Cloud Security
Cloud security is a crowded field of platform vendors covering secure access, identity, edge and application security, endpoint and workload protection, exposure management and data resilience. Recent activity centers on securing AI agents and embedding frontier AI models into security products, with Zscaler reporting 25% annual recurring revenue growth for its fiscal year and Netskope beating revenue guidance. The main risks are product vulnerabilities and incidents at vendors themselves, regulatory inquiries, channel concentration, overlapping competition from hyperscalers and large platforms, and export-control and geopolitical constraints disclosed in company filings.
Active institutional funds cut a net $8.8 billion in Q2 2026, versus $42.2 billion in Q1 2026 — an outflow 79% smaller. 50% of companies in this sub-theme saw decreased active positions in Q2 2026.
Overview
Cloud security covers the platforms that protect cloud workloads, APIs and SaaS applications. The category spans several layers, and many vendors compete across more than one. Secure access and web-gateway vendors include Zscaler and Netskope, which compete directly with each other and with Palo Alto Networks, Cisco and Check Point. Network and enterprise security platforms include Palo Alto Networks, Fortinet, Check Point and Cisco. Edge, application and API security is covered by Cloudflare, Akamai, F5 and Radware, which compete in web application firewall, bot detection, API protection and DDoS mitigation. Endpoint and workload protection is led by CrowdStrike and SentinelOne. Vulnerability and exposure management is covered by Tenable, Qualys and Rapid7. Identity security is anchored by Okta, which names Microsoft as its principal competitor and lists Palo Alto Networks, Zscaler, CrowdStrike and Google among its ecosystem partners. Data protection and cyber resilience includes Rubrik, Commvault and AvePoint. JFrog addresses software-supply-chain security within DevOps. Microsoft and Alphabet are both platform partners and competitors. Rubrik's solutions run on Google Cloud and Microsoft Azure, Netskope lists both as technology partners, and Palo Alto Networks and Okta also list Alphabet and Microsoft respectively as competitors. Integrators and services firms such as Accenture and IBM sit alongside the vendors. Sales commonly run through distributors and resellers, with Ingram Micro and Arrow among the named channel partners. Because most products incorporate encryption, the category is structurally subject to export-control and sanctions regimes and to data-protection and operational-resilience rules.
Investment Thesis
Investment thesis details are part of the Pro plan.
Bottleneck Tracker
Bottleneck details are part of the Pro plan.
Key Companies
Related Events
PHP2Shell, two unauthenticated remote code execution flaws in PHP, forced precautionary shutdowns of public-sector sites across the UK and several other countries. The flaws were found with AI tools (OpenAI's GPT-5.6 Sol and Wiz's tooling), and AWS says attackers were exploiting them four days before disclosure. That points to shrinking patch windows and rising demand for emergency patching, web application firewalls and exposure management. Cloud and edge security providers such as Cloudflare and AWS are positioned to benefit from mitigation demand. In the UK, the disruption adds pressure on the Cyber Security and Resilience Bill, which currently leaves central government and councils outside its statutory duties.
EU cloud sovereignty procurement rules represent a durable structural barrier for U.S. hyperscalers in European government and quasi-government markets, potentially worth tens of billions in annual contract revenue. Amazon Web Services, Microsoft Azure, and Google Cloud face exclusion or heavy restrictions in state tender competitions across EU member states. European cloud providers such as OVHcloud, Deutsche Telekom's T-Systems, and SAP gain a structural preference in government procurement. This accelerates the fragmentation of the global cloud market into sovereign blocs, increasing compliance and operational costs for multinational cloud providers. Longer term, it may incentivize U.S. hyperscalers to establish EU-domiciled sovereign cloud subsidiaries as a workaround, increasing capital expenditure requirements.