1. The machine-identity claim delivered its predicted deals — then kept going down-market. The report said the next notable identity acquisition would again be framed around non-human identity (NHI — the machine, service, and AI-agent accounts that now outnumber human users in most enterprises). It took two days, and then it happened three times at three tiers: Cisco (Attention tier) announced intent to acquire WideField Security on Jun 18 to feed identity and session telemetry into Splunk's AI-agent-driven security operations center (SOC); SailPoint (Attention) closed its acquisition of Tel Aviv non-human-identity startup Entro Security on Jun 29 (announced Jun 15; ~$200M reported) for its Agentic Fabric; and Barracuda acquired Evo Security, an identity vendor for managed service providers (MSPs), on Jul 7 under "AI-ready identity security" positioning — the same rationale now running at the mid-market tier. The people followed the capital: CyberArk founder Udi Mokady took the chairmanship of CHEQ (Jul 7) as it pivots to "trust infrastructure for the agentic web." Confirms the machine-identity convergence claim — the strongest of the whole window (Inference).

1. The AI-agent-run SOC went from slideware to a shipping race — on all three flanks. SentinelOne (Gravity tier) opened Purple AI "Agentic Investigations" — autonomous threat investigation with no analyst prompting — to all customers the day the report published (Jun 17), then integrated with Amazon's Bedrock AgentCore agent platform (Jul 2). Fortinet (market tier) launched FortiSOC — six security-operations functions in one AI-agent-driven console (~Jun 15-19). Cisco put a working AI-agent SOC on the floor at Cisco Live Americas (Jul 7), making the WideField rationale visible go-to-market within three weeks of the announcement. Services entered too: CyberProof (UST) launched an AI-agent managed-detection service (MXDR — managed extended detection and response) claiming ~two-thirds of investigations automated (Jul 7, vendor states), and challenger Dropzone AI locked exclusive Europe/Middle-East/Africa distribution with QBS Software (Jul 2). Securonix (market) installed a new CEO (Jun 29) explicitly to lead the AI-security-operations shift, and Databricks agreed to buy Panther Labs, an AI-native security-analytics (SIEM) vendor, one day before the window (Jun 16). Incumbents, services firms, and AI-natives are now shipping the same story simultaneously. Confirms the challengers-vs-incumbents SOC claim as live, intensifying tension (Inference).

1. Money kept forming a "securing the AI agent" layer — and the buyer set widened past the security platforms. Funding: Straiker ($64M Series A, late June), NeuralTrust ($20M seed for a gateway that polices AI-agent traffic over the Model Context Protocol (MCP) — the emerging standard for how AI agents call tools and data, Jun 17), Nebulock ($25M Series A with an insider-risk module that treats AI agents as insiders, Jun 24), plus just pre-window Arcade ($60M, AI-agent authorization, Jun 16) and adjacent Dream ($260M at $3.0B, Jun 18). Acquisitions: in one pre-holiday week, A10 Networks acquired TrojAI and F5 acquired SurePath AI (both Jul 2) — two mid-cap networking incumbents buying AI-security capability. The layer is being funded and bought faster than the platforms can absorb it.

1. Palo Alto Networks compounded on four axes in a single week. In the Jul 6-7 burst, Palo Alto Networks (Attention; its CyberArk unit Gravity) announced collaborations with IBM and Red Hat (its virtual-patching technology paired with Red Hat's platform) and with Tenzai (AI-generated adversarial intelligence feeding network controls), hired Sherrod DeGrippo — Microsoft's former threat-intelligence strategy lead — to head Unit 42 Threat Intelligence, and ran the first CyberArk IMPACT conference (Austin) under its ownership, CEO Nikesh Arora delivering the launch keynote from CyberArk's own mainstage. Shares hit a record high Jul 6-7 on analyst price-target raises; the company also listed on the Tel Aviv Stock Exchange (Jul 2-3, entering the TA-35/TA-125 indices Aug 6) — the capital-markets echo of the $25B CyberArk deal. The on-stage IMPACT offering launch remains conference-sourced with specifics unconfirmed at close of window; carried forward rather than guessed.

