Welcome to the Era of the Great Security Swallowing?

You can feel it in every earnings call, every acquisition press release, every breathless “strategic alignment” announcement from Silicon Valley: the security industry is folding in on itself. But is this normal market consolidation? Or is this AI-driven panic?

The threat? A scattered, atomized Cloud Native Security Fabric (CNSF), an ephemeral web of VPCs, APIs, and workloads that span AWS, Azure, GCP, and everything in between. And the mega-vendors know they’re “buying” their way into full coverage while racing against obsolescence with billion-dollar shopping carts.

The three-legged stool (and why everyone’s missing a leg)

Chris McHenry, chief product officer at Aviatrix, a multi-cloud networking player watching the consolidation unfold from the fabric layer, frames it as “the three-legged stool of runtime security.” Network security. Endpoint security. Identity. You need all three legs working in concert to stop modern attacks. Miss one, and you’re toast.

When Palo Alto Networks went after CyberArk (expected close in 2026), they acknowledged that they had a glaring gap in identity, the new control plane of zero-trust security. McHenry notes that in a cloud-first world where identity has become the control plane, firewalls and endpoints aren’t enough anymore. Without embedding identity into the runtime fabric, Palo Alto’s platform would remain incomplete.

Palo Alto already dominated network and endpoint. CyberArk owned privileged access management. Together, they complete the stool, positioning them to secure the exploding number of human, machine, and AI identities that now traverse the cloud. The pitch writes itself: tighter cross-signal correlation of who the entity is, what they’re trying to do, and where in the cloud they’re executing.

But here’s the thing about stools: when all three legs are attached to the same base, one crack can topple the whole structure.

How we learned to stop worrying and love consolidation

Then there’s Veeam’s USD1.725 billion acquisition of Securiti AI. This isn’t just about runtime defense; it’s a proactive, vertical strike on the core data problem of the AI era. The target is the dirty secret that 80-90% of AI projects fail, often because enterprises can’t trust the accuracy, lineage, or privacy of their own data.

“It’s no longer about just protecting data from cyber threats. It’s about identifying all your data, ensuring it’s governed and trusted to power AI transparently,” says Veeam’s chief executive officer Anand Eswaran. “Enterprise AI is simply not possible without data security.”

This is a profoundly thoughtful move: the merger unifies data resilience (Veeam’s strength) with Data Security Posture Management (DSPM), privacy, governance, and AI trust (Securiti’s strength). This combination mitigates the traditional trade-offs CISOs face between security and business agility.

Securiti AI’s Data Command Center, powered by a unique knowledge graph, is the linchpin. It tracks and unifies intelligence across the entire data estate, gaining command over the unstructured data — emails, documents, and customer interactions that represent the 70-90% of enterprise data that lives in the shadows. This one-stop-shop approach gives CISOs a single control plane across both production and secondary (backup) data.

Crucially, the deal enables surgical “recover and rollback” of AI and data with precision. This means if an AI model is poisoned or hallucinates, you can trace, audit, and roll back specific datasets or model weights without disrupting unaffected systems. It positions Veeam not just as a backup company, but as the AI Trust Layer, which fundamentally redefines the resilience category.

It smells like consolidation because it is, in fact, a consolidation. But for CISOs drowning in tool sprawl, it smells like salvation.

McHenry acknowledges the appeal: for CISOs under pressure to simplify, a one-stop shop looks attractive with fewer contracts, fewer consoles, and less tool sprawl can be a relief — especially with AI creating new headaches and threat vectors.

But there’s a price tag when it comes to consolidation.

Are security giants building single points of failure

The challenge in all consolidations lies in integration. And in this case, a security posture only improves if the integration is real.

McHenry warns that if integration is shallow, a challenge often associated with acquisition-heavy strategies, enterprises will end up with a bundle of parts rather than a unified platform. Many acquisitions lose momentum once they’re absorbed into what he calls “platformization”, which is the Silicon Valley strategy of being a one-stop shop for everything cyber. The roadmap shifts toward integration and cross-sell rather than sharp innovation.

The CyberArk acquisition is a case study. CyberArk built its reputation on deep, narrow innovation in privileged access management. Once it’s inside Palo Alto’s ecosystem, does it become the backbone of runtime architecture or just another SKU in an expanding portfolio?

