Report Digest

State of Cyber 2026 is one report told in two movements. The data war (Part 1: insider risk, data loss, data posture) and the platform war (Part 2: the SOC, the edge, AI security, identity) are not two markets. They are two fronts of a single contest, and the same platform incumbents are winning both.

The Arc: One Force, Two Wars

Read end to end, this report makes one argument. The same handful of platform incumbents, Microsoft, Palo Alto Networks, and CrowdStrike above all, are winning two wars at once.

The first war is fought on the data layer. Who is doing what (insider risk), what data is moving (data loss prevention), what data exists and who can reach it (data security posture). The second war is fought on the platform layer. Who owns detection and response, the secure edge, the emerging AI-security stack, and the identity control plane beneath every alert.

One force drives both. The autonomous AI agent, and the machine-versus-human identity inversion it produces, roughly 80 machine identities for every human, is the upstream cause. That one force expresses as two enforcement primitives: govern the data at its source (Part 1) and govern the agent's identity (Part 2). A platform that can do both governs an agent end to end. That is why the incumbents are buying their way across every front, and why the buyer's real decision spans both parts at once.

The honest qualification, carried from the capstone: same force does not mean same problem. The data layer was Part 1's headline; agent identity was Part 2's. The report is one report because the force is one force, not because the two wars collapse into a single problem. The win is also bounded. The incumbents take the mid-market and the greenfield buyer decisively; the sophisticated enterprise tier stays genuinely contested in both wars.

Not investment advice. See Disclosures.

How to Read This Digest

This is an executive distillation of all eight fronts. It opens with the shared arc above, then takes the two movements in turn.

Movement One, the data war covers insider risk, data loss, and data posture, then the Part 1 convergence read. Its spine claim: a DSPM absorption chain is pulling the standalone data-security lanes into the platforms that were supposed to replace them. The data layer wins the substrate role.

Movement Two, the platform war covers the SOC, the edge, AI security, and identity, then the Part 2 synthesis and the One Force, Two Wars capstone that braids both movements together. Its spine claim: four nominally distinct fronts are one platform-consolidation contest, vectored by agent identity.

Each front below is a short, scannable digest of a full chapter, with the load-bearing Pattern Claim and a falsifiable test you can re-check from public signals. The numbers are public and live in the chapters. Every read is the author's, hedged and attributed.

Methodology Snapshot

ProductBeacon Research is built on a publishing standard three audiences should be able to verify independently: private-equity and hedge-fund analysts, CISO operators, and fractional product leaders. We publish the rules so the bar is checkable.

596 citations across eight fronts and two parts. 68 of those are cross-chapter references where the same source anchors claims across multiple fronts, most often where an absorption thesis depends on signals cited in more than one front. The four data-war chapters of Movement One carry 280 of the citations:

• IRM: 60 citations.
• DLP: 103 citations.
• DSPM: 95 citations.
• Convergence: 22 citations.

The platform-war chapters of Movement Two carry 302, and the One Force, Two Wars capstone carries the remaining 14, spanning both movements:

• SOC Platform War: 77 citations.
• Edge Theater: 80 citations.
• AI Security: 69 citations.
• Identity: 61 citations.
• Platform Wars Synthesis: 15 citations.

Every claim cites at the point it is made. We cite when we claim, not when we speculate.

Zero vendor sponsors. No paywalled data. No analyst-firm reuse. We do not accept vendor sponsorship, republish paywalled analyst datasets, or reuse paid analyst-firm conclusions. The frameworks are our own. Named vendors do not receive pre-publication review of how they are covered.

Verifiable Proxy Rule. Every falsifiable test in the report grounds on a publicly observable signal. During pre-publication audit on 2026-05-20, six conditional predictions originally hung on "enterprise RFP language" as the falsifiable test. RFPs are private. A reader cannot independently observe what an enterprise puts into one. We rewrote all six against named-outlet customer wins, vendor earnings disclosures, analyst category-reclassification events, product-page hero changes captured as dated HTML, SEC filings, and funding rounds. Predictions grounded on private data cannot be falsified by the reader; predictions grounded on public signals can.

Post-publication factual-correction window. Within five business days of publication, any named vendor may request a factual correction by writing to the published research contact. We will correct factual inaccuracies. We will not negotiate positioning, change Winner / Watch / Loser characterizations, or remove Pattern Claims under vendor pressure. The correction window is for facts, not framing.

Author conflict disclosure. Yohay Etsion is Head of Product (Fractional) at AXIA, which competes in the Data Loss Prevention segment covered in this report. The methodology applies equally to AXIA-adjacent vendors and to non-adjacent vendors. There is no parity exception.