1. Bundle-driven displacement got a name on it — and free became a price point. Yale University publicly announced its migration from Forcepoint (Gravity) data loss prevention to Microsoft Purview DLP (migration from Sept 2; Microsoft ships a purpose-built migration assistant targeting Symantec and Forcepoint estates). iboss (market) launched a free AI Security Platform inside its security-service-edge stack (Jul 2). Add Fortinet's six-functions-one-console packaging and the Netskope/Cloudflare pushes down-market through managed service providers (both Jun 17-18), and the squeeze the report modeled is visible at both ends: a named enterprise displacement running through the Microsoft 365 E5 bundle, and AI security at $0 in the mid-market. Confirms the bundle-pricing-squeeze claim, still weakly — anecdotes, not yet a trend line (Inference).

1. "AI agents as insiders" became the insider-risk front's new pitch — and then the whole industry's marketing copy. Exabeam (market) doubled its AI-focused detections to ~90 and added monitoring of Anthropic Claude usage under a "secure the agentic enterprise" banner (Jul 1); Nebulock's new insider-risk module unifies a person's — or an AI agent's — accounts and identities into one risk view (Jun 24); Microsoft unified the Purview Insider Risk Management alert experience (Jul 1). Then the LinkedIn pass (Jul 8) found the meta-signal: every tracked vendor's page, on every front, is now messaging AI-agents-as-risk — the report's central convergence thesis is the industry's own copy.

1. New gravitational centers formed outside the report's incumbent set. Accenture agreed to take a majority stake in operational-technology (OT) security leader Dragos alongside simultaneous runZero and NetRise acquisitions — a combined reported $4.18B (Jun 18, closing Aug-Sep): services capital consolidating at incumbent-deal scale. And on a single day (Jun 22), Proofpoint (Gravity) and Cato Networks (Attention) both joined the OpenAI "Daybreak" Cyber Partner Program — frontier-AI vendors becoming a distribution and legitimacy channel for security go-to-market. Neither axis was in the report's model; both widen who counts as a consolidator.

Exabeam [market] expanded Behavior Intelligence to "secure the agentic enterprise" (2026-07-01): AI-focused detections doubled to ~90, monitoring support for Anthropic Claude, new Observra observability, coverage of the OWASP agentic-threat list — the user-behavior-analytics franchise re-aimed at AI agents as first-class insiders (Business Wire; SiliconANGLE).

Nebulock [new entrant] raised a $25M Series A led by FirstMark (2026-06-24) and shipped an insider-risk module that consolidates a human's or an AI agent's accounts, identities, and hosts into a single risk view (Nebulock announcement; MGMT Boston). Same reframing as Exabeam, one week earlier, from a startup — a two-source pattern.

Microsoft [Gravity] announced a unified alert experience for Purview Insider Risk Management (2026-07-01) — one alert queue, richer user profiles, notes carried across alerts and cases (Redmondmag).

Everfox [Attention] rebuilt half its C-suite in seven days: Tracey Mustacchio as chief marketing officer (2026-07-01; ex-Secureworks, ex-Nitel) followed by Toby O'Brien as chief financial officer (2026-07-06) (HSToday; Business Wire). A CFO+CMO pair landing in a week at a private-equity-held federal-assurance vendor reads like a company being prepared for a growth push or a transaction — worth watching, not concluding.

Varonis [Gravity] earned GovRAMP authorization for its Data Security Platform (2026-06-30), opening US state and local government sales (GlobeNewswire).

Narrative layer (LinkedIn, Jul 8 pass): Cyberhaven and DTEX both spent early July explicitly recasting AI agents as insiders — agent-exfiltration scenarios; DTEX leaning on the Google AI-theft case as the insider-risk exemplar.

Quiet on moves across the full window: Cyberhaven, DTEX Systems, Teramind, Mimecast (Incydr/Code42), Above Security. The standalone insider-risk tier made no absorption news either way.

Forcepoint → Microsoft displacement, named in public. Yale University announced it is transitioning from Forcepoint [Gravity] DLP to Microsoft Purview DLP, migration beginning September 2 (Yale Cybersecurity notice; posting date unstamped — treated as in-window). Microsoft's Purview migration assistant explicitly targets Symantec and Forcepoint estates. One named loss, but through the exact bundle mechanism the report models.

