Copilot agents.15

The third trend follows directly: telemetry-cost pressure is repricing the SIEM. Because ingestion volume drives SIEM cost but not detection value in proportion, the vendors that can decouple the two gain pricing power, and those who cannot face margin compression. Cisco's Splunk-as-data-platform thesis is the largest bet here.16 One currency note worth fixing: Microsoft's retirement of the Sentinel experience in Azure in favor of the Defender portal is scheduled for 2027-03-31, not mid-2026. Any earlier date is out of date.17

Regulatory trends. The regulatory driver most specific to this segment is mandatory incident disclosure. In the United States, the SEC's rules require public companies to disclose a material cybersecurity incident on Form 8-K (Item 1.05) within four business days of determining the incident is material — a clock tied to the materiality determination, not the moment of discovery.18 I read this as a structural tailwind for the SOC platform pitch. A four-business-day disclosure obligation makes fast, defensible detection-and-investigation a board-level requirement rather than a security-team preference, and the platforms that can compress mean-time-to-understand are selling directly into that pressure. Government EDR mandates compound the effect: U.S. federal civilian agencies have been under binding deployment requirements that extended into cloud and identity coverage, pulling the public sector onto modern detection platforms on a regulatory timetable.8

5.3 The Contenders

5.3 The Contenders

The SOC Platform Vendor Landscape 2026 PRODUCTBEACON — STATE OF CYBER SECURITY MARKETS 2026, FRONT 5 AI-native detection core Retrofitted / acquired-engine integrator Detection-engine origin → ↑ Buyer-spend gravity (installed base + bundling) Owns the budget Earning the seat TIER COLOR Gravity — bends the market Attention — incumbents + contender Wildcard — private agentic bets Microsoft Defender + Sentinel (E5) CrowdStrike Falcon · established leader SentinelOne Singularity · AI-native pole Palo Alto Cortex XSIAM Cisco Splunk data-OS Vectra AI behavior-first NDR Hunters next-gen SIEM Dropzone AI agentic SOC analyst Author's read of public material, June 2026. Vendor positions are conceptual, not data-derived.

Author's read of public material, June 2026. Vendor positions are conceptual, not data-derived.

The SOC platform field divides cleanly along two questions: who already owns the buyer's spend, and whether the detection engine was built AI-native or retrofitted onto a signature-and-correlation core. The eight vendors below are grouped into three tiers — Gravity (the three platforms that bend the market around them), Attention (the consolidating incumbents and the analytical contender flanking the leaders), and Wildcard (two private agentic-SOC bets characterized descriptively only). Each card is anchored to a single dated vendor-controlled surface and at least one verbatim messaging pillar.

Gravity tier

Gravity tier

CrowdStrike

"The Agentic Security Platform. Unified and built to secure the AI revolution." — [crowdstrike.com/en-us/platform, accessed 2026-06-16]19

CrowdStrike is the category-defining endpoint platform. Its public messaging in mid-2026 has shifted from the long-running "we stop breaches" frame to an agentic-platform frame. The Falcon hero now reads as "the AI era is transforming cybersecurity across three critical fronts, and the CrowdStrike Falcon Platform secures them all."20 The stated USP is unification around a single agent and single console: endpoint detection and response as the anchor, expanding outward into SIEM (Falcon Next-Gen SIEM, built on the LogScale logging engine) and identity. The target buyer is the enterprise SOC standardizing on one platform to retire a tool sprawl. Falcon's module-based pricing rewards that bundling: the more modules a customer lights up, the lower the per-module cost, and that discount is the commercial mechanism behind the platform pitch.

Architecturally, CrowdStrike classifies as cloud-native (the Falcon sensor reports to a cloud analytics backbone) and platform-over-best-of-breed. But it is fundamentally an established-leader posture: the detection core predates the current AI-native wave, and the agentic layer is being added on top of an established EDR engine. That established-leader framing is central to the front. It is the pole against which the AI-native challenger narrative (SentinelOne, below) defines itself.

