Security Market Pulse · August 2026

Infrastructure is running ahead.
Security is splitting, not booming.

PERIOD 2026-08UPDATED August 16, 2026LAG NO-CALL

Market condition · not vendor performance

+92%

NVIDIA Data Center

+4%

2025 security budgets

NO-CALL

Infra → security lag

Use infrastructure activation as an account qualification trigger — not as proof of a broad cybersecurity boom. A stable lag is still not measurable.

The read

High on infrastructure acceleration. High that 2025 security budgets did not follow. Medium on the 2026 domain split. No-call on a stable lag.

What changed

  1. Cisco Q4 networking orders +40% and NVIDIA Data Center at $75.25B. The build is still on.
  2. Fortinet product +52% while Zscaler organic ARR is +21% and Cisco FY security is +2%. Network iron is hot; the category is not.
  3. Rubrik and Varonis are accelerating. Okta decelerated. CrowdStrike recovered. That is a split, not a wave.

Do

  • Prepare the observed network refresh motion where it is already in flight. Do not rebrand it as infrastructure-lag capture.
  • Ask when cloud/AI capacity, sensitive data, and machine identities go live.
  • Prepare data/AI only for accounts putting sensitive data into new workloads.

Avoid

  • Claiming a market-wide cybersecurity boom or a stable 0–8 quarter lag.
  • Reading headline security growth without stripping acquisitions.
  • Treating the 2025 Wiz or CyberArk announcements as this month’s demand signal.

We will not call

  • Stable 0–8-quarter infrastructure-to-security lag
  • Domain-specific infrastructure lag
  • AI compression of the lag
  • Broad cybersecurity-boom motion

What would change the call

  • Realized security-budget growth and rebound in security share of IT
  • Organic acceleration across a majority of comparable security vendors
  • Expansion from AI pilots into consequential production workloads
  • A registered infrastructure impulse followed by a registered security response under fixed cohort rules

Tempo

Where the prints convert into a decision. Tag will not exceed the Episode 002 posture.

DomainWindowDo
Network / SASEThis quarterPREPARE

Refresh is live. Cato and Netskope are growing faster than Zscaler organic. That is a split, not a new SASE wave.

Data / AI SecurityExposed accountsPREPARE

Public data vendors are up. DSPM names are capital and M&A, not a broad spend series.

Cloud SecurityWatchWATCH

CrowdStrike cloud segment is real. CNAPP names show 2026 GTM or last disclosed equity — not a clean category ARR series.

IdentityWatchWATCH

IGA is up. Mega-seed and strategic rounds are capital heat in agentic identity — not buyer spend yet.

SecOpsWatchWATCH

Public XDR and XSIAM segments are healthy. SOAR capital (Torq, Tines) is scale-up, not a new cycle.

AI RuntimeWatchWATCH

Agent governance capital is real and sourced. Company-stated growth is not public buyer spend.

M&A and startups

Window: Jul 6 – Aug 10, 2026. Platforms that bought identity are now seeding and buying agent control. Agent governance funded at every stage in one window; capital heat runs ahead of disclosed revenue. First disclosed agentic-identity revenue is the falsifier.

Zenity raised $115M Series C (+ $10M secondary)$115M + $10M

Norwest · AI runtime

Series C. Some outlets report $125M total — primary plus secondary, not a conflict. Valuation is not ARR.

Oak raised $60M seed$60M

Accel, CRV, Greylock · Identity

Mega-seed for AI-native identity OS. Capital, not buyer spend.

Hush raised $30M with Akamai strategic$30M

Akamai, Battery, YL Ventures · Identity

Series A. Akamai joined as strategic investor — cap table is the story.

Cyera to acquire Oasis Security~$1B

Cyera · Data / identity

LOI, not close. Cyera raised $600M eight weeks earlier — raise-then-acquirer. Capital, not ARR.

Onyx raised $113M$113M

Bessemer · AI runtime

Series B. Agent control plane. Company-stated revenue growth is not a public ARR series.

More in this window (12)
Horizon3.ai raised $250M Series E$250M

NightDragon, NEA · Exposure

Autonomous pentest scale-up. Not a lead — mature-category check.

CrowdStrike fund backed Above SecurityUndisclosed

CrowdStrike Falcon Fund · AI runtime

Agent-driven insider threat. Strategic fund signal; amount undisclosed.

Glow emerged with $180M$180M

Sequoia, Cyberstarts · Endpoint

Company PR: $180M at launch. Source does not label a round type.

Cathedral raised $160M$160M

a16z, Sequoia · Exposure

Defense-tech: autonomous red team for military cyber operations. Different audience than enterprise agent governance.