Zscaler [Gravity] shipped an AI Protect expansion (2026-06-25) — 16 enhancements across AI asset management, secure access to AI, and securing AI apps, packaged alongside its inline data-protection stack (Zscaler blog).

Netskope [Gravity] launched Partner Orchestrator plus a revamped Catalyst program for managed service providers (2026-06-17): production secure-access tenants (carrying its DLP) provisioned in under 15 minutes — a deliberate down-market/channel push (CRN exclusive), which drew follow-on Asia-Pacific-traction coverage into July.

Broadcom (Symantec DLP) [Gravity]: no security-portfolio moves — its three SEC 8-K filings resolved to debt tender offers and (Jul 6) expanded Apple custom-chip agreements through 2031. Recorded so the filings don't resurface as acquisition rumors (Corporate ledger).

Quiet across the window: Fortra (Digital Guardian), Nightfall AI, Strac, Operant AI. No standalone-DLP funding or M&A anywhere in three weeks — the pure-play lane stayed silent, itself consistent with the report's direction.

The DSPM front produced no in-window deal or funding — the big move landed a week before publication: Cyera [Attention] raised a $600M Series G at a $12.0B valuation (2026-06-10, 4x in 18 months; Evolution Equity lead), funding a platform spanning posture management + data loss prevention + AI-agent security (Business Wire; SecurityWeek). Pre-window, but the strongest funding-side evidence yet that capital reads data security as DSPM-anchored-with-DLP-attached. Late-June commentary questioning the $12B mark is sentiment, not a move.

The in-window story was a validation race: Varonis [Gravity] named a 2026 Gartner Peer Insights Customers' Choice for DSPM for the third straight year (2026-07-02), and Concentric AI [wildcard] claimed the identical badge five days later (2026-07-07). Two tracked vendors marketing the same analyst-proxy credential in one week is a small but telling sign of how crowded DSPM validation has become.

LinkedIn color: Cyera's "Agentville" campaign — an AI-agent governance-layer narrative — plus a Paris office opening in its June recap.

Wiz (Google) [market]: no new beat (the $32B acquisition closed 2026-03-11; integration phase — though see Alphabet's capital raising in the Corporate ledger). Quiet: BigID, Sentra, Symmetry Systems, Bedrock Data, OneTrust, Securiti; IBM (Guardium) filings resolved to treasury housekeeping.

Cisco → WideField Security [Attention; M&A — announced 2026-06-18, threaded]: Cisco will fold the identity-lifecycle/telemetry startup into Splunk to power its AI-agent security operations center; terms undisclosed (Cisco Newsroom; SecurityWeek). Third identity-shaped Cisco move after Astrix and Galileo. New beat: three weeks later Cisco showcased the working AI-agent SOC at Cisco Live Americas (2026-07-07) — Cisco Security + Splunk workflows, evidence-backed verdicts, human-validated. Acquisition rationale becoming visible go-to-market inside a month.

Accenture → Dragos (majority) + runZero + NetRise [market context; announced 2026-06-18, close Aug-Sep]: combined outlay reported at $4.18B (CyberScoop; Infosecurity Magazine; SecurityWeek rounds to $4.1B). A systems integrator building an operational-technology-security platform at incumbent-deal scale.

SentinelOne [Gravity], threaded: Purple AI "Agentic Investigations" opened to all customers (2026-06-17) — autonomous investigation without analyst prompting (SiliconANGLE); then an Amazon Bedrock AgentCore integration to secure AI-agent workflows on AWS (2026-07-02).

Fortinet [market] launched FortiSOC (week of 2026-06-15): security analytics (SIEM), automated response playbooks (SOAR), threat intelligence, and identity detection unified in one AI-agent-driven cloud console (Fortinet press release; Help Net Security).

CyberProof (UST) [market context] launched an AI-agent managed-detection service (MXDR) claiming ~two-thirds of investigations automated (2026-07-07, vendor states; SiliconANGLE) — a services entrant productizing the AI-agent-SOC claim set, pricing pressure on both flanks.

