Hello everyone,
PHP2Shell, Node2Shell, eMudhra, Brotli Bug etc. Vulnpocalypse: For some customers a non-event (“25,000 servers patched at the push of a button, was over in 10 minutes”), for others pure stress and near-death experience. Actually like the it-sa.
This time, as part of my personal longevity initiative, I was only at the obligatory class reunion for one day. The team sent me to Hall 6 with a list of vendors so that I wouldn’t block the seats at our mini table and get on my colleagues’ nerves (official reason. “We’re splitting up this year”). So please apologize to everyone I didn’t pass by despite being invited.
Overall impression: respect. Outside, cold, lamentations, job cuts, swan songs and farewell tones. Inside, warmer than the freezers of Belgian supermarkets, bass-drowned optimism and blustering salespeople booming, good vibes everywhere. No one seems to be doing badly economically here – especially not Messe Nürnberg.
In principle, as a Cybersec player, you can’t afford not to be there. And the length of the booth also shows very well the true size [of the marketing budget], the equivalent of the Rolex on the wrist, so to speak.
No wonder, AI Visibility + Governance was the focus of many discussions. Cost pressure has been a recurring topic, especially at SOC Services, and is leading to further consolidation. Interestingly, SOC prices have fallen so much that the existing sales concepts for some MSSPs are faltering. 5-digit closing bonuses are difficult when the customer only pays 5-digit sums per year. Pen tests are in high demand, but here, too, the customer gets more and more for the money.
As always, the rich are getting richer, the poor (= German startups and small consulting firms) have poor people to work with.
A few randomly selected observations about some providers, without prioritization:
- QGroup: While the SentinelOne DACH team has shown signs of disintegration in between, QGroup has developed an on-prem solution with former S1 Field CTO Jan Tietze. It seems to be well received not only in this country, but also by customers in the Middle East, who are also more willing to pay for digital sovereignty than the median of German buyers. There is no breach warranty, but there is cyber insurance without risk assessment via the partner DUAL if the MDR service is booked
- Devity: Startup for certificate-based OT/IoT device identity lifecycle-Mgmt. from Paderborn. Approx. 15 employees and also 15 customers, including the BMG. The PKI currently still comes from third-party providers / OSS, but a separate CA is on the roadmap. Interesting use case: Replacement of Secure Remote Access Gateways
- Jamorie: Small consulting especially on detection engineering, control maintenance and SIEM/SOAR optimization
- Enclaive: Remote attestation, vHSM and everything else you need to use the confidential computing function in standard processor architectures. => Exciting: This makes it possible to use the American hyperscalers and AI frontier models even for the most sensitive patient or government data. Similar provider (Opaque) has just been acquired by Anthropic
Speaking of which: Anthropic has replaced Git with its own version control system (Scion), which is designed for machine speed. The 25 million code downloads and 30,000 changes per day to the Claude codebase are simply too much. Microsoft wants to part with a quarter of the workforce. Somehow, these two reports impressed me more because of their concreteness and dimensions than some of the media noise of the last few weeks.
So far, I have ducked away from the topic of PQC migration , and I was probably not alone in this. NIST now provides a guideline for this. We all have the problem that data that is now believed to be secure can be stolen by attackers and later read out with quantum computers (“harvest now, decrypt later“).
What are the concrete to-dos that can be implemented today and do not cost a fortune? Without any claim to academic correctness:
- Implementation of
- TLS 1.3 (Perfect Forward Secrecy)
- AES-256 or higher
- SHA-256, SHA-3 or higher
- For self-operated PKI: Migration plan for HSM, TPM, code signing appliances, etc., ideally as part of the usual hardware update cycles. If you are with Digicert, Sectigo, etc., you usually don’t have to worry about anything for the time being.
- For new SW purchases: Include as a criterion that crypto algos are configurable (and not hardwired) or PQC has already been taken into account
- All of this has the advantage that it also works without having a clue about Shor’s algorithm, Module-Lattice Key Exchange, Entanglement Nodes or the actual schedule of Quantum Computing. In Consultant Speak: No Regret Moves
If you have a different opinion and/or already have practical experience in the changeover, please let us know.
Fluctuations of +/- 10% in one day are now quite normal for stocks, but when F5 suddenly rushes down 20%, it is noticeable. So let’s take a quick look at the books:
- Revenue ~3.4 billion USD/a, thus on a par with ZScaler, Okta or now Proofpoint incl. Varonis (see below). At about 2 billion, the pure security business is about the same size as Trend Micro and significantly larger than e.g. Tenable
- Approx. 11% growth compared to 2025. For 2027, however, only 8-9% growth is expected, inventories have already risen drastically, so sales are slowing down
- Of course, the WAF/WAAP help against AI threats and are also becoming increasingly important
- Like all firewall manufacturers, highly profitable: Free cash flow even after deducting stock-based compensation of ~560 million USD, i.e. approx. 15% of sales. Net profit ~700 million
- Market capitalization now ~19 billion, i.e. roughly 6x sales. To maintain the share price, 1.5 billion will be released for share buybacks
- Marketing and sales: 29% of sales. This is actually quite efficient compared to others 😉. More people are to be hired in the security area
Many of us know Ross Haleliuk (Ventures in Security) – his book “Cyber for Builders” is now available for free as a pdf. Easy + easy to read, all in all, of course, shaped by the US market. If you have subscribed to the newsletter, you can skim through a lot of things or smile about it again (“Most security products want to become a single pane of glass, but instead they end up a single glass of pain”).
And finally: Detailed forensics report by Stoik (cyber insurance) on ClickFix attack with Akira ransomware. Takeaways: App Control, check free fields in AD attributes for credentials, disable xp_cmdshell on SQL servers, restrict users with VM creation rights. In principle , hardening, hardening, hardening.
M&A:
- Proofpoint buys Varonis for ~6 billion USD, about 50% premium on the price before the announcement. This makes it a top 10 security player in terms of revenue (> 3 billion USD) and the main competitor to Microsoft and Cyera in the DSPM/DLP market. Quote from market competitors: “Good for us, they’ve been busy with themselves for a year now”. In general, data classification is still a task that no one (really absolutely nobody) wants to do, and which will hopefully soon be satisfactorily automated
- Upwind (CNAPP) will receive another $400 million at a valuation of $3.8 billion. Revenue is said to have quadrupled in the last 12 months
- Botguard (“Blackwall” WAF/DDoS/Botnet-Protection from Estonia) raises USD 100 million and is valued at USD 2.2 billion. This certainly makes it one of the most valuable cybersec companies in the EU
- One of the most exciting tasks I know: &Truth receives 70 million euros for formal software protection using mathematical proofs. If this works, vulnerabilities in the code base can be systematically excluded and features can also be proven (“Specification Factory”). That would probably be the end of some other cybersecurity providers
- Workday (HR Software) buys C1.AI (IGA from USA)
- Protectt.ai invests in AIShield (Bosch startup from India for AI security tests, guardrails, runtime protection)
- Infisical (PAM for agents) gets 40 million from VCs at a valuation of 600 million
- SentinelOne raises USD 1.25 billion in bonds, Sophos 200 million.
- Harmonic (Secure AI Agents based on SLM, from the UK) receives another USD 50 million
Notes from vendor conversations:
HackerOne (Update):
- Of course, in the eye of the storm as far as vulnerability tsunami and bug bounty AI slop are concerned
- ~500 employees, ~1300 customers, including Beiersdorf, Lufthansa, IKEA, SIX, Helvetia
- Interesting: Headquarters and all data centers in the