The published-material tier here is the strongest in the front. George Kurtz remains chairman and CEO, and the company reported roughly $4.5 billion in cash and equivalents in its fiscal Q1 2026 filing. Its continued tuck-in acquisitions (including a January 2026 identity move) are documented in SEC filings and named-outlet coverage rather than vendor blog posts alone.21 My read: CrowdStrike is the gravity well of this front, the vendor whose pricing and packaging choices set the reference point every other contender prices against.

Microsoft

"Prevent and disrupt threats with AI-powered, coordinated defense." — [Microsoft Defender, microsoft.com/en-us/security/business/microsoft-defender, accessed 2026-06-16]22

"Power your agentic defense with unified data and context." — [Microsoft Sentinel, microsoft.com/en-us/security/business/siem-and-xdr/microsoft-sentinel, accessed 2026-06-16]23

Microsoft's claim on this front rests on two products, not one: Defender for Endpoint as the EDR/XDR layer and Microsoft Sentinel as the cloud-native SIEM, with the Defender portal positioned as the single SOC plane that unifies both. Microsoft describes Sentinel as a "cloud-native SIEM that unifies AI, SOAR, UEBA, and TI," now wrapped in a unified data lake and "intelligent reasoning tools." It pairs the SIEM with Security Copilot agents for investigation.24

The stated USP is not a better detection engine — it is that the platform is already there: the buyer who runs Microsoft 365 E5 finds Defender and Sentinel inside a license they already pay for. That is the front's central platform-bundling story, and it is a pricing-pressure story before it is a capability story. E5 bundling compresses the standalone-EDR and standalone-SIEM deal that CrowdStrike, SentinelOne, and the independent SIEM vendors would otherwise win. The target buyer is the Microsoft-standardized enterprise; the architectural classification is cloud-native and platform-over-best-of-breed, with the SOC console (the Defender portal) as the unification surface.

One dated signal matters for currency: Microsoft extended the retirement of the legacy Sentinel-in-Azure experience to 2027-03-31, pushing the full migration into the Defender portal back from its earlier 2026 target.25 The published-material tier is named-outlet plus vendor-controlled, and SEC-grade for the financials behind it (MSFT, NASDAQ). My read: Microsoft does not need to win on detection sophistication to reshape this front. Bundling does the work, and the platform-pressure thesis below is built on exactly that mechanism.

SentinelOne

"AI-native security powered by Autonomous Security Intelligence. See further. Stop faster. Gain the edge." — [sentinelone.com, accessed 2026-06-16]26

SentinelOne is the public-market pure-play that has staked the AI-native position most explicitly. Its homepage leads with "Built to Secure. Engineered for Advantage." and an "AI-native security powered by Autonomous Security Intelligence" pillar — language deliberately drawn to contrast with the established EDR engines.26 The stated USP is autonomy: the Singularity platform and Purple AI "Auto-Investigations" frame the product as detection-and-response that runs at machine speed with less human triage.

The detail that matters most for classification, and the one a dated read would miss, is that SentinelOne is no longer accurately described as endpoint-pure. As of its fiscal Q1 2027 reporting (period ended 2026-04-30) the company disclosed roughly $1,163 million in ARR, up about 23% year over year. Roughly half of that ARR now comes from non-endpoint products — data, AI, and cloud.27 The repositioning was reinforced by two September 2025 acquisitions, Prompt Security and Observo, both AI-pipeline and AI-security tuck-ins.28

The target buyer is the SOC that wants an AI-first platform without defaulting to the established leader; the architecture is genuinely AI-native and cloud-native, classified as platform rather than best-of-breed. Published-material tier is the strongest available — public reporter (S, NYSE), with ARR and acquisition figures from SEC filings and named-outlet coverage. My read: labeling SentinelOne "EDR" in 2026 understates it. It has become the cleanest articulation of the AI-native pole, which is precisely why the AI-native-versus-incumbent line is the front's central pattern claim.