Dropzone AI [wildcard] signed exclusive Europe/Middle-East/Africa distribution with QBS Software (2026-07-02) — challenger-side channel build-out (Computer Weekly; CRN).

Securonix [market] appointed Toby Weiss as CEO (2026-06-29) to lead its move to AI-powered security operations (Securonix press release).

Palo Alto Networks [Attention]: Wipro expanded its partnership to deliver AI-driven managed detection and response (MDR) built on Cortex XSIAM (2026-06-23; Moneycontrol). CrowdStrike [Gravity]: Atos joined Project QuiltWorks (2026-06-17; GlobeNewswire).

Elastic [market; distress] cut ~7% of its workforce (~300 roles) in June, CEO citing AI-enabled leaner operations (Elastic blog; TechCrunch tracker 06-22; exact date unconfirmed). Counterpoint in the same window: named a Leader in IDC's 2026 worldwide security-analytics (SIEM) vendor assessment (~06-18).

Demand and market color: The US Defense Information Systems Agency and Army published a sources-sought notice for a consolidated $850M endpoint security & event management requirement (~2026-06-18; GovConWire). Cybersecurity equities rallied hard Jul 6-7 — CrowdStrike +5%, Palo Alto Networks and Okta +4%, Cloudflare re-rated to a $300 target — sentiment, not strategy, but the platform names re-priced upward together.

Pre-window context: Databricks agreed to acquire Panther Labs (AI-native security analytics, 2026-06-16) — a data-platform giant entering the SIEM market directly. CrowdStrike shipped "Continuous Identity for AI Agents" and positioned Falcon as "AI's control plane" via Open Gateway (06-15/16). BlueVoyant launched an AI-agent security-operations platform (06-09).

Quiet: Vectra AI, Hunters, Anvilogic, Tines, Prophet Security, Rapid7, Google SecOps; Microsoft Sentinel/Defender routine updates only.

Cloudflare [Attention] launched the Cloudflare One Design Partner Designation (2026-06-17/18) — a channel initiative to accelerate secure-access and secure-AI adoption through named partners (Cloudflare press release; Reuters/Zawya; CRN).

Cato Networks [Attention] joined the OpenAI Daybreak Cyber Partner Program (2026-06-22), integrating GPT-5.5/Codex into its secure-access platform (PRNewswire). (The "$359M at $4.8B, IPO delayed" item recirculating on social is June 2025 news — excluded.)

iboss [market] launched a free AI Security Platform (2026-07-02; PR Newswire) — a security-service-edge vendor giving AI visibility and control away at no cost is bundle-economics behavior, logged as such.

CyberFOX → Timus Networks [market edge; M&A — GlobeNewswire stamps 2026-06-29]: the MSP-security vendor acquires a cloud-native secure-access (SASE, with zero-trust network access) provider; terms undisclosed (GlobeNewswire; citybiz; Security Boulevard). Secure-access consolidation reaching the MSP tier.

Netskope's managed-service-provider push (DLP front) is equally a secure-access story: sub-15-minute tenant provisioning aimed at the mid-market.

Demand side: The US cyber agency CISA published guidance for federal agencies adopting secure access service edge for zero trust (Trusted Internet Connections 3.0 alignment, 2026-06-24/25; CISA; Infosecurity Magazine). Pre-window sizing: analyst firm Dell'Oro put first-quarter-2026 SASE revenue at >$3B, +21% year-over-year, with AI-governance use cases called out as a driver (06-16).

Quiet on business moves: Zscaler (secure-access side; its AI-agent security suite launched at Zenith Live 06-09, pre-window), Versa, Tailscale, Twingate, Menlo Security, Akamai, Forcepoint (SSE side).

Straiker [new entrant] raised a $64M Series A in late June (day unpinned; CRN midyear roundup 07-02), Marathon Management Partners lead with Citi Ventures, Illuminate Financial, and Workday Ventures — AI-agent discovery, pre-deployment adversarial testing, runtime protection. The window's largest new AI-security round.

