Cyber

The Adversary

Why this whole map exists — and why the budgets never shrink

The Adversary

Nation-state crews (Salt Typhoon inside US telecoms, Volt Typhoon pre-positioned in critical infrastructure), ransomware gangs, and social-engineering outfits like Scattered Spider — now armed with AI that writes the phishing and finds the exploits. Every breach headline is a budget line for everyone to the right.

The Cloud Giants

The rails security runs on — and the trillion-dollar rivals who bundle it

AMZN — Amazon (AWS)

The infrastructure the Falcon platform runs on and the storefront it sells through: CrowdStrike was the first security vendor to clear $1B in AWS Marketplace sales, and Marketplace private offers now burn down enterprise cloud commitments on security subscriptions.

market cap $2.79T · revenue $776B (research snapshot; the live map shows current data)

MSFT — Microsoft

The biggest security vendor on earth by revenue and the industry’s frenemy: Defender, Sentinel, and Entra ship bundled into E5 licenses, which is exactly the "good enough and already paid for" pitch every pure-play on this map has to beat.

Why it matters: The bundling threat that caps every pure-play’s pricing power — and, since the July 2024 Falcon outage that took down 8.5M Windows machines, the kernel gatekeeper deciding how deeply third-party agents get to run.

market cap $3.71T · revenue $332B (research snapshot; the live map shows current data)

GOOGL — Alphabet (Google Cloud)

Bought its way into the room: Mandiant ($5.4B, 2022) for incident response and threat intel, then Wiz ($32B, the largest deal in Google’s history) for cloud security — folded into Google Unified Security to sell alongside GCP.

market cap $4.14T · revenue $446B (research snapshot; the live map shows current data)

The Falcon

The cloud-native endpoint platform that became the industry’s consolidation bet

CRWD — CrowdStrike

The center of the map: the Falcon platform started as a single lightweight endpoint agent and grew into cloud security, identity protection, Next-Gen SIEM, and exposure management sold as modules on one console — the "consolidate onto Falcon" pitch, with Charlotte AI as the agentic layer on top.

Why it matters: The cleanest read on whether security consolidates onto a few platforms or stays a hundred point products. Every rival on this map is either trying to bundle Falcon away, out-platform it, or plug into it.

Outlook: Falcon Flex, the pay-as-you-consume licensing model, is pulling customers into larger multi-module commitments and has become the main growth engine. Management’s long-term target is $10B of ARR, with net new ARR re-accelerating after the outage-era customer-commitment packages rolled off.

market cap $218B · revenue $5B (research snapshot; the live map shows current data)

The Platform War

Everyone wants to be the one vendor the CISO keeps

PANW — Palo Alto Networks

The other consolidation bet: Nikesh Arora’s "platformization" strategy sells network (Strata), cloud (Prisma), and SOC (Cortex XSIAM) as one stack, and the $25B CyberArk acquisition bolted on identity security — the biggest deal in cybersecurity history.

Outlook: Targets $15B of next-generation security ARR by FY2030, betting that customers standardizing on two or three platforms will pick Palo Alto for network-plus-SOC and treat everything else as a feature.

market cap $272B · revenue $12B (research snapshot; the live map shows current data)

S — SentinelOne

The endpoint challenger that never caught the leader: Singularity competes head-on with Falcon on EDR, Purple AI is its answer to Charlotte, and it lives off deals where a CISO wants a credible second source — or a cheaper one.

market cap $7B · revenue $1B (research snapshot; the live map shows current data)

The Network Guard

Firewalls, zero trust, and the edge — where the packets get inspected

FTNT — Fortinet

The firewall volume leader with a margin structure nobody else on this map has: FortiGate appliances run on Fortinet’s own ASICs, so it undercuts Palo Alto on price while printing ~28% net margins, and the 2025–26 firewall refresh cycle is its tailwind.

market cap $115B · revenue $8B (research snapshot; the live map shows current data)

CSCO — Cisco

The networking incumbent that paid $28B for Splunk to own the SOC data layer, then fused it with its firewalls and Hypershield into a security business that now rivals the pure-plays in size — sold through the biggest enterprise sales force in tech.

market cap $430B · revenue $63B (research snapshot; the live map shows current data)

ZS — Zscaler

The zero-trust pioneer: the Zero Trust Exchange replaces the corporate firewall perimeter with a cloud proxy that inspects every connection, and the Red Canary acquisition (2025) added managed detection to sell the SOC alongside the network.

market cap $28B · revenue $3B (research snapshot; the live map shows current data)

NET — Cloudflare

The "connectivity cloud": a global edge network that started as DDoS protection and CDN and now sells zero-trust access, SASE, and AI-agent security (plus Workers, its developer platform) to the same buyers Zscaler chases.

market cap $99B · revenue $3B (research snapshot; the live map shows current data)

The Keys & Vault

Who you are and what you can recover — identity and data resilience

OKTA — Okta

The independent identity layer — single sign-on and access management for the workforce and for customer apps — squeezed between Microsoft Entra bundling from above and Palo Alto’s CyberArk push from the side, now pitching identity for AI agents as its next act.

market cap $30B · revenue $3B (research snapshot; the live map shows current data)

RBRK — Rubrik

Backup reinvented as cyber resilience: the Microsoft-backed 2024 IPO sells the immutable copy of your data that lets a company recover from ransomware without paying — the fastest-growing name on this map.

market cap $19B · revenue $2B (research snapshot; the live map shows current data)

The CISO

Where the money ultimately comes from

Enterprises

Global security spending is running past $240B a year and growing double digits regardless of the macro cycle — the one budget a board never cuts after a breach. The fight on this map is over how many vendors each CISO keeps.

Governments

The federal channel: FedRAMP High authorizations, the Pentagon’s CMMC contractor mandates, and CISA’s post-Salt-Typhoon push to harden telecoms and critical infrastructure — slow to win, sticky once won.

Relationships on the map

• Amazon (AWS) supplies CrowdStrike — AWS rails & Marketplace
  Falcon runs on AWS, and AWS Marketplace is a major sales channel — CrowdStrike was the first security vendor to pass $1B in Marketplace sales.
• Microsoft competes with CrowdStrike — Defender vs Falcon
  Defender ships bundled into Microsoft E5 licenses; every Falcon renewal is a fight against "we already pay for Microsoft."
• Microsoft partners with CrowdStrike — Threat-actor naming alliance
  The two co-published a shared glossary mapping each other’s adversary names (2025), and Microsoft’s post-outage Windows endpoint-security platform sets the rules Falcon’s agent runs under.
• Alphabet (Google Cloud) competes with CrowdStrike — Wiz cloud security
  Google’s $32B Wiz purchase turned the cloud-security posture market into a fight between Wiz and Falcon Cloud Security.
• Alphabet (Google Cloud) competes with Palo Alto Networks — Wiz vs Prisma Cloud
  Prisma Cloud was the incumbent cloud-security suite until Wiz took the mindshare; now Google sells it with GCP credits attached.
• CrowdStrike competes with Palo Alto Networks — The consolidation war
  Falcon Flex vs platformization: both sell the CISO the same dream of fewer vendors, from opposite starting points (endpoint vs network).
• CrowdStrike competes with SentinelOne — EDR turf
  Singularity is the credible alternative endpoint agent — SentinelOne wins on price and second-source deals, CrowdStrike on platform breadth.
• Palo Alto Networks competes with Fortinet — The firewall crown
  Palo Alto sells the premium next-gen firewall; Fortinet undercuts it on custom ASICs and wins the volume — the oldest rivalry on the map.
• Palo Alto Networks competes with Zscaler — SASE & zero trust
  Prisma Access vs the Zero Trust Exchange for the corporate network that no longer has a perimeter.
• Cisco competes with CrowdStrike — Splunk vs Next-Gen SIEM
  Falcon Next-Gen SIEM is built to pull security data — and the budget — out of Splunk, the incumbent Cisco paid $28B for.
• Zscaler competes with Cloudflare — Zero-trust edge
  Two cloud edges selling the same replacement for the VPN and firewall: Zscaler from security, Cloudflare from the network up.
• Zscaler partners with CrowdStrike — Zero-trust integration
  A long-running alliance: Falcon’s device-health signals feed Zscaler’s access decisions, and the two co-sell into the same zero-trust deals.
• Okta partners with CrowdStrike — Identity signals
  Okta’s identity events flow into Falcon Identity Protection and Next-Gen SIEM; the two share a large customer base and co-sell against Microsoft.
• Palo Alto Networks competes with Okta — The CyberArk land grab
  Buying CyberArk made Palo Alto an identity-security vendor overnight, putting the platform giant on Okta’s turf.
• Rubrik partners with CrowdStrike — Recovery meets detection
  Rubrik’s data-resilience telemetry feeds Falcon’s SIEM so a ransomware detection and the clean recovery point live in the same workflow.
• CrowdStrike supplies Enterprises — Falcon subscriptions (~$5B/yr)
  Roughly $5B of ARR — the overwhelming majority from enterprise subscriptions, increasingly sold as multi-module Falcon Flex commitments.
• Palo Alto Networks supplies Enterprises — Platform stack (~$11B/yr)
  Firewalls, subscriptions, and now CyberArk identity — the biggest pure-play security revenue base in the world.
• Fortinet supplies Enterprises — Firewalls & services (~$8B/yr)
  Appliance sales plus the security-subscription and support revenue attached to every FortiGate in the field.
• Microsoft supplies Enterprises — Bundled security (~$30B/yr)
  Research estimate: Microsoft’s security business passed $20B years ago and is now the largest in the industry, mostly attached to E5 licenses.
• CrowdStrike supplies Governments — FedRAMP High Falcon
  Falcon holds FedRAMP High and DoD authorizations, making the US government one of its largest and stickiest customers.