Attention tier

Attention tier

Palo Alto Networks

"Unparalleled data. Unbeatable AI. The most advanced SOC platform." — [Cortex XSIAM, paloaltonetworks.com/cortex/cortex-xsiam, accessed 2026-06-16]29

Palo Alto Networks competes here through Cortex — Cortex XDR and, as the leading edge of its platform-expansion push, Cortex XSIAM, which the company markets as the place to "unlock true AI-driven security operations" and "the autonomous SOC built to stop tomorrow's threats."30 The stated USP is convergence: XSIAM folds XDR, SOAR, and SIEM into one engine and pitches the SOC team on retiring the legacy SIEM entirely. The target buyer is the large enterprise consolidating a multi-tool SOC stack onto a single next-gen platform; the architecture classifies as AI-native at the analytics layer and platform-over-best-of-breed by design.

What earns Palo Alto its Attention-tier placement is not the SOC product alone but the capital behind it. The company recently closed two of the largest deals in the sector's history: CyberArk for roughly $25 billion (pulling identity security into the core platform; closed 2026-02-11) and Chronosphere for roughly $3.35 billion (cloud-native observability for AI-era data; closed January 2026). Cortex AgentiX is being integrated against Chronosphere for agentic find-and-fix.31 That makes Palo Alto the most aggressive acquirer in the set, and its war chest the largest signal in the table below.

Published-material tier is named-outlet plus SEC-grade (PANW, NASDAQ). My read: Cortex/XSIAM is a credible next-gen SOC contender on its own, but Palo Alto's real advantage on this front is the acquisition engine — it is buying its way across identity, observability, and detection faster than any rival can build.

Cisco

"Tired of disconnected tools? Meet the new standard for threat detection, investigation, and response (TDIR)." — [Splunk Enterprise Security (a Cisco company), splunk.com/en_us/products/enterprise-security.html, accessed 2026-06-16]32

Cisco's claim on the SOC runs through Splunk, the $28 billion acquisition that closed in 2024 and reshaped the SIEM landscape.33 The Splunk Enterprise Security product page — now footed as a Cisco company — positions the product as "a unified TDIR platform, seamlessly integrated with agentic AI, SOAR, UEBA, and SIEM." Cisco wraps Splunk's data engine together with Cisco XDR, Hypershield, and AI Defense into a single security narrative.34 The stated USP is the data operating system: Splunk's ingestion and analytics layer as the system of record for the SOC, with Cisco's network telemetry and threat intelligence (Talos) feeding it.

The target buyer is the large enterprise already running Splunk or Cisco networking that wants the SIEM and detection layer bundled with infrastructure it owns — the same cross-sell pricing-power play Microsoft runs, but anchored on networking rather than productivity. Architecturally Cisco is a hybrid, a platform-over-best-of-breed integrator stitching acquired engines together rather than a single AI-native core. The open question this front returns to in §5.6 is whether that integration can credibly replace a best-of-breed SIEM. Cisco reported roughly $1.95 billion in quarterly security revenue (up about 9% year over year) and reportedly around 5,000 customers across its newer security products.35

Published-material tier is named-outlet plus SEC-grade (CSCO, NASDAQ). My read: Cisco's Splunk integration is the bellwether for whether platform bundling can swallow the SIEM category — if it works, best-of-breed SIEM contracts; if it stalls, the independents get a reprieve.

Vectra AI

"AI-native, not AI nonsense." — [vectra.ai, accessed 2026-06-16]36

Vectra AI is the analytical contender of the Attention tier — the private specialist whose differentiation thesis is behavior-first detection rather than signature or correlation. Its homepage frames the pitch bluntly as "AI-native, not AI nonsense" and "we protect modern networks from modern attacks, Vectra AI sees attackers' every move, connecting the dots across network, identity, and cloud."36 The stated USP is Attack Signal Intelligence: detection driven by attacker behavior across network, identity, and cloud, positioned against the alert-noise problem that the established correlation engines generate. The target buyer is the SOC that wants high-fidelity detection layered over (not replacing) its existing SIEM — an analytical complement more than a platform play. Vectra's 2026 acquisition of Netography nudges it toward converged cloud observability. The architecture is AI-native and best-of-breed by positioning rather than platform integrator.