Neo launched with $100M$100M

a16z, Bessemer · AI runtime

Company PR: $100M at emergence. RoS listed $75M Series A — priced round vs total at launch.

Cisco invested in ZafranUndisclosed

Cisco Investments · Exposure

Strategic round in exposure/risk prioritization. Amount undisclosed.

Arcade just appeared (Series A 2026)Undisclosed

SYN Ventures · AI runtime

Secure action layer for production AI agents. SYN portfolio — round year 2026 only; no public amount or date.

CodeIntegrity just appeared (Seed 2026)Undisclosed

SYN Ventures · AI runtime

Runtime control layer for AI agents. SYN portfolio — round year 2026 only; no public amount or date.

Cisco completed AstrixUndisclosed

Cisco · Identity

NHI / agent identity into Cisco Identity Intelligence. Cisco did not disclose terms.

Cyera raised $600M at $12B$600M / $12B

Evolution Equity · Data

Series G. Context for Oasis lead row. Valuation is not ARR.

Palo Alto closed PortkeyUndisclosed

Palo Alto · AI runtime

AI gateway into Prisma AIRS. Control, not demand. Terms not disclosed.

Zscaler intends Symmetry SystemsIntent

Zscaler · Data / identity

Intent, not close. Access graph to govern agent-to-data communication. Terms not disclosed.

Background — last disclosed raises (4)
Google closed Wiz$32B

Google · Cloud

Closed. Announced Mar 2025. Capital, not customer spend.

Palo Alto closed CyberArk$25B

Palo Alto · Identity

Closed. Identity becomes a PANW platform pillar.

Lumos last disclosed $35M Series B$35M

Scale VP · Identity

Last disclosed raise. Mar 2026 agent-identity product launch is not a new capital print.

Secuvy last disclosed seedSeed

Dell Capital · Data

Last disclosed raise. 2026 partner listings only. Do not invent ARR.

Market layers

Market layers

Panel window 2023-Q1 through 2026-Q1 (2023-Q1 = 100). Later JUL ’26 scorecard prints are not on these charts. Fiscal quarters are mapped into calendar buckets — NVIDIA FY27 Q1 ended 2026-04-26 sits in 2026-Q1. Descriptive sequence only, not a fitted lag.

All three charts use the same log-scale index axis (50–1800; 2023-Q1 = 100) so proportional differences are visually honest — e.g. infrastructure near 18× vs. security near 2×.

Loading charts…

View data table (accessible alternative)
Derived panel indices by quarter (2023-Q1 = 100)
QuarterNVIDIA DCMSFTAMZNGOOGHyperscaler medianCRWDOKTAFTNTZSCHKPSecurity median
2023-Q1100.0100.0100.0100.0100.0100.0100.0100.0100.0100.0100.0
2023-Q2241.1135.280.6109.5109.5105.6107.3102.4108.6104.1105.6
2023-Q3339.0150.187.8128.1128.1113.5112.7105.7118.6105.3112.7
2023-Q4429.9147.4102.7175.2147.4122.0116.8112.1125.4117.3117.3
2024-Q1527.1165.7105.1190.9165.7133.0119.1107.2132.1105.8119.1
2024-Q2613.8209.8124.0209.7209.7139.2124.7113.6141.6110.8124.7
2024-Q3718.9225.7159.2207.6207.6145.9128.4119.5150.0112.2128.4
2024-Q4831.3239.0195.8227.0227.0152.9131.7131.5154.7124.4131.7
2025-Q1913.8253.4176.1273.4253.4159.3132.8122.0161.9112.7132.8
2025-Q2960.3258.4226.5356.9258.4168.8140.5129.1171.7117.5140.5
2025-Q31196.7293.3247.0380.8293.3178.2143.2——119.8143.2
2025-Q41455.8452.0278.1442.8442.8188.4146.9150.9—131.6148.9
2026-Q11758.2467.2311.0567.1467.2200.1147.7—203.1118.0173.9

Panel window is calendar 2023-Q1 through 2026-Q1. Later JUL ’26 scorecard prints are not on these charts. Company fiscal quarters are mapped into those calendar buckets — NVIDIA FY27 Q1 (ended 2026-04-26) sits in 2026-Q1. All three charts share the same log-scale index axis (50–1800; 2023-Q1 = 100). Infrastructure: NVIDIA Data Center revenue. Hyperscaler: median indexed Microsoft, Amazon, and Alphabet quarterly cash capex (not additive). Security: median indexed CrowdStrike, Okta, Fortinet, Zscaler, and Check Point revenue where reported. Gaps remain null — no interpolation.

