Graham Watts

SIEM has been around for 20 years, yet most people don’t really understand it - even after working with SIEMs for years. A SIEM is not a product. It’s not even a product category. It’s not about tech at all. A SIEM is a reflection of how security is managed and viewed within a company. "Market-leading" SIEMs can fail miserably. So-called "legacy" or "bad" SIEMs can quietly deliver significant, tangible outcomes. A SIEM is a blueprint - on paper, an architectural masterpiece soaring (pun intended) into the sky. It can be just that. More often, the architect’s dream is simply the contractor’s nightmare. Let’s not even mention the maintenance crews who have to deal with it once it’s built. It’s common to spend millions and still have zero meaningful coverage. To centralize all the data only to find it contains nothing of value. To query all day and come back empty-handed. A SIEM is a mirror. Of priorities, decisions, execution capabilities, attention to detail, objective setting, resource allocation, and how well the business, its processes, and its risks are understood. Show me your SIEM, and I’ll tell you who you are. So, what’s being shown in your mirror? #SIEM #SOC #SecurityOperations #cyber

163

2 Comments

Another major cybersecurity industry milestone: Zscaler just crossed $3 billion of ARR. They're one of four (mostly) cybersecurity companies ever to do it (Palo Alto Networks, Fortinet, CrowdStrike, and I would also include Gen Digital – although a very different and consumer-focused business). And, as they referenced on the earnings call, one of two pure-play SaaS security companies to surpass this level of ARR (I'm assuming CrowdStrike was the other – they didn't say). Their Q4'25 report was excellent all around, both in terms of performance and the data points they disclosed. A couple (of many) highlights: → Strategic growth drivers Zscaler has been building a good narrative around growth drivers outside of their core Zero Trust networking business for several quarters now. This report put some numbers behind it. Strong Zero Trust Everywhere performance is no surprise. This is a logical extension of their core business. It's moving much faster than expected. They nearly hit their FY'26 estimate of 390 customers already this quarter (350). Data Security Everywhere was very interesting because they disclosed product line ARR of $425M — some of which was standalone (e.g. data security products purchased without other components of the ZS platform). Jay Chaudhry pointed out that it would be one of the largest standalone data security businesses in the industry if it was a separate company. (Theoretically second to Varonis's $693M ARR. I'd guess Microsoft and a couple other diversified tech companies are close, too). AI security is the wild card. Zscaler includes both Security for AI Applications and Agentic Operations (both SecOps and IT Ops solutions) in this product line, so its scope is partially outside of cybersecurity. Either way, they expect it to exceed $400M ARR in their next fiscal year. → On SASE and firewall displacement Jay Chaudhry put on a clinic about both firewall displacements and SASE market confusion in the Q&A. He said firewalls are becoming "like mainframes" and predicted a phased displacement: branch firewalls first, data center firewalls next, and virtual firewalls last. Another epic quote on SASE: "Unfortunately, SASE is one of those terms which means anything and everything...we don't even like to use the term SASE too much." Zscaler has a very specific definition and vision for the future of secure networking and zero trust. That vision does not involve firewalls. It's going to take a long time for this vision to play out, of course — but the mission is clear. --- 2025 was a great fiscal year all around for Zscaler. They made a lot of progress on AI, security operations market expansion, and more while continuing to grow at scale. I think we'll look back on this as an inflection point that turned them into a multi-domain cybersecurity company that is capable of competing with the biggest and best in the industry.

293

20 Comments

The future of vulnerability management tooling has never been more intensely competitive, as early consolidation has driven the large platforms to start pushing highly competitive offerings at helping companies achieve the idea of Continuous Threat Exposure Management (CTEM) - which yes, has been vulnerability management all along. You have: 1. Wiz + Dazz (acquired by Wiz) 2. Orca Security + Opus Security (Now Part of Orca Security) 3. Zscaler + Avalor Security, a Zscaler Company 4. Armis + Silk Security 5. Tenable + Vulcan 6. Invicti + Kondukto These players are rushing to provide holistic multi-cloud and on-prem vulnerability management capabilities to their customers via acquisition strategies. From what I've seen, Wiz's approach of having the team rebuild their capabilities in house has once again paid off, having the Universal Vulnerability Management (UVM) features tightly integrated with the platform. Independent players provide distinct benefits, especially with capabilities like reachability across multiple scanners. Some of the independent players doing a great job at vulnerability aggregation and normalization across large diverse environments are: 1. Axonius 2. Zafran Security 3. Phoenix Security | ASPM 4. ArmorCode Inc. 5. Seemplicity 6. Brinqa 7. Nucleus Security 8. DevOcean There are numerous other vendors in this category as well, but these providers all focus on unifying large sets of vulnerability information to drive results, especially for enterprises struggling with massive infrastructures.