Two facts correct any "challenger" framing. Vectra was named a Leader in the 2026 Gartner Magic Quadrant for Network Detection and Response for the second consecutive year, and it is a private unicorn valued at roughly $1.2 billion, having raised roughly $425 million across its history.37 Published-material tier is named-outlet (analyst coverage, funding announcements) plus vendor-controlled. My read: Vectra is the clearest case in the front that "best-of-breed AI detection" still commands an analyst-validated seat at the table even as the platforms consolidate around it. But it is the smallest and least bundled of the public-facing contenders, which is its structural vulnerability if the consolidation thesis holds.

Wildcard tier

Wildcard tier

Hunters

"AI-Driven Next-Gen SIEM. Automated detection, investigation & response for small SecOps teams." — [hunters.security, accessed 2026-06-16]38

Hunters is the Israeli SOC platform that positions itself as a SIEM replacement. It leads with "AI-Driven Next-Gen SIEM" and the buyer-side promise of "a SIEM that works for you, not the other way around."38 Descriptively, the stated USP is built-in detection engineering and automated investigation delivered as a platform rather than a toolkit the customer must assemble — aimed at SOC teams that want SIEM outcomes without the operational overhead the legacy SIEM imposes. The target buyer described on its surfaces skews toward leaner SecOps teams. Architecturally it presents as cloud-native and SIEM-replacement in framing. On the funding picture, the most recent verifiable round is the $68 million Series C from January 2022 (roughly $118 million raised in total). No newer raise surfaced in the bounded scan, so this card makes no claim of recent capital.39 Published-material tier is vendor-controlled plus the 2022 named-outlet funding coverage. I keep this read descriptive, and Hunters does not feature in the pattern claims that close this chapter.

Dropzone AI

"Reinforce your SOC with AI Analysts. Hunt, investigate, and respond at machine scale." — [dropzone.ai, accessed 2026-06-16]40

Dropzone AI is the agentic-SOC-analyst wildcard — the smallest-vendor edge of the AI-native SecOps story. Its homepage describes an "Agentic SOC" that "continuously adapts your detection and response," with an "AI SOC analyst" that "replicates the techniques of elite analysts to autonomously investigate and solve every alert."40 Descriptively, the stated USP is autonomous alert investigation: an AI analyst that triages and investigates Tier-1 alerts without a human in the loop, sold to SOC teams drowning in alert volume. The target buyer described on its surfaces is the resource-constrained or alert-saturated SOC looking to offload investigation labor. Architecturally it presents as agentic and AI-native by construction rather than retrofit. On funding and scope, Dropzone raised a $37 million Series B in July 2025 led by Theory Ventures, and reports more than 100 customers. It has signaled an expansion from triage into full-spectrum detection, with an AI Threat Hunter and AI Threat Intel Analyst slated for the first half of 2026.41 Published-material tier is vendor-controlled plus named-outlet funding coverage. I keep this read descriptive, and Dropzone does not feature in the pattern claims that close this chapter; the agentic-SOC thesis it embodies is examined in depth in the AI Security front (Front 7).

5.4 Their Plays

5.4 Their Plays

The SOC platform market is not fighting over features in 2026. It is fighting over what counts as the platform. Four plays are in motion, and each one is an argument about where the gravity of the security operations center should sit: in the detection engine, in the data layer, in the AI analyst, or out at the edge. Below, each play is stated as an observation grounded in a public signal, the named participants, and a conditional outcome that resolves against something an outsider can actually watch happen.

Play 1: The Next-Gen-SOC Conso...

