Cloud-native EDR/XDR with the strongest 2026 analyst execution in endpoint protection.

Largest installed base; bundled with Microsoft 365 and Defender XDR.

Autonomous AI EDR with strong rollback and multi-year analyst Leader placement.

XDR that correlates endpoint, network, and cloud telemetry on the Cortex platform.

Broad mid-market EDR with managed detection and a 2026 EPP Leader seat.

Enterprise endpoint suite from the McAfee/FireEye stack, still a top share holder.

XDR platform spanning endpoint, email, and cloud workload protection.

Open-core SIEM/EDR for teams that want detection engineering on Elasticsearch.

Cloud SIEM with the fastest enterprise adoption via Azure and Defender bundling.

Long-time SIEM standard for large SOCs, now inside Cisco.

High-speed SIEM on Falcon log data, replacing a slice of legacy SIEM spend.

AI SOC platform combining SIEM, SOAR, and XDR into one operations console.

Chronicle-based SIEM with petabyte search and Google threat intel.

UEBA-first SIEM used by SOCs that want behavior analytics over raw logs.

Search-native SIEM popular with detection engineers and MSSPs.

Cloud SIEM with strong UEBA for large enterprise log volumes.

Category-defining CNAPP; the default shortlist for new cloud security buys.

Broadest CNAPP module set for enterprises already on Palo Alto.

CNAPP plus runtime protection for teams standardizing on Falcon.

Native Azure CNAPP with multi-cloud connectors and Defender bundling.

Agentless-first CNAPP known for fast time-to-value and side-scanning.

CNAPP and network security for Check Point estates.

Container, Kubernetes, and software-supply-chain runtime security.

CNAPP tied into Rapid7’s VM and SOC tooling.

Default enterprise IdP; largest workforce identity install base.

Independent IAM leader for SSO, MFA, and customer identity.

Enterprise IAM and CIAM for complex hybrid identity estates.

Workforce identity sitting next to CyberArk’s PAM franchise.

MFA and device trust used widely as the add-on second factor.

Directory-as-a-service for mid-market SSO, device, and identity.

Developer-first CIAM platform, now part of Okta.

Identity for Google Workspace and Google Cloud customers.

PAM market leader for vaulting, session control, and secrets.

Strong PAM and remote privileged access; 2025 analyst Leader.

Cloud-forward PAM used widely in mid-market and enterprise.

De facto secrets and machine-identity vault for engineering teams.

Infrastructure access proxy replacing standing VPN/bastion privileges.

PAM layered on a large password-manager install base.

Identity-native access for SSH, Kubernetes, and databases.

European PAM suite with a large regulated-industry footprint.

Top 2026 SASE/SSE execution; deep CASB, DLP, and cloud security.

Single-vendor SASE cloud; jumped to #2 in 2026 SASE rankings.

Enterprise SASE from Prisma Access plus SD-WAN.

Proxy-native zero trust SASE with a large Fortune 500 base.

SASE built on Cisco networking, Umbrella, and Duo.

SASE for shops standardized on FortiGate and FortiOS.

ZTNA, SWG, and WARP on Cloudflare’s global edge.

Single-vendor SASE with strong SD-WAN roots.

Most widely deployed cloud WAF, bundled with CDN and bot defense.

Enterprise WAF standard for on-prem and hybrid app protection.

Edge WAF and bot management on the largest content network.

Specialist WAF/API security with a long enterprise AppSec franchise.

Default WAF for workloads already on CloudFront and ALB.

Signal Sciences–based WAF popular with engineering teams.

WAF for Fortinet network security stacks.

Mid-market WAF and application security.

Nessus franchise and Exposure Management; VM market share leader.

Cloud VM, policy compliance, and scanning at global enterprise scale.

VM plus SOC context for teams already on InsightIDR.

Cloud vulnerability and toxic-combo ranking that displaced a lot of VM spend.

Exposures on endpoints and identities inside the Falcon console.

Vulnerability management inside Defender for Cloud and Endpoint.

High-velocity template scanning used by AppSec and red teams.

Attack-surface and VM platform for mid-market internet-facing assets.

Developer-first SCA/SAST leader for open source, containers, and IaC.

Enterprise AppSec platform with deep SAST and supply-chain coverage.

Cloud AppSec testing used by large regulated engineering orgs.

Code scanning, secret scanning, and Dependabot where developers already work.

Built-in SAST/DAST/Fuzz testing in the DevSecOps platform.

Quality-plus-security static analysis with huge developer adoption.

Fast, customizable SAST used by modern AppSec teams.

IAST/RASP that finds vulns in running applications.

Leading business password manager with developer secrets and SSO.

Standard dynamic secrets vault for infrastructure and apps.

Open-source password manager with strong SMB and enterprise growth.

Enterprise secrets for machines sitting next to PAM.

Default secrets store for AWS-native applications.

Zero-knowledge password manager and PAM for enterprises.

Developer secrets manager for multi-cloud app config.

SaaS secrets and zero-trust application access.

Email security market leader for phishing, BEC, and information protection.

Native Microsoft 365 email protection with the largest seat count.

Behavioral AI email security taking share from classic SEGs.

Cloud email security, continuity, and awareness for mid-market and enterprise.

SEG and API email security inside the Cisco security stack.

Email security and backup aimed at Microsoft 365 SMBs.

Human-layer email security for outbound data loss and inbound BEC.

API-based Microsoft 365 / Google email security from Check Point.

Self-learning NDR/XDR with a 2026 NDR Leader seat and large brand presence.

Packet-based NDR Leader focused on network intelligence plus detection.

Agentless AI NDR covering identity, cloud, and network attacker behavior.

Zeek-powered network evidence and NDR for detection engineering teams.

NDR and NetFlow analytics for Cisco-heavy networks.

Network IPS/NDR inherited from FireEye NX.

Network detection feeding Cortex XDR/XSIAM.

Open XDR with NDR sensors for MSSPs and mid-market SOCs.

Category leader in automated security compliance for SaaS companies.

Continuous control monitoring and SOC 2/ISO automation at enterprise scale.

Fast-growing compliance automation for startups and mid-market.

Compliance automation with personnel and vendor risk workflows.

Enterprise GRC on the ServiceNow platform.

Privacy, GRC, and third-party risk in one trust platform.

Audit, SOX, and operational risk platform for large enterprises.

Compliance automation plus audit delivery in one motion.

Largest bug-bounty and pentest marketplace by researcher and program volume.

Crowdsourced security platform with pentest and bounty programs.

European bug-bounty leader expanding globally.

Vetted researcher network plus pentest platform for regulated buyers.

Pentest as a service with a large pentester community.

Automated pentest and security validation against production networks.

Autonomous pentest that chains real exploits for exposure scoring.

Bug-bounty platform with a strong EU and public-sector footprint.

Enterprise NGFW share and capability leader.

Highest unit volume NGFW, especially outside the US Fortune 100.

Broad installed base across campus and data-center networks.

Long-running NGFW franchise with strong threat prevention.

NGFW for Juniper routing and AI-driven campus networks.

Mid-market NGFW bundled with endpoint.

MSP-friendly NGFW and unified threat management.

SMB and distributed-edge firewalls.