Security That Acts
Nidhal Selmi@nselmi
−7.4%
since Oct 6
The idea
As AI agents start writing code, touching data, and moving money on their own, I think security value concentrates in the vendors already sitting at the enforcement points, holding the telemetry, identity, and recovery infrastructure needed to act in real time. This isn't a broad cybersecurity basket, it's split across platform enforcement, telemetry and edge, identity, and recovery, with no single name above 12% and 10% held in cash.
What it owns
- Vendors whose endpoint and network position gives them proprietary data on what agents actually do. · CrowdStrikeIt sees what agents actually do on endpoints and can stop them, building a data advantage that protects retention as AI-native competitors arrive., CloudflareIt runs the edge network that AI agents route through, giving it both telemetry and a point to enforce rules in real time., ZscalerIt brokers traffic between users, agents, and apps, making it both an enforcement and monitoring point as zero-trust adoption grows.32%
- Firewalls and security platforms that sit inline and can block what an AI agent does, not just report it. · Palo Alto NetworksIt owns the broadest enforcement layer through firewalls, cloud security, and SOC tools that agents' traffic must pass through., FortinetIt sits inline on a huge installed base of firewalls, giving it the embedded enforcement point where value concentrates., Check Point SoftwareIt is the steady, cash-rich incumbent in the enforcement layer, sustaining durable cash generation as AI-native challengers emerge.27%
- When an agent breaks or corrupts something, the ability to restore clean data is the last line of defense. · RubrikIt restores data after agents or attackers break things, positioning recovery as its own budget category separate from prevention., CommvaultIt is embedded in backup and restore workflows across enterprises and can shift that base toward cyber recovery as agents proliferate.16%
- Controlling who and which agent gets access becomes the choke point when software acts on its own. · OktaIt decides which agent acts as whom at the identity gateway, becoming essential as organizations control agent access., SailPointIt governs who and what accesses which systems, becoming more critical as agents multiply access requests across infrastructure.15%
- Cash10%