Play 1: The Next-Gen-SOC Consolidation Play

Play 2: The Splunk-as-Data-OS ...

Play 2: The Splunk-as-Data-OS Play

Play 3: The Agentic-SOC-Analys...

Play 3: The Agentic-SOC-Analyst Play

Play 4: The MDR-Boundary-Move ...

Play 4: The MDR-Boundary-Move Play

5.5 War Chests & Casualties

5.5 War Chests & Casualties

The capital picture for this front splits cleanly into two groups: public incumbents financing consolidation off their own balance sheets, and privately held specialists whose last fundraises range from very recent to several years old. The snapshot below mixes both. For deeper venture-landscape analysis across all fronts, see the Phase 3 convergence chapter.

VendorMost Recent RoundValuation (if public)Strategic InvestorDistress Signal
Palo Alto Networks (NASDAQ: PANW)Public; deployed ~$25B (CyberArk, closed 2026-02-11) + ~$3.35B (Chronosphere, closed Jan 2026)52Public market capPublic-market funded(empty — no public distress event)
CrowdStrike (NASDAQ: CRWD)Public; ~$4.5B cash and equivalents, FY26 Q1; ongoing tuck-in M&A53Public market capPublic-market funded(empty — no public distress event)
SentinelOne (NYSE: S)Public; ~$1,163M ARR (+23% YoY), fiscal Q1 2027; acquired Prompt Security + Observo54Public market capPublic-market funded(empty — no public distress event)
Cisco (NASDAQ: CSCO)Public; ~$28B Splunk integration deepening; security revenue ~$1.95B/quarter55Public market capPublic-market funded(empty — no public distress event)
Vectra AI (private)~$425M raised across ~15 rounds; acquired Netography (terms undisclosed)56~$1.2B (private, last reported)Venture-backed unicorn(empty — no public distress event)
Dropzone AI (private)$37M Series B, July 2025 (Theory Ventures; Madrona, Decibel, PSL, IQT)57Not disclosedTheory Ventures (lead); IQT(empty — no public distress event)
Hunters (private)$68M Series C, January 2022; ~$118M total raised. No newer round on public record58Not disclosedVenture-backed(empty — no public distress event)

The dynamic is asymmetric. The public players are spending balance-sheet cash to buy adjacencies into the SOC platform: Palo Alto bought identity and observability, Cisco bought the data layer, and CrowdStrike and SentinelOne are funding tuck-ins from cash and growing ARR. The privately held specialists divide by capital recency. Dropzone AI raised fresh capital in mid-2025 and is expanding scope on the strength of it. Vectra AI sits on a unicorn valuation and used it to acquire Netography. Hunters, by contrast, last raised publicly in January 2022, and no newer round appears on the public record, so any read of its position should rest on its standalone SIEM-replacement traction rather than on implied capital. None of the seven carries a citable public distress event in this snapshot. Cybereason's reported 2023–2024 down-round narrative is the nearest distress candidate in this segment, but it is not a top-eight contender here and is left out of this table rather than labeled without a same-paragraph dated source.59

5.6 Winning & Losing

5.6 Winning & Losing

The SOC platform war is the most contested ground in the entire report, and it is contested on two axes at once. The first axis is the endpoint battlefield proper: who owns the agent on the box, the detections it fires, and the analyst workflow that triages them. The second axis is the SIEM battlefield above it: who owns the data lake, the correlation engine, and the economics of ingesting everything an enterprise generates. For a decade these were separate fights with separate winners. In 2026 they are collapsing into one, and the vendors who win the collapse are the ones who can credibly tell a buyer "one platform, one console, one bill" without that promise falling apart under the weight of telemetry costs.

Three patterns explain who is advancing and who is dug in. The first is a clean segmentation line opening up between an AI-native challenger and the scaled incumbent. The second is the platform pressure a bundled-by-default SOC plane exerts on every standalone vendor below it. The third is the absorption test that will decide whether platform consolidation can actually replace best-of-breed SIEM, or whether telemetry economics quietly defeat the consolidation pitch. Each is a falsifiable thesis, not a forecast — I have named the public signal that would confirm or refute it by the next refresh.

