Network & Firewall
The old perimeter — still doing most of the heavy lifting.
Traditional firewall and network-security vendors. Their gear sits at the edge of every enterprise network, inspecting traffic. Margins are high, customer-stickiness extreme — switching firewalls is multi-quarter pain. The maturity layer of the stack.
Endpoint & XDR
Where 90% of attacks actually land.
Endpoint detection and response. Modern attacks reach laptops, phones, and servers — and the endpoint layer is where ML-based behavioural detection has displaced signature-based AV. The fastest-evolving layer, with AI-driven threat detection a real moat.
Cloud & Zero Trust
The new perimeter is no perimeter.
Cloud security and zero-trust network access. As workloads moved off-prem, the firewall stopped being the edge — every connection is now a potential attack vector. The fastest-growing layer, with hyperscaler-adjacent positioning.
Identity & Access
Identity is the new perimeter.
Identity and access management. Every modern attack starts with credentials. The layer that has compounded most reliably — every new SaaS app, every contractor, every device increases the identity attack surface. Subscription-revenue economics are the cleanest in the entire stack.
Security Operations
Where alerts become actions.
SIEM, vulnerability management, and security operations platforms. The layer where everything else feeds into. As alert volume explodes, automation and AI-aided triage are the differentiators. Margins are lower than endpoint but stickier — replacing a SIEM is a one-year project.
What the data says today.
Computed live across all 32 names in the chain. No curation, just rankings.