Watch next

Watch next

What would change the read before the next freeze.

  1. Next IANS publication

    2026 security-budget growth and share of IT

    The +4% / 10.9% hero numbers are the 2025 IANS print (published August 2025). A 2026 edition is the first buyer-budget falsifier.

  2. Next 60 days

    Palo Alto Q4 FY26 — first full CyberArk quarter

    Separates organic platform demand from acquired identity revenue.

  3. Next print

    Fortinet product-revenue follow-through

    Tells refresh spike vs architectural rotation toward converged appliance.

  4. Next print

    Zscaler FY27 ARR guide

    Tests whether SASE deceleration is company-specific or category-wide.

  5. Any hyperscaler print

    A 2027 capex guidance cut

    Largest threat to the infrastructure-lead story. Would change the call.

  6. Open

    Any vendor disclosing agentic-identity revenue

    First disclosed number defines whether the category is real spend or product naming.

How this is built

How this is built

Public sources only. This edition is the Episode 002 packet (SEC-MARKET-SIG-002 v0.2) plus an August 2026 surface refresh — SentinelOne, SailPoint, identity coverage names, and 2026 capital events — updated August 16, 2026. Not a live feed. Every number links to a source excerpt and its limits.

How editions age

Current prints stay on the scorecard. Older still-true context collapses to Background. Superseded prints leave the card and stay in evidence. Acquired vendors keep their last independent print — we do not rewrite them into the buyer. Refresh is manual: earnings clusters, material closes or raises, and Watch-next falsifiers. Not a weekly news cycle.

Signals we use

SignalExamplesWe treat it as
Infrastructure printsNVIDIA Data Center, Cisco orders, Arista, Dell, VertivSupply and buildout. The lead layer.
We do not. Proof that security budgets will follow.
Hyperscaler capexMicrosoft, Amazon, Alphabet cash investmentDemand for capacity. Market condition, not a vendor score.
We do not. A security-spending forecast.
Security vendor printsFortinet, SentinelOne, CrowdStrike, Rubrik, Varonis, SailPoint, Okta, Palo Alto, CiscoRealized category motion — after stripping acquisitions.
We do not. A boom from one headline growth rate.
Buyer budgetsIANS security-budget growth and share of ITThe best check on whether customers actually spent.
We do not. Vendor guidance dressed up as demand.
Buyer intentETR planned increases, McKinsey AI-use surveysDirection of attention. Useful, early, weak.
We do not. Bookings or a category call.
Capital and M&AWiz, CyberArk, Portkey, Astrix, Symmetry, Cyera, Onyx, LumosWhere incumbents are placing bets.
We do not. Customer spend. A $32B deal is not a demand series.
Forcing eventsDORA, SEC cyber rule, incidents, insurance hygieneReasons spend can move on a different clock than infra.
We do not. A product-revenue print.

How we turn that into a call

  1. 1

    Separate the fact from the story

    Keep the excerpt, date, period, and metric definition. Interpretation sits next to it, not on top of it.

  2. 2

    Do not collapse signal types

    Realized revenue, organic growth, guidance, intent, funding, and acquisitions stay in different buckets.

  3. 3

    Need breadth before a domain call

    One strong print is a card. A domain posture needs more than one company and a reason the motion is not just share shift or M&A.

  4. 4

    Refuse the lag if the window cannot support it

    A stable infra-to-security lag needs two mature buildout impulses and a comparable security response. This window has one mature impulse. That is a no-call, not a guessed number of quarters.

  5. 5

    Action follows exposure, not the composite

    PREPARE only where the account has a matching live motion. A split market is not a license for a broad campaign, and this episode does not authorize RUN.

  6. 6

    Age the edition; do not pretend it is live

    Keep the latest comparable print on the card. Demote still-true context. Leave superseded prints in evidence. Freeze acquired entities. Refresh on earnings, material capital events, and falsifiers — not on a news clock.

Research & evidence

Research & evidence library

Search the Episode 002 packet and the August 2026 surface refresh. Click any row to inspect full attribution.

72 sources

Next edition

Get the next read, or argue with this one

Editions publish when the evidence moves, not on a fixed schedule. Ask to be told when the next one is out and you will get an email when it publishes. There is no form and no signup behind these links — they open a plain message to me.

Corrections and counter-evidence are more useful than agreement. If a print is wrong, a source has been superseded, or a call reads further than the evidence goes, that is worth an email.

Tell me when the next edition publishesSend a correction or a question

Jesse Pike · jesse@keatingpike.com