Pattern Claim 1 — The Sentinel...

Pattern Claim 1 — The SentinelOne–CrowdStrike Bifurcation Thesis

Observation.

My read.

Conditional prediction.

Sources. 60 61 62

The SentinelOne–CrowdStrike Bifurcation Thesis PATTERN CLAIM 1 — STATE OF CYBER 2026, FRONT 5 The two leaders stop competing for the same buyer — a segmentation line, not a feature war SentinelOne the AI-native pole Wins the fresh-choice buyer ~$1,163M ARR (+23% YoY) ~50% of ARR now non-endpoint (Data / AI / Cloud) $44M net-new ARR (+55% YoY) Purple AI Auto-Investigations Bet: choosing a SOC platform fresh, on AI-native architecture Q1 FY27, period ended 2026-04-30 SEC 10-Q (NYSE: S) CrowdStrike the scaled incumbent Defends the installed estate $5.25B ending ARR (+24% YoY) Falcon Flex: $1.69B ending ARR (+120% YoY) 1,600+ customers > $1M ARR each Consumption-based land-and-expand Moat: cheaper to add a module than to evaluate a competitor 7th consecutive Gartner EPP Leader highest on both axes two segments FALSIFIABLE TEST — H2 2026 / FY27 CONFIRMED if SentinelOne keeps disclosing non-endpoint ARR mix rising above ~50% AND converts it into a named-outlet enterprise reference win displacing an incumbent EDR estate — the AI-native segment is durable. REFUTED if the non-endpoint mix plateaus while CrowdStrike Falcon Flex ending ARR keeps compounding above 80% YoY and SentinelOne net-new ARR growth decelerates — the incumbent's consumption scale reabsorbs the middle.
Pattern Claim 2 — The Microsof...

Pattern Claim 2 — The Microsoft Platform-Pressure Thesis

Observation.

My read.

Conditional prediction.

Sources. 63 64

The Microsoft Platform-Pressure Thesis PATTERN CLAIM 2 — STATE OF CYBER 2026, FRONT 5 A SOC plane pre-paid inside the M365 E5 bundle compresses every standalone deal below it M365 E5 bundle Defender + Sentinel unified Defender portal · "already paid for" Standalone EDR "is it enough better to be a 2nd line item?" Standalone SIEM repriced against "good enough + included" Mid-market SOC (sharpest pressure) small team · E5 estate in place · "already included" wins Sentinel-in-Azure retires 2027-03-31 (extended from 2026-07-01) — a longer runway, not a retreat High-end SOC: pressure real but more resistible (efficacy is a board-level concern) FALSIFIABLE TEST — FY2026–FY2027 CONFIRMED if 2+ standalone EDR/SIEM vendors cite Microsoft bundling as a named headwind on mid-market deal sizes/win rates AND Microsoft discloses accelerating unified-Defender SOC-plane adoption through the 2027-03-31 retirement. REFUTED if standalone vendors hold or grow mid-market deal sizes and analyst share data shows no Microsoft share gain — coexistence, not displacement.
Pattern Claim 3 — The Splunk-A...

Pattern Claim 3 — The Splunk-Absorption Thesis

Observation.

My read.

Conditional prediction.