Full methodology page, including refresh cadence and the canonical 596-citation list, lives at productbeacon.agency/research/methodology.html.

Movement One · The Data War

Three fronts, one absorption wave

The data war is fought across three fronts that ask three different questions about the same sensitive data: who is touching it (insider risk), what is moving and where (data loss), and what exists and who can reach it (data posture). The 2026 read is that these three are collapsing into one buying conversation anchored on the data layer. The convergence section closes the movement; the capstone in Movement Two ties it back to the platform war.

IRM, The Insider Risk Landscape

The Insider Risk Management chapter evaluates eight vendors across three tiers: three Gravity (Microsoft Purview, Varonis, Proofpoint ITM), four Attention (Cyberhaven, DTEX Systems, Mimecast Incydr, Everfox), and one Wildcard (Above Security). IRM answers a different question from the adjacent categories: who is doing what, and why, not what data is moving (DLP) or what data exists (DSPM). The 2026 product narrative has converged on AI-driven behavioral analysis at the content and intent layer, replacing the rule-and-anomaly UEBA tooling that defined 2018-2023.

Top three takeaways.

• Distribution wins the default-choice slot. Microsoft Purview ships IRM inside the M365 E5 bundle with twelve policy templates including "Risky AI usage" and "Risky Agents (preview)". The buyer rarely makes a standalone IRM purchase decision when Purview is already activated.
• AI-actor framing has gone from differentiator to table-stakes-in-progress. Above Security's USD 50M Series A funding thesis explicitly treats AI agents as insiders; Cyberhaven, DTEX, and Microsoft Purview all ship AI-actor coverage; if every Gravity-tier vendor has both an AI-usage template and an autonomous-agent investigation experience by Q4 2026, the wedge closes.
• Public-market discipline anchors the credibility floor. Varonis (NASDAQ:VRNS) at 16% YoY total ARR growth and 32% SaaS-ARR growth in Q4 2025 is the most analyzable Gravity-tier vendor in the category.

Pattern Claim from the IRM chapter, The Mimecast Absorption Thesis. Mimecast acquired Code42 in July 2024. The code42.com homepage now 301-redirects to mimecast.com/products/incydr; the Incydr page hero now reads "Adaptive data protection for a changing world" with no use of the phrase "insider risk" in the primary header. I read this as Mimecast subordinating the standalone IRM category brand to a broader Human Risk Management umbrella. The Pattern Claim is structural: if Mimecast's H2 2026 product cadence shows Incydr-branded releases on parity with pre-acquisition velocity, the absorption is structural-only; if Incydr is described only as a "module" or "capability" of the Mimecast HRM platform by Q4 2026, the standalone identity is consumed. This is one of three category-absorption events in 2024-2026 that Part 1 documents.

Full chapter at productbeacon.agency/research/state-of-cyber-2026/irm.html.

DLP, The Data Loss Landscape

The Data Loss Prevention chapter evaluates nine vendors across three tiers: three Gravity (Microsoft Purview DLP, Broadcom/Symantec, Forcepoint), four Attention (Cyberhaven, Nightfall AI, Fortra/Digital Guardian, Proofpoint Enterprise DLP), and two Wildcard (Cyera, Operant AI). DLP answers what data is moving, in what channel, with what enforcement primitive applied. The 2026 product narrative has shifted from regex-and-fingerprint as the primary substrate toward AI-classifier substrates, and from "stop the file from leaving" toward "stop the sensitive content from being typed into a chatbot or pasted into an agent's tool call."

Top three takeaways.

• The DSPM-eats-DLP convergence has crossed from positioning into vendor reality. Microsoft Purview ships a productized Symantec-and-Forcepoint-to-Purview migration assistant. Cyberhaven's February 2026 unified launch bundles DSPM + DLP + IRM + AI Security on a single data-lineage substrate. BigID, Palo Alto Prisma Cloud, and IBM Guardium all now position DLP as a module of a DSPM-anchored platform.
• Identity-led DLP is the post-CyberArk question. Palo Alto Networks closed its USD 25B CyberArk acquisition on February 11, 2026, the largest cybersecurity deal in history, with a closing release citing an 80-to-1 machine-vs-human identity ratio. That ratio is the load-bearing number: content-rule DLP cannot scale to machine-identity volume even in principle.
• MCP-DLP is a genuine category-formation moment. Operant AI launched Endpoint Protector on May 4, 2026 covering the Model Context Protocol surface that legacy DLP, CASB, and proxy controls have zero visibility into.