NeuralTrust [new entrant] raised a $20M Seed (2026-06-17; Alstin Capital lead) for an agent-security platform whose TrustGate product polices AI-agent traffic over the Model Context Protocol (MCP) — the emerging standard for how AI agents call tools and data (FinSMEs). Money arriving at the MCP control point, though as a security gateway rather than anything labeled data-loss-prevention.

A10 Networks → TrojAI and F5 → SurePath AI [M&A — both 2026-07-02]: two mid-cap networking incumbents buying AI-security capability (securing/testing/governing AI applications with sovereign-AI framing; AI governance respectively) in the same week (The Fast Mode; CyberWire Business Briefing). The buyer set for this front keeps widening beyond the security platforms.

Palo Alto Networks × Tenzai (2026-07-07): AI-generated adversarial intelligence feeding network-security controls — "fighting AI with AI"; also Tenzai's expansion into network security (Yahoo Finance/newswire).

BeyondTrust [Attention] shipped a beta AI Agent Security product to stop autonomous agents taking unauthorized endpoint actions (2026-07-02; Technology Decisions).

Dream [adjacent] raised $260M at a $3.0B valuation (2026-06-18; Reuters) — AI-for-cyber-defense rather than securing-AI; logged for awareness.

HiddenLayer [Attention] announced a collaboration with Cohere (~2026-06-30; day unconfirmed) to secure Cohere's sovereign-AI agent deployments (PR Newswire). Proofpoint [Gravity] joined OpenAI Daybreak (2026-06-22; GlobeNewswire) — same day as Cato. Reco [new entrant] launched Reco Agent Security in late June (CRN 07-02), including governance of Anthropic Claude usage.

Pre-window context: Arcade $60M for AI-agent authorization (06-16). Palo Alto Networks completed its Portkey acquisition (05-29) and spent June positioning that AI gateway as the control plane inside Prisma AIRS. Akamai unveiled an agent-security framework (06-15).

Quiet: Check Point (Lakera), Cisco (Robust Intelligence), Credo AI, Holistic AI, Noma Security, Zenity (research output only), SentinelOne (Prompt Security).

SailPoint → Entro Security [Attention; M&A — announced 2026-06-15, closed 2026-06-29, ~$200M reported]: the Tel Aviv non-human-identity and secrets-security startup folded into SailPoint's Agentic Fabric "to secure the future of AI-driven enterprises" (GlobeNewswire intent; SailPoint investor-relations completion; price per Calcalist, reported not company-confirmed). The report's predicted "next identity deal on a machine-identity rationale," announced two days before publication and closed twelve days after. The early-July press wave around the deal was repeat coverage of the same beat — nothing new.

Barracuda → Evo Security [M&A — 2026-07-07]: identity resilience for managed service providers, folded into BarracudaONE with "AI-ready identity security" positioning (CRN; Managed Services Journal). Neither party tracked; the datapoint is that identity consolidation on an AI rationale now runs at the MSP/mid-market tier too.

Udi Mokady → chairman of CHEQ (2026-07-07): the CyberArk founder's first post-exit operating seat, explicitly framed around agentic-web trust infrastructure (Calcalist; Boston Business Journal). Talent and capital from the $25B exit recycling straight into agentic security.

Okta [Gravity] expanded Cross App Access (2026-06-23): 25+ independent software vendors adopted the protocol routing AI-agent-to-app connections through identity-based policy (Okta Newsroom; SiliconANGLE) — the flagship agent-identity go-to-market move of the window; UBS raised its Okta target to $150 on "AI momentum" mid-June. Corporate color: removed from several Russell growth indices in the late-June reconstitution — a factor-classification event, not an operating one.

Saviynt [Attention] expanded Identity Security for AI with intent-aware runtime authorization for AI agents (Agent Access Gateway, ~06-14/17, around the Identiverse conference; Saviynt press release; iTWire).

Palo Alto Networks (CyberArk unit) [Gravity], threaded: Tel Aviv Stock Exchange listing announced 2026-07-02/03 with fast-track entry into the TA-35/TA-125 indices Aug 6 (Globes); then CyberArk IMPACT 26 ran in Austin the week of Jul 6 — first under Palo Alto Networks ownership, Nikesh Arora personally delivering the launch keynote from CyberArk's mainstage. A new offering was launched on-stage; specifics were conference-sourced and remain unconfirmed by press wire at window close — carried to the next run rather than guessed.