Sources. 65 66

The Splunk-Absorption Thesis PATTERN CLAIM 3 — STATE OF CYBER 2026, FRONT 5 The live experiment: can a platform vendor absorb a best-of-breed SIEM and reprice telemetry economics? Splunk data engine $28B acquisition (closed 2024) +500 logos H1 FY26 Cisco telemetry XDR · Hypershield · AI Defense Talos threat intel · the network SOC "data OS" Splunk on Cisco's network $8.09B FY25 security rev (+59%) The open question Lower cost-per-GB than a best-of-breed SIEM standalone? logos ≠ economics proof If it works, every platform-consolidation story gets a tailwind. If not, "platform replaces best-of-breed SIEM" stays a slide, not a budget reality. FALSIFIABLE TEST — FY2026–FY2027 CONFIRMED if Cisco's earnings keep showing Splunk ARR + the combined security portfolio compounding double digits AND a named outlet documents an enterprise migrating off a standalone best-of-breed SIEM onto Splunk-on-Cisco specifically on telemetry-cost grounds. REFUTED if Splunk logo growth decelerates, Cisco stops breaking out Splunk momentum in its security commentary, or Gartner's SIEM/SecOps coverage keeps best-of-breed independents seated above the Cisco-Splunk combination on execution — best-of-breed SIEM survives the consolidation wave on economics the platform could not beat.
Winners

Winners

CrowdStrike is winning the commercial dimension of this war. Crossing $5.25B ending ARR at 24% growth with Falcon Flex ending ARR up over 120% year-over-year is, in my read, the clearest evidence in the front that a consumption-based consolidation model can lock in an installed base while still expanding it 61. The seventh consecutive Gartner EPP Leader placement — positioned highest on both Ability to Execute and Completeness of Vision — confirms the analyst community sees no erosion of the core franchise even as the company pushes into AI detection-and-response and the agentic interaction layer 62 67. My opinion: CrowdStrike's moat in 2026 is as much commercial architecture (Flex) as it is detection efficacy.

SentinelOne is winning the repositioning it set out to win. Reaching ~50% non-endpoint ARR while sustaining 23% ARR growth and posting a company-record $44M in net-new ARR (up 55% year-over-year) is, in my view, the strongest available public evidence that the AI-native platform narrative is converting to revenue rather than just messaging 60. It is not winning at CrowdStrike's scale, but it is winning the argument that a public pure-play can credibly anchor the AI-native segment.

Microsoft is winning by default-distribution. I read the deliberate, unhurried extension of the Defender-portal consolidation to 2027-03-31 as the move of a vendor that does not need to rush because the E5 bundle keeps compounding its reach into the SOC regardless of release cadence 63. The seventh consecutive EPP Leader placement removes the "good enough but not a Leader" objection that once let standalone vendors hold the line 62.

Losers / Casualties

Losers / Casualties

Cybereason is the front's clearest casualty. Its valuation collapsed roughly 90% from $3.3B in July 2021 to about $300M by April 2023, it ran a third round of layoffs in March 2024 that included the exit of its product and R&D head, and it saw a CEO transition in 2025 68. Its proposed merger with MDR provider Trustwave, announced November 2024, was subsequently terminated 68. Each of those is a dated public event; together they describe a vendor that has lost the scale race in the EDR tier and has not found a consolidation lifeline.

The SIEM-tier consolidation has produced one large defensive combination rather than a clear casualty: the Exabeam–LogRhythm merger completed July 17, 2024, and was accompanied by layoffs of 80 workers in Broomfield as the merged entity rationalized two overlapping SIEM portfolios 69. I would not label the merged Exabeam a casualty — it is a consolidation play with a credible pure-play SecOps pitch — but the layoffs are the dated evidence that the standalone-SIEM middle is under genuine pressure, consistent with the Microsoft platform-pressure and Splunk-absorption theses above.

Watch

Watch

Hunters is the watch signal I would track most closely on funding cadence. Its most recent verifiable round remains the $68M Series C from January 2022 (~$118M total raised); no newer raise has surfaced 70. For a SIEM-replacement SOC platform competing against Cisco-Splunk, Microsoft, and CrowdStrike's LogScale, a four-year gap since the last public round is a signal worth watching. It is not a distress label, but a cadence that would warrant reassessment at the next refresh if it extends through 2026 without a new round or a strategic outcome.