Pattern Claim from the DLP chapter, Identity-Led DLP Post-CyberArk. The historical content-classification-led DLP architecture asks what content is moving. The identity-led pitch asks which identity is moving content and is that identity privileged to do so. The 80-to-1 ratio gives the identity-led pitch durability that pure platform-bundling does not have. The falsifiable test: if by Q4 2026 either Palo Alto Networks' earnings cite Cortex XSIAM + Prisma Cloud DLP + CyberArk integration as a named contributor to enterprise wins, or Microsoft adds "Entra ID identity-aware DLP" as a headline capability with named reference customers, or Gartner reclassifies identity-integration as a baseline DLP requirement, the enforcement primitive has reorganized.

Author conflict disclosure. AXIA, where I am Head of Product (Fractional), competes in the Data Loss Prevention segment. The methodology is built so this disclosure does not require a reader's trust. Every claim in the DLP chapter, including those touching AXIA-adjacent vendors, grounds on the same Verifiable Proxy Rule applied across the other three chapters. There is no parity exception.

Full chapter at productbeacon.agency/research/state-of-cyber-2026/dlp.html.

DSPM, The Data Posture Landscape

The Data Security Posture Management chapter evaluates eight vendors across three tiers: two Gravity (Microsoft Purview DSPM, BigID), four Attention (Cyera, Sentra, Proofpoint DSPM, Symmetry Systems), and two Wildcard (Concentric AI, Bedrock Data). DSPM answers what data exists, where it sits, who can reach it, and how exposed it is. The 2026 product narrative has expanded scope from cloud-storage-only coverage to a multi-estate scope that explicitly includes AI training pipelines and the vector stores feeding production LLM and agent workflows.

Top three takeaways.

• The boundary problem is itself the load-bearing observation. Four distinct vendor archetypes claim DSPM territory: DSPM-native specialists (Cyera, Sentra), platform-incumbents-with-DSPM-module (Microsoft Purview, BigID), CNAPP-extensions claiming DSPM (Wiz, Orca, CrowdStrike, FortiCNAPP), and data-governance pivots (Securiti). The chapter's scoping rule places vendors whose primary product page leads with DSPM as the headline category in the Contenders table; CNAPP-extensions appear as Plays-only references. The boundary itself is a Pattern Claim.
• The Cyera valuation cadence (USD 1.4B April 2024 to USD 3B November 2024 to USD 6B June 2025 to USD 9B January 2026, four rounds in twenty-one months) is the largest concentration of data-security capital in the 2024-2026 cohort.
• The August 2, 2026 EU AI Act Article 10 enforcement deadline is the most-cited single 2026 regulatory deadline in DSPM buyer-facing material; the obligations on training-data governance map directly onto the DSPM discovery + classification + lineage + access-governance surface.

Lead Pattern Claim across the launch cascade, The DSPM Absorption Chain. Per Yohay's launch-post framing, this is the one claim that has six platform absorbs in fourteen months on one side and Cyera's USD 9B Series F on the other. The chapter sources seven category-shaping events across approximately two years (IBM-Polar, PANW-Dig, CrowdStrike-Flow, Rubrik-Laminar, Proofpoint-Normalyze, Veeam-Securiti AI at USD 1.725B closed December 2025, Google-Wiz at USD 32B closed early 2026). The C-1 launch post compresses the framing to "six platform absorbs in fourteen months" to land the cascade tease; the chapter itself anchors the longer event chain. Both framings point to the same wave: platform incumbents from four different starting positions (data-resilience, CNAPP, identity, and email-security) are all converging on a DSPM-anchored data-security stack. The standalone-DSPM lane survives only at the AI-training-pipeline frontier where CNAPP-bundled DSPM has not caught up; the Cyera mega-round is the standalone-leader pole that the absorption is failing to consume.

Full chapter at productbeacon.agency/research/state-of-cyber-2026/dspm.html.

Convergence, The Cross-Front Synthesis

The Convergence chapter is the synthesis the three data-war fronts could not contain on their own. It argues one chosen thesis and keeps two serious counter-positions on the table. The reader's renewal-cycle bet depends on which one is right.

The chosen read: the data layer is the substrate. The 2026 consolidation of insider risk, data loss, and data posture is not three parallel races. It is one absorption wave in which the data layer becomes the anchor for the categories around it. DSPM wins the substrate role because every front ultimately needs the same primitive: where sensitive data sits, who can reach it, and what its classification says downstream controls should trust. Insider risk and data loss are absorbing into platforms whose load-bearing surface is that data layer.

Two counter-reads, kept honest. The first says the convergence is pure platform economics: Microsoft Purview ships all three as modules of one E5 SKU, and the survivors are simply whoever has cross-module distribution, with no special privilege for the data layer. The second says agentic AI is the driver and the fronts collapse because the subject of analysis is no longer cleanly human or non-human, so the survivors are whoever accommodates that data-actor collapse natively. The chosen read argues the architectural force dominates; the counters argue the platform layer wins regardless of architecture.