BeyondTrust [Attention; trust event] confirmed business data stolen from its Salesforce instance in the Klue/Salesforce supply-chain incident (~06-26/27; SecurityWeek), one of roughly a dozen vendors affected. Reported strictly as a vendor-trust event; no commercial impact evidenced. (Its AI Agent Security beta, Jul 2, sits on the AI Security front.)

Pre-window context (a dense identity fortnight): 1Password → Apono (06-15; medium confidence); Ping Identity Runtime Identity across AWS Bedrock AgentCore, Google Agent Gateway, and Cloudflare Model-Context-Protocol traffic (06-16); Aembit to Microsoft Copilot Studio (06-16); Silverfort agent identity control for Copilot Studio (~06-08); Oasis Security × Zscaler for non-human identities (~06-10); Semperis × Hack The Box (06-10); Opal Security $23M for AI-native access governance (~06-12). Every one machine/AI-agent-identity-shaped. Workforce single-sign-on news across the entire three weeks: none — the break condition stayed silent.

Quiet in-window: Delinea, Astrix (Cisco unit), Aembit, Silverfort, Semperis, Oasis Security (all active just before publication, silent after).

Eight SEC 8-K filings (current-report disclosures) from tracked/market companies were flagged as possible acquisitions across the two runs; each was opened and resolved. None was an acquisition:

• IBM (06-23): one-year maturity extensions of its $2.5B and $7.5B credit facilities. Treasury housekeeping.
• Broadcom (06-18, 06-11): debt tender offer pricing/launch. (07-06): expanded Apple custom-chip agreements through 2031 — material for Broadcom, nothing to do with the Symantec security portfolio.
• Alphabet (06-04/05; pre-window but material context for Wiz/Google): a $40B at-the-market equity program, a ~51M-share offering, a $10B private placement to Berkshire Hathaway, and a mandatory convertible preferred offering. The Wiz owner raising equity at unprecedented scale — the war-chest backdrop to everything Google does in security.
• CrowdStrike (06-03 announcement; in-window execution): first-quarter results plus a 4-for-1 stock split — split-adjusted trading began 2026-07-02.

First structured pass over tracked companies' own pages, run 2026-07-08 (18 pages: all Gravity tier, top Attention tier; company posts only, ~2-week lookback). Honest coverage note: this lens opened only in the final days of the window — LinkedIn signal effectively begins late June. SentinelOne's page yielded no extractable posts (page-format variance); Microsoft's page surfaced only regional-award content — its Purview news travels through blogs, not the main page.

The one-sentence finding: every tracked vendor's page, on every front, is now messaging AI-agents-as-risk — the report's central convergence thesis is the industry's own marketing copy.

Specific catches:

• Palo Alto Networks: the DeGrippo welcome (the exec catch of the week originated here) + Prisma Browser and Sovereign Cortex pushes.
• CyberArk: three days of IMPACT 26 coverage; Arora keynote confirmation.
• Netskope: previewed June "AI Risk Quadrant" findings — claiming 89% of production AI agents carry private-data access + untrusted-content exposure + outbound-action capability simultaneously (vendor states; the "lethal trifecta").
• Okta: full agentic drumbeat — "AI kill switch" webinar with ADT; "your newest employees aren't human" machine-identity framing.
• Cyera: "Agentville" campaign + Paris office opening.
• Cyberhaven / DTEX (insider risk): agent-as-insider scenario content; DTEX leaning on the Google AI-theft case.
• Proofpoint: Protect 2026 teaser framed on AI agents in workflows growing risk.

The payoff table: the report's predictions against everything the market did between Jun 17 and Jul 8. Claim names below are plain-English renderings of the report's original claim identifiers (shown in parentheses, once, for traceability). Every verdict is an Inference.

Net read: four confirms (one strong, one cumulative, two qualified), three not-affected, zero breaks. Eighteen trading days in, no claim has taken counter-evidence.

Union of both runs; never auto-added to the registry; each awaits the market-tier rubric.