Dropzone AI is the agentic-SOC wildcard scaling into the thesis. Its $37M Series B (July 2025, Theory Ventures) funds an expansion from triage-only into full-spectrum detection with AI Threat Hunter and AI Threat Intel Analyst agents launching in Q2 2026 71. Whether the autonomous-SOC-analyst category becomes a feature absorbed by the platforms or a standalone wedge is the open question; Dropzone's capability expansion is the public signal to watch.

Vectra AI is worth watching post-Netography. Its acquisition of Netography (terms undisclosed) nudges it from AI-driven NDR toward converged cloud network observability, and it was named a Leader in the 2026 Gartner Magic Quadrant for NDR for the second consecutive year 72. The watch question is whether behavior-first NDR remains a distinct analytical contender or gets pulled into the converging XDR/SOC-platform gravity well the three Pattern Claims describe.

5.7 The Campaign Ahead

5.7 The Campaign Ahead

The SOC platform war will be decided in public over the next several quarters, and the signals that decide it are observable without privileged access. These are the five I would put on the H2 2026 watchlist, each with a falsifiable threshold and a primary source class anyone can monitor.

  1. The non-endpoint ARR mix at the AI-native pure-play. Signal: SentinelOne's quarterly earnings disclosures of non-endpoint (Data/AI/Cloud) ARR as a share of total ARR. Threshold: if the non-endpoint share rises above the ~50% Q1 FY27 mark across two consecutive quarters, the AI-native segment is structurally expanding; if it plateaus or reverses, the bifurcation thesis weakens. Primary source: SentinelOne (NYSE: S) earnings transcripts and 10-Q filings 73.
  1. The Microsoft Defender single-SOC-plane unification at the retirement date. Signal: Microsoft's disclosures on unified Defender-portal SOC adoption as the 2027-03-31 Sentinel-in-Azure retirement approaches, plus any standalone-vendor earnings commentary naming Microsoft bundling as a deal-size headwind. Threshold: if two or more standalone EDR/SIEM vendors cite Microsoft bundle pressure on mid-market deal economics in earnings commentary, the platform-pressure thesis is confirmed. Primary source: Microsoft Security blog/Tech Community posts and standalone-vendor earnings transcripts 74.
  1. Cisco-Splunk telemetry-economics repricing. Signal: Cisco's security-segment and Splunk-momentum disclosures in FY2026–FY2027 earnings, plus any named-outlet report of an enterprise migrating off standalone best-of-breed SIEM onto Splunk-on-Cisco on cost-of-ingestion grounds. Threshold: a documented best-of-breed-SIEM-to-Splunk-on-Cisco migration cited specifically on telemetry economics confirms the absorption thesis; continued logo growth without an economics proof point does not. Primary source: Cisco (NASDAQ: CSCO) earnings transcripts and named-outlet enterprise coverage 75.
  1. The agentic-SOC GA milestone. Signal: general-availability launches of autonomous-SOC-analyst capabilities across the front — Dropzone's AI Threat Hunter and AI Threat Intel Analyst agents (slated Q2 2026), CrowdStrike's agentic interaction-layer protection, SentinelOne's Purple AI Auto-Investigations, and Microsoft's Defender AI agents. Threshold: if three or more contenders ship GA agentic-SOC capabilities as a headline product-page hero by year-end, autonomous triage has crossed from differentiator to table stakes. Primary source: vendor product-page hero snapshots and funding/launch announcements 76.
  1. CrowdStrike's Falcon Flex consumption trajectory. Signal: CrowdStrike's quarterly disclosure of Falcon Flex ending ARR and account count. Threshold: if Flex ending ARR growth stays above 80% year-over-year through FY2027, the consumption-based bundling moat is widening and the contested middle reabsorbs toward the incumbent; if Flex growth decelerates sharply, the AI-native challenger has more room than the bifurcation's incumbent branch assumes. Primary source: CrowdStrike (NASDAQ: CRWD) earnings transcripts and 8-K exhibits 77.
References & Footnotes

References & Footnotes

References

1 / 22
Section