Who is advancing, and who is exposed. Three vendors are positioned to win, each in a separate lane.

• Microsoft Purview wins the cross-front-platform lane: the only Gravity-tier vendor in all three fronts, the default in Microsoft-standard enterprises.
• Cyera wins the standalone-DSPM lane on capital depth, its USD 9B January 2026 Series F the largest data-security-private mark on the table.
• Cyberhaven wins the unified-platform-challenger lane, compounding funding, revenue, and a single-lineage-substrate platform across a fourteen-month window.

There is no named Convergence-level loser. What the wave produces instead is a structural loser position: any single-category specialist with no platform attach and no AI-training-pipeline differentiator faces renewal-cycle pressure by H2 2026, regardless of product quality. The exposed specialists already sit on the per-front Watch lists.

The buyer's three choices follow directly, and are the same three the report returns to at the close:

• Consolidate to a platform.
• Buy best-of-breed across the fronts.
• Hybridize on a DSPM anchor with selective augmentation.

Each has defensible logic; the renewal cycle reveals which assumption the buyer was operating under.

The two cross-front Pattern Claims

Two claims span all three fronts and could not be made inside any single chapter. The first names the vendor-level absorption dynamic; the second names the architectural reason the absorbed mass settles on the data layer, the same force that drives Movement Two.

Pattern Claim, the Thoma Bravo Data Security Stack. Proofpoint is the only single vendor with named-outlet presence across all three fronts at combined Gravity or Attention placement: Insider Threat Management at IRM Gravity, Enterprise DLP at DLP Attention, post-Normalyze DSPM at DSPM Attention. The parent was taken private by Thoma Bravo in August 2021 at USD 12.3B, reportedly crossed USD 2B ARR mid-2024, and is publicly signaling 2026 IPO intent ^{17 18 19}. I read this as the cleanest 2026 example of a PE-backed vendor assembling a multi-front data-security stack as an IPO asset rather than as one coherent product. It is real as a portfolio; whether it is real as a platform is the load-bearing question.

Falsifiable test. If the H2 2026 S-1 names ITM, Enterprise DLP, and DSPM as a single Data Security segment with unified ARR, the stack is a platform and integration depth becomes a public-market-disclosure question. If the three are segmented separately under an Information Protection umbrella, it is a portfolio, and renewal-cycle pressure from Microsoft Purview's single-classifier stack and Cyberhaven's single-lineage substrate intensifies through 2027.

Pattern Claim, agentic AI pulls enforcement back to the data source. This is the bridge claim, the one that links the two movements. Three category-specific articulations converge on the same primitive: Microsoft Purview's Risky Agents (preview) template at the insider-risk layer, Operant AI's MCP-protocol Endpoint Protector at the data-loss layer, and Veeam's DataAI Command thesis that enforcement must shift to the data source so known and unknown agents cannot reach data governed at source. When the actor is a machine identity moving at machine speed, the only enforcement point that scales is the data store itself. That is the data-source primitive of Part 1, and it is the same upstream force, the autonomous agent and the identity inversion, that Movement Two reads as agent-identity governance.

Together with the DSPM Absorption Chain shown earlier, these claims give the data war its shape. The chain documents the absorption events that have already executed; the Thoma Bravo Stack documents the vendor-level dynamic behind them; and the data-source claim documents why the absorbed mass settles on the data layer rather than anywhere else. That last claim is the hinge into the second movement.

Full Part 1 chapters at the convergence chapter and the IRM, DLP, and DSPM fronts linked above. Not investment advice. See Disclosures.

Movement Two · The Platform War

Four fronts, one consolidation

The data war resolved on the data layer. The platform war is the wider theater around it: the SOC, the secure edge, the emerging AI-security stack, and the identity control plane beneath every alert. Across all four, the same structural moment recurs. The SOC incumbents kept buying the adjacent control planes outright. The edge bundle pressed down on the standalone vendor below it. The most-funded AI-security independents exited into platforms before any could scale. And in identity, the PAM category originator itself became a platform pillar.

ProductBeacon reads these as four faces of one contest, not four parallel races. The force that makes them one is the same one that pulled enforcement to the data layer in Movement One: agentic AI, here expressed as the non-human and agent-identity problem. The digests below take each front in turn, then the two syntheses that tie the movement, and the whole report, together.