• Straiker — AI-agent security; $64M Series A (late June). The window's biggest new AI-security name. (AI security)
• NeuralTrust — agent/Model-Context-Protocol gateway security; $20M seed (06-17). Direct relevance to the MCP data-protection question. (AI security / data protection)
• Nebulock — hunt-first security operations with an AI-agent insider-risk module; $25M Series A (06-24). (insider risk / detection & response)
• Tenzai — AI adversarial-intelligence; now co-selling with Palo Alto Networks into network security. (AI security)
• CHEQ — agentic-web trust infrastructure; the Mokady chairmanship signals capital + talent inflow. (identity / AI security)
• CyberProof (UST) — services-side AI-agent managed-detection entrant. (detection & response)
• Arcade — AI-agent authorization/governance; $60M (06-16, pre-window). (AI security / identity)
• Reco — agent security launch (late June; $30M Series B in Feb). (AI security)
• Dream — AI-cyber platform, $260M at $3.0B (06-18). Adjacent (AI-for-defense), logged for awareness. (adjacent)
• Opal Security — AI-native access governance, $23M (~06-12, pre-window). (identity)
• Resolved into acquirers (no independent tracking needed): Entro Security → SailPoint; WideField Security → Cisco; Evo Security → Barracuda; TrojAI → A10 Networks; SurePath AI → F5; Panther Labs → Databricks; Apono → 1Password; Timus Networks → CyberFOX; Dragos / runZero / NetRise → Accenture.