And then there’s the monoculture risk. When one vendor owns too much of the zero trust stack, even a small vulnerability cascades. In the CNSF era, where every workload and API call traverses public infrastructure, over-centralization creates monocultures that attackers can exploit.

But here is the massive counter-argument: for the CISO, the operational benefit of a unified platform can feel like a lifeline. Single-platform architectures eliminate the sprawl of agents, reduce licensing costs, and, critically, improve the speed of incident response. By consolidating telemetry from network, endpoint, and identity into one console. The unified view also drastically lowers the risk of misconfiguration, which is often a greater cause of breach than a zero-day vulnerability in a single product.

As McHenry puts it, consolidation can improve efficiency, but security diversity remains essential for resilience.

Are you paying for integration or just overlap?

In the short term, customers should brace for a premium. But the real question is whether that premium buys you actual security or just vendor lock-in with a bow on top.

McHenry explains that the real impact depends entirely on whether integration reduces operational sprawl across the CNSF. Today, many enterprises are unaware of 50-80% of their cloud attack surface because each VPC or API endpoint requires its own set of controls.

If the mega-platforms can secure that fabric holistically, the operational complexity drops even if licensing costs rise. But if integration is superficial, enterprises will simply pay more for overlapping tools and remain blind where it matters most.

This is where the specialists, i.e., especially those who haven't been swallowed yet, see their opportunity.

Why specialists still have a pulse

McHenry’s bet is that the multi-cloud reality guarantees diversity. Enterprises running multi-cloud aren’t going to rely on one platform's native tools for everything; they need consistent visibility and control across all clouds.

Aviatrix sits at the multi-cloud connectivity and security fabric layer, providing what McHenry describes as the neutral plane that stitches together consistent policies, observability, and control. Their pitch is surgical: even after all the buying, enterprises will still need a CNSF partner to see and secure the blind spots those platforms miss.

McHenry points out that after an acquisition, innovation within large platforms often slows down, creating opportunities for smaller vendors to catch up. He expects bursts of innovation from specialists who can move faster and remain neutral across clouds.

It’s a David-vs-Goliath narrative, but with a twist: David isn’t trying to kill Goliath. He’s just betting that Goliath can’t move fast enough to cover every gap in an attack surface that’s expanding faster than acquisition budgets.

AI agents and the next breach: The smarter bet

The threat horizon is forcing the speed and scope of these deals, and this is where the strategic foresight of the Veeam acquisition truly shines.

Forrester’s 2026 predictions are stark: an agentic AI deployment will cause a public breach and lead to employee dismissals.

“In 2026, security leaders in Asia Pacific will face unprecedented pressure to evolve as the risk landscape shifts rapidly,” said Jinan Budge, vice president and research director at Forrester. “The rise of agentic AI will introduce new breach scenarios, prompting organisations to balance innovation with new layers of accountability. We anticipate accelerated investment in quantum security as the region prepares for quantum computing’s disruption of encryption standards.”

This makes Veeam’s move to unify resilience and data trust not just relevant, but essential. The Palo Alto move completes the “runtime defense” stool; the Veeam move addresses the foundational integrity layer beneath the AI applications themselves.

In the end, the CISO’s nightmare isn’t just complexity. It’s also about being locked into a mega-platform that has deprioritized the deep, narrow innovation needed to fight the next wave. The Palo Alto/CyberArk move completes the horizontal “runtime defense” stool; the Veeam move addresses the vertical foundational integrity layer beneath the AI applications themselves.

The security market is projected to hit USD302.5 billion by 2029, says Forrester in their "Predictions 2026: Cybersecurity and Risk" report. But the core problem remains unchanged: the more complex the threat (AI, quantum, agentic systems), the more pressing the need for simplification, and the more tempting the one-stop-shop becomes.

Forrester anticipates more strategic acquisitions by legacy IT vendors seeking relevance in a rapidly evolving threat environment. The giants are buying time and territory. But they may also be building massive, single targets for the next generation of attacks.

The only way out is a rigorous, multi-cloud reality check. Success demands security diversity, not just consolidation. Trust the fabric.

Image credit: iStockphoto/damedeeso