SOC, The Detection & Response War

The Detection & Response front (Front 5) covers the segment where an organization watches its own systems for compromise and acts on what it sees, built from three product categories: Endpoint Detection and Response (EDR), Extended Detection and Response (XDR), and Security Information and Event Management (SIEM). The 2026 story ProductBeacon reads is the collapse of those three into one buying conversation, a unified "next-generation SOC" platform on a single data and workflow plane. The contest is fought on two axes at once: the endpoint battlefield (who owns the agent on the box and the analyst workflow) and the SIEM battlefield above it (who owns the data lake and the economics of ingesting everything).

Top takeaways.

• A clean segmentation line is opening between an AI-native challenger and the scaled incumbent rather than a single feature war.
• A bundled-by-default SOC plane exerts platform pressure on every standalone vendor below it, sharpest at the mid-market.
• The absorption test, whether platform consolidation can actually replace best-of-breed SIEM or whether telemetry economics quietly defeat the consolidation pitch, is the open question of the front.

Pattern Claims (three, each with a public falsifiable test).

• The SentinelOne-CrowdStrike Bifurcation Thesis. On dated disclosures, SentinelOne reported roughly half of total ARR now coming from non-endpoint solutions and launched autonomous-triage tooling, while CrowdStrike crossed USD 5.25B ending ARR with its Falcon Flex consumption model compounding fast; ProductBeacon reads the two as no longer competing for the same buyer with the same pitch, a bifurcation that holds or dissolves on whether SentinelOne's non-endpoint mix keeps rising into named enterprise displacement wins.
• The Microsoft Platform-Pressure Thesis. Microsoft extended the Sentinel-into-Defender-portal consolidation to 2027-03-31; the read is that an E5-bundled SOC plane pressures standalone deal economics most at the mid-market, with the high end more resistible.
• The Splunk-Absorption Thesis. Cisco's USD 28B Splunk acquisition is read as the single most important live experiment in the SIEM market, decided not by logo growth but by whether Cisco can credibly reprice telemetry economics on the network it already owns.

Who is advancing, who is exposed. ProductBeacon frames CrowdStrike as winning the commercial dimension (consumption-model scale), SentinelOne as winning the AI-native repositioning it set out to win, and Microsoft as winning by default-distribution. Cybereason is named as the front's clearest casualty on a chain of dated public events (valuation collapse, repeated layoffs, a terminated merger); the Exabeam-LogRhythm combination is read as a defensive consolidation under genuine standalone-SIEM pressure, not a casualty. Hunters (funding cadence), Dropzone AI (agentic-SOC wildcard), and Vectra AI (post-Netography) sit on the watch list.

Full chapter at productbeacon.agency/research/state-of-cyber-2026/detection-response.html.

Edge, The Secure Service Edge War

The Edge front (Front 6) covers the cloud-delivered stack that decides who and what may reach an organization's applications and inspects the traffic to and from them, after the hardware perimeter dissolved. The front separates three routinely conflated terms: SASE (networking plus security converged), SSE (the security half, bundling Secure Web Gateway, CASB, ZTNA, and Firewall-as-a-Service), and ZTNA (the VPN-replacement building block inside SSE). ProductBeacon reads SSE as an enforcement plane that feeds the SOC, identity, and data-security layers around it rather than owning the case workflow itself.

The DLP boundary. Every major SSE platform bundles a data-loss-prevention module at the egress, which makes the displacement question, whether SSE-bundled DLP compresses the standalone DLP vendors covered in Part 1, a live winning-and-losing question rather than a category line.

Pattern Claims.

• The Bundle-vs-Best-of-Breed DLP Compression Thesis tests whether a documented enterprise consolidation off standalone DLP onto SSE-bundled DLP, cited on total-cost-of-ownership grounds, confirms compression at the middle of the market.
• The Identity-First ZTNA Thesis tracks whether developer-led access tools port up-market on the AI-agent access problem, or get absorbed into the platform incumbents' identity-access acquisitions.
• The Single-Stack SASE Thesis tests whether single-vendor SASE moves from a stated buyer preference into an enterprise architecture, with a Cato Networks S-1 or documented enterprise logo mix as the resolving signal.

Who is advancing, who is exposed. ProductBeacon frames Zscaler as winning the scaled-platform dimension, Netskope as winning the public-benchmark argument after its Nasdaq debut, and Cato Networks as winning the mid-market on operational simplicity. The front has few clean casualties and the digest declines to manufacture one: Cloudflare's 2026 workforce reduction is read, on the company's own filing, as an AI-first reshaping at a growing company rather than a distress signal. Cato (the enterprise-versus-IPO question), the developer-led ZTNA category, and Cloudflare (post-restructuring roadmap focus) sit on the watch list.

Full chapter at productbeacon.agency/research/state-of-cyber-2026/sse.html.

AI Security, The Emerging Theater

The AI Security front (Front 7) is the youngest battleground in the report and the only one where the category is still being assembled in front of the buyer. ProductBeacon reads it as not one market but three, bound by a single demand driver (agentic AI) yet sold to different buyers on different timetables: AI Application Security (runtime defense of models and agents), AI-Native SecOps (AI doing security operations), and AI Governance & Assurance (model-risk management, auditing, and regulatory alignment). Two cross-front boundaries are drawn explicitly: AI App Sec owns the runtime while Part 1's DLP owns the egress, and AI-Native SecOps sits as an analytic layer on top of the SIEM/XDR stack rather than replacing it.

The defining structural finding. As of mid-2026 there is no pure-play AI-security Gravity vendor, none public or past the roughly USD 100M-private mark the report's tier rubric uses. The category is being absorbed into platform incumbents faster than any pure-play can graduate, the clearest evidence being acquisition (the most-funded independents folded into platforms before reaching escape velocity). ProductBeacon reads this as the front's defining condition for 2026, with a public, falsifiable test on whether a pure-play crosses into Gravity within the next four quarters.

Pattern Claims.

• The Pre-Gravity Window Thesis resolves on whichever comes first: a pure-play graduating to Gravity (a public listing or a disclosed nine-figure standalone round) or a fourth named independent absorbed into a platform.
• The Governance-vs-Compliance Bifurcation Thesis tracks whether AI governance, which sells into two distinct buying centers (the security org and the legal/compliance org), resolves toward a bridging vendor.
• The AI-SOC Layering Thesis tests whether AI-native SecOps stays an augment-the-SOC layer or a credible vendor raises to displace the SIEM with a documented rip-and-replace.

Who is advancing, who is exposed. Because the front has no Gravity vendor and most contenders are early-stage privates, ProductBeacon frames winners at the level of positions, not named vendors: the platform incumbents winning the absorption race, the compliance-and-procurement go-to-market winning a defensible governance lane, and the augment-the-SOC posture winning AI-Native SecOps. The digest names no individual casualty and states plainly that manufacturing one in a pre-Gravity market would be the directional verdict the front's discipline forbids; the consolidation events are read as exits, not deaths. The losing position, stated at the category level, is the standalone-AI-security-pure-play-as-a-durable-independent path.

Full chapter at productbeacon.agency/research/state-of-cyber-2026/ai-security.html.

Identity, The Front Beneath Every Alert

The Identity front (Front 8) treats the layer underneath every alert in the report, strip an incident down and what remains is an identity that did something it should not have, as a distinct buying center with its own budget, vendors, and procurement rhythm. The battleground has four disciplines sold to overlapping-but-distinct buyers: Access Management (proves who), Identity Governance & Administration (governs what they should have), Privileged Access Management (guards the dangerous accounts), and Non-Human / Workload Identity (extends all of it to the machines and agents that are not people).

The central structural finding. ProductBeacon presents as observed, dated fact, not forecast, that the identity control plane is converging with the SOC, and the vector of convergence is non-human identity. In roughly thirteen months each of the three platform giants that anchor the detection segment acquired an identity capability and a fourth built one, and the striking feature the digest flags is that every one of those moves is justified, in the acquirer's own words, by the agent-identity problem rather than legacy workforce single sign-on.

Pattern Claims.

• The Identity-Converges-with-the-SOC Thesis is the spine of the front: it validates if the next notable identity acquisitions are again framed around machine, agent, or non-human identity and folded into a SOC or network platform.
• The Non-Human-Identity Wave Thesis tracks NHI resolving by acqui-graduation into platforms rather than by independent scaling.
• The Entra Compression Thesis tests whether Microsoft's bundled Entra economics, now extending to agent identity, compress standalone deal sizes.

How the front is read. ProductBeacon explicitly declines a vendor-versus-vendor scoreboard here, stating that two of the contenders are already inside platforms, the two largest exits are premium acquisitions rather than collapses, and there is no entity-level casualty it is willing to name. The front is read one altitude up, at the level of platform consolidation, with the two acquisitions of the period read as positive-to-neutral consolidation exits rather than casualties. Per the cross-front rule, the SOC and network platform incumbents appear here only as identity moves, not as graded identity contenders.

Full chapter at productbeacon.agency/research/state-of-cyber-2026/identity.html.

Platform Wars, The Part 2 Synthesis

The Part 2 Convergence chapter asks whether the four platform fronts are four parallel category races or one contest with four faces. ProductBeacon reads them as one contest, and the force that makes them one rather than four is agentic AI, expressed as the non-human / agent-identity problem. As with Part 1, the chapter puts three theses on the table verbatim before arguing from the chosen one.

The chosen thesis, in its bounded form: Platform Consolidation. The four fronts are read as a single platform-consolidation contest in which the SOC-anchored platform incumbents absorb each adjacent category from whichever starting position they hold, on an explicitly stated agent-identity rationale. ProductBeacon qualifies the pre-commit in two places: the platform win is located at the mid-market and the fresh-greenfield buyer, with the sophisticated enterprise tier held as genuinely contested, and the bundle-economics mechanism is absorbed as a second, parallel compression force rather than denied.

The two competing reads, kept on the table. The Best-of-Breed Persistence Thesis argues the fronts stay distinct because each is a different technical discipline sold to a different buying center, citing standalone leaders scaling independently and the SailPoint re-IPO and Saviynt KKR round as evidence. The Bundle-Economics (Pricing-Power) Thesis argues the convergence is driven by suite-attach economics and bundling pressure, not architecture, with Entra's bundled pricing compressing standalone deal sizes.

The decisive asymmetry. What ProductBeacon reads as the evidence neither competitor can absorb is the disclosed rationale: four independent acquirers converging on the same stated reason, the agent / non-human identity problem, across four categories in a thirteen-month window. The careful framing matters here. The chapter does not assert the acquirers are correct that these are one market; it asserts the weaker, sturdier claim that four acquirers naming the same problem is a dated public signal the consolidation is vectored rather than opportunistic. The winner is framed at the position level, platform-with-distribution anchored at the SOC, with Palo Alto Networks as its clearest instance, not its sole occupant.

Full chapter at productbeacon.agency/research/state-of-cyber-2026/convergence-p2.html. Not investment advice. See Disclosures.

One Force, Two Wars, The Capstone

The Grand Unification capstone answers the question the report has to face before it can call itself one report: is this one report, or two? Part 1 marched through the data war and resolved on the data layer; Part 2 marched through the platform theater and resolved on agent identity. Two arcs, two convergence chapters, two chosen theses that do not name the same core capability. ProductBeacon puts the null on the table at full strength before betting against it.

The chosen thesis, qualified: Shared Incumbency. The read is that the report is one report because the same handful of platform incumbents, Microsoft, Palo Alto Networks, and CrowdStrike above all, are winning both wars. The capstone qualifies the pre-commit in two deliberate places. First, it cuts the over-reach that the two wars are "one problem" and argues instead one force, two enforcement primitives: the autonomous agent and the roughly 80-to-1 machine-vs-human identity inversion are the same upstream force, expressed as data-source enforcement in Part 1 and agent-identity governance in Part 2. Second, the win is bounded: the shared incumbents win the mid-market and greenfield decisively across both reports, while the sophisticated enterprise tier is genuinely contested in both.

The two rejected reads. The Two-Unrelated-Arcs Thesis holds that the incumbent overlap is a statistical artifact of company size, a big company appearing in two adjacent markets no more proving they are one war than Amazon in retail and cloud proving those are one market. The Pricing-Power Thesis agrees the same incumbents win both but attributes it to a commercial margin-and-distribution story rather than an architectural one.

One force, three primitives, with the asymmetry named. ProductBeacon traces the one force, the autonomous agent plus the identity inversion, expressing as three governance primitives: data-source enforcement (Part 1's), the AI-runtime primitive (Front 7's), and agent identity (Part 2's), with only a platform spanning all three able to govern an agent end to end. The digest carries the capstone's own honest caveat: the agent-force is the chosen headline thesis in Part 2 but only a secondary cross-front Pattern Claim in Part 1 (whose headline was the data layer). The capstone therefore elevates a Part 1 pattern claim to capstone level alongside Part 2's chosen thesis, and states plainly it will not claim "Part 1 was about agent identity," because it was not. The report is read as one report because the force is one force, not because the two wars are one problem.

Full chapter at productbeacon.agency/research/state-of-cyber-2026/grand-unification.html. Not investment advice. See Disclosures.

The Close

The Buyer's Real Decision, Across Both Wars

Both movements land on the same buyer, and the decision spans them. In the data war, the choice is consolidate to a platform, buy best-of-breed across the fronts, or hybridize on a DSPM anchor. In the platform war, the same buyer faces the same fork: ride the SOC-anchored consolidation, or hold a best-of-breed estate where depth still beats breadth.

The report's read is that these are not two decisions. They are one bet on how far the platform incumbents reach. If you believe one force is reorganizing both wars, you consolidate toward the incumbent that can govern an agent end to end, data at its source and identity at the gate. If you believe the fronts stay distinct technical disciplines sold to distinct buying centers, you keep specialists and accept the operator burden. The boundary, in both wars, is the same: the mid-market and greenfield tilt to the platform; the sophisticated enterprise stays genuinely contested, because the hard problems still reward depth.

The renewal cycle reveals which assumption the buyer was operating under. Sometimes too late. The point of reading both movements as one report is to make that assumption explicit before the cycle forces it.

What This Means For Three Audiences

The synthesis lands differently for each reader. Here is where to pull on it.

For PE and hedge-fund analysts. The sourceable signals concentrate in a handful of event types over the next four quarters, and they span both wars.

• In the data war: the Proofpoint S-1 segment structure (platform if ITM, DLP, and DSPM report one Data Security segment with unified ARR; portfolio if segmented under an Information Protection umbrella), the Cyera Series G cadence, and the next mid-tier DSPM-native acquisition.
• In the platform war: whether a single-stack or SOC-platform play converts to a documented enterprise logo mix, whether standalone leaders cite bundle pressure as a named earnings headwind, and whether the next identity acquisition is again justified on the agent-identity rationale.

The capstone test ties them: a fourth platform giant making both a data-layer and an identity-layer acquisition, both justified on the agent problem, confirms the shared force.

For CISO operators and security buyers. Bring three things to the steering meeting.

• A vendor-tier audit: every renewal should map to a named tier, and any vendor outside the graded set should be challenged on why it survived the published-material filter.
• The Verifiable Proxy Rule applied to vendor claims: if a vendor's hero copy claims unified coverage across fronts, ask for the shared classifier substrate, the unified control plane, and the joint customer reference; the convergence reads flag that several multi-front pitches do not yet name these at flagship-mature depth.
• An explicit position on the one bet above: are you consolidating toward an incumbent that governs the agent end to end, or holding best-of-breed where depth wins.

For fractional founders, CPOs, and product leaders. Three frameworks port to other markets.

• The published-material discipline: select vendors by a defensible filter rather than by analyst-firm convenience, and it survives any category transition.
• The boundary analysis: any market entering a convergence moment produces the same boundary-problem signature, and naming the archetypes is the first step to defensible positioning.
• The Pattern Claim shape: observation, the author's read, a conditional prediction grounded on a publicly observable proxy, and sources, a portable structure for any market being repositioned by a structural force.

Disclosures and Backmatter

Author conflict disclosure. Yohay Etsion is Head of Product (Fractional) at AXIA, which competes in the Data Loss Prevention (DLP) segment covered in this report. The methodology applies equally to AXIA-adjacent vendors and to non-adjacent vendors. There is no parity exception.

Not investment advice. Nothing in this digest or in the underlying chapters constitutes investment advice, an offer to buy or sell any security, or a recommendation for any specific investment action. Vendor placements, Winner / Watch / Loser characterizations, and Pattern Claim conditional predictions are research opinions grounded on publicly verifiable proxies; they are not financial advice and should not be relied upon as such. Readers should consult their own advisors before making investment decisions about any named vendor.

Citation count. State of Cyber 2026 ships with 596 unique citations across eight fronts and two parts, 68 of which cross-reference between chapters. The full citation list lives at productbeacon.agency/research/state-of-cyber-2026/citations.md, regenerated at every chapter ship.

Methodology. The full sourcing rules, Verifiable Proxy Rule, disclosure framework, citation discipline, and Quarterly Refresh cadence live at productbeacon.agency/research/methodology.html. Methodology version bumps are independent of chapter version bumps.

Contact and corrections. Within five business days of any chapter's publication date, named vendors may request a factual correction by writing to [email protected]. We will correct factual inaccuracies. We will not negotiate positioning, change Winner / Watch / Loser characterizations, or remove Pattern Claims under vendor pressure. The correction window is for facts, not framing.

About the author. Yohay Etsion is Head of Product (Fractional) at AXIA, which competes in the Data Loss Prevention segment. Seventeen years building product organizations at NICE and Cognyte, managing $200M+ portfolios and 30+ person teams. Creator of Product Org OS, an open-source methodology operationalizing Vision to Value. He is the author of Leading the Charge (2023) and Vision to Value (coming 2026).

About ProductBeacon. ProductBeacon is the fractional product leadership practice for ambitious startups and scaleups that need senior product judgment without full-time overhead. Outreach is signal-triggered, never spam or spray-and-pray: we approach when we see the specific pain we know how to fix. We publish open-source thinking on how product organizations actually work, including Product Org OS and Vision to Value, coming 2026. Learn more at productbeacon.agency/services.

State of Cyber 2026 Report Digest, one report in two movements · v2.0 · 2026-06-21 · ProductBeacon Research