• SailPoint→Entro — GlobeNewswire (intent, 2026-06-15); SailPoint investor relations (completion, 2026-06-29); Calcalist (~$200M reported).
• Cisco→WideField — Cisco Newsroom (2026-06-18); SecurityWeek; Futurum (2026-06-25). Cisco Live AI-agent SOC — Cisco Security blog (2026-07-07).
• Barracuda→Evo Security — CRN (2026-07-07); Managed Services Journal (2026-07-07).
• Udi Mokady → CHEQ — Calcalist / Boston Business Journal / Newspress (2026-07-07).
• Accenture/Dragos/runZero/NetRise — Accenture Newsroom (2026-06-18); CyberScoop; SecurityWeek; Infosecurity Magazine M&A roundup (2026-07-03).
• A10 Networks→TrojAI — A10 Networks press release; The Fast Mode (2026-07-02); F5→SurePath AI — F5 press release; CyberWire Business Briefing (2026-07-02).
• Palo Alto Networks–IBM/Red Hat (Project Lightwell) — Palo Alto Networks press release; IBM Newsroom (stamps 2026-06-24; surfaced in the Jul 6-7 coverage wave). Palo Alto Networks–Tenzai — Yahoo Finance (2026-07-07). Sherrod DeGrippo to Unit 42 — Martech360 + company LinkedIn page (week of 2026-07-06). Tel Aviv listing / TA-35 — Globes (2026-07-02/03). Wipro × Cortex XSIAM — Wipro press release; Moneycontrol (2026-06-23).
• SentinelOne Purple AI Agentic Investigations — SentinelOne investor relations; SiliconANGLE (2026-06-17); SentinelOne × Amazon Bedrock AgentCore — Yahoo Finance (2026-07-02).
• Fortinet FortiSOC — Fortinet press release; Help Net Security roundup (2026-06-19).
• CyberProof AI-agent managed detection — SiliconANGLE (2026-07-07). Dropzone AI × QBS — QBS Software (release dated 2026-07-01); Computer Weekly / CRN / ITPro (2026-07-02).
• Securonix CEO — Securonix press release (2026-06-29).
• Exabeam Behavior Intelligence — Business Wire (2026-07-01); Yahoo Finance mirror; SiliconANGLE. Nebulock $25M — Nebulock announcement (2026-06-24); Axios Pro (2026-06-25); MGMT Boston.
• Microsoft Purview Insider Risk Management unified alerts — Microsoft Tech Community; Redmondmag (2026-07-01).
• Varonis GovRAMP — GlobeNewswire (2026-06-30); GovRAMP participant register. Varonis Gartner Peer Insights DSPM — GlobeNewswire/Yahoo (2026-07-02); Concentric AI Gartner Peer Insights DSPM — Concentric AI / Business Wire (2026-07-07).
• Everfox CMO — Everfox press release; HSToday (2026-07-01); Everfox CFO — Everfox press release; Business Wire (2026-07-06).
• Yale Forcepoint→Purview — Yale Cybersecurity notice (posting date unstamped; migration from Sept 2); Microsoft Purview migration-assistant documentation.
• Zscaler AI Protect — Zscaler blog (2026-06-25). Netskope Partner Orchestrator/Catalyst — CRN exclusive (2026-06-17); Netskope press release.
• Cloudflare One Design Partner Designation — Cloudflare press release (2026-06-17); Reuters/Zawya; CRN.
• Cato × OpenAI Daybreak — Cato Networks news; PRNewswire (2026-06-22); Proofpoint × OpenAI Daybreak — Proofpoint blog; GlobeNewswire (2026-06-22).
• CrowdStrike × Atos QuiltWorks — Atos press release; GlobeNewswire (2026-06-17).
• iboss free AI Security Platform — Help Net Security; PR Newswire (2026-07-02). BeyondTrust AI Agent Security beta — SecurityBrief; Technology Decisions (2026-07-02).
• Elastic layoffs — Elastic blog (CEO announcement); San Francisco Business Times (2026-06-24); TechCrunch AI-layoffs tracker (2026-06-22). IDC SIEM MarketScape — Business Wire via Morningstar (2026-06-17).
• DISA/Army $850M — GovConWire (~2026-06-18). CISA secure-access guidance — CISA; Industrial Cyber (2026-06-24/25).
• CyberFOX→Timus — GlobeNewswire (2026-06-29); citybiz; Security Boulevard.
• Straiker $64M — PR Newswire; CRN midyear AI-security roundup (2026-07-02). NeuralTrust $20M — The SaaS News; FinSMEs (2026-06-17). Dream $260M — Reuters; Bloomberg (2026-06-18). Arcade $60M — WSJ CIO Journal; PYMNTS (2026-06-16). Reco launch — Yahoo Finance; CRN (2026-07-02).
• HiddenLayer × Cohere — PR Newswire (~2026-06-30).
• Okta Cross App Access — Okta Newsroom; SiliconANGLE (2026-06-23); UBS target — Investing.com; Russell reconstitution — market data (late June).
• Saviynt agent runtime authorization — Saviynt press release; iTWire (~mid-June 2026).
• BeyondTrust Klue/Salesforce — SecurityWeek (~2026-06-26/27).
• Cyera $600M @ $12B — Cyera announcement; Business Wire (2026-06-10); SecurityWeek.
• Databricks→Panther — Databricks press release (2026-06-16). 1Password→Apono — 1Password press page (2026-06-15).
• Ping Identity Runtime Identity — PR Newswire (2026-06-16). Dell'Oro SASE 1Q26 — delloro.com (2026-06-16).
• Jul 6–7 equity rally, Palo Alto Networks record high, Cloudflare target raise — Invezz/TradingView; 24/7 Wall St.
• SEC 8-K resolutions — SEC EDGAR: IBM (0000051143-26-000061), Broadcom (0001193125-26-275077, -266777; 0001730168-26-000051; Jul-6 Apple chip 8-K), Alphabet (0001193125-26-259830, -257724 + investor-relations release), CrowdStrike (0001535527-26-000022).
• LinkedIn company pages (18 tracked vendors), accessed 2026-07-08.

Internal working brief — ProductBeacon Research, unlisted. Consolidates radar-2026-07-05-catchup.md and radar-2026-07-08-weekly.md; no new state recorded. Anything published or forwarded outside re-enters SOP-1/SOP-2 review (incl. §RPD / §5.5). All thesis verdicts are Inferences on public, dated signals against the report's qualified claims. LinkedIn signal collected 2026-07-08 only; D5 respected — no NICE/Cognyte research performed, none surfaced.

Citations ledger + raw research: radar-2026-07-08-since-publication-citations.md · research/2026-07-08-since-publication/ · methodology per State of Cyber 2026 (public-source Integrity Wall, claim-typed, link-audited).