278

60 Comments

Met with some smart founders last week and was discussing two common patterns amongst security teams. Both patterns break trust and create distance between security teams and the rest of the company. The first is security team as "rock throwers" - tossing a never ending stream of issues at others for resolution. This is made worse with naive recommendations, poor validation, and sloppy prioritization. The second is security team as "wrench wielders" - creating business and production impact by tossing wrenches into the works when their changes cause outages, interruptions, and performance impact. Avoiding these patterns isn't easy and takes effort and experience. I wrote up my recommendations for successful security teams (to avoid these and other problems) in Security for High Velocity Engineering (https://lnkd.in/gmtA2UJP). I cover everything from strategy, constraints, tactics, and execution.

163

10 Comments

🚨 Big launch today at Kandji 🚨 We just shipped Vulnerability Response—the missing link between vulnerability detection and automated remediation for Mac. Now, Kandji can automatically patch vulnerable apps based on CVE severity and rules you define. No more ticket ping-pong between Security and IT. No more manual patching marathons. Just faster, smarter remediation—built right into your existing workflows. Proud of the team for delivering a feature that makes a real difference for lean security and IT teams. More info can be found here: https://lnkd.in/dG5XVS6Y #cybersecurity #vulnerabilitymanagement #macadmin #patchmanagement #kandji

123

8 Comments

Gartner named CTEM a top security trend of 2024-25. And if you’ve worked in security, you understand why. Quarterly vulnerability scans just aren’t cutting it anymore. By the time the report lands in your inbox... - The code has changed - The infra’s been redeployed - The risk is already outdated That’s where CTEM (Continuous Threat Exposure Management) comes in. It’s NOT a tool. It’s NOT a feature. It’s a mindset shift. From point-in-time snapshots → to continuous discovery, validation, and remediation. From static reports → to real-time visibility on what attackers can actually exploit. From “fix everything” → to “fix what matters.” Because here’s what most orgs are getting wrong: You don’t need more findings. You need fewer distractions. CTEM helps teams: Reduce noise, validate exposures continuously, Focus security programs on real risk, but not theoretical severity. And yes, Strobes CTEM supports that shift. From aggregating findings across your scanners - To correlating them - To pushing prioritized issues straight into workflows. But this post isn’t about us. It’s about what comes after the dashboards. The future of enterprise security is continuous. And it's already here. PS: What’s stopping teams from adopting CTEM right now? Curious what you’re seeing in the field. 👇

31

Missed the last couple of posts with Black Hat + PTO , but wanted to highlight some of the biggest announcements in the cyber industry over the last few weeks:   Funding   Noma Security raise $100M in Series B Funding | Founded in 2023, Noma Security is a unified platform focused on AI and agent security, enabling cybersecurity to control AI risks. The round was led by Evolution Equity Partners. Congrats to Niv Braun & the rest of the team!   Safe Security raise $70M in Series C Funding | Founded in 2012, Safe Security provides cyber risk management solutions to quantify and manage enterprise‑wide cyber risk in real time. The round was led by Avataar Venture Partners. Congrats to Saket Modi & the rest of the team!   Wallarm: API Security Leader raise $55M in Series C Funding | Founded in 2016, Wallarm is an API security platform that automates real-time application protection and security testing for APIs, apps, and microservices. The round was led by Toba Capital. Congrats to Ivan Novikov & the rest of the team!   BlinkOps raise $50M in Series B Funding | Founded in 2021, Blink is a security workflow automation platform designed to make building, collaborating, and scaling all things security & beyond quick and easy using generative AI. The round was led by O.G. Venture Partners. Congrats to Gil Barak & the rest of the team! 1Kosmos raise $47M in Series B Funding | Founded in 2018, 1Kosmos provides a unified identity verification and passwordless authentication platform. The round was led by Forgepoint Capital. Congrats to Hemen Vimadalal & the rest of the team!   Prophet Security raise $30M in Series A Funding | Founded in 2023, Prophet Security delivers an AI-driven security operations center (SOC) platform that automates alert triage, investigation, and response. The round was led by Accel. Congrats to Kamal Shah & the rest of the team! M&A Palo Alto Networks announce their agreement to acquire CyberArk | This strategic acquisition will accelerate Palo Alto Networks’ platform strategy by establishing Identity Security as a new core platform. The deal was reported to be for $25bn. SentinelOne announce their agreement to acquire Prompt Security | The deal is part of SentinelOne’s strategy to extend its AI-native Singularity Platform to secure the rapidly growing use of generative (GenAI) and agentic AI in the workplace.  The deal was reported to be for $250M. Congrats to all involved! 🚀   #venturecapital #cybersecurityfunding #cybersecurityacqusitions #startups #cybersecurity #cyber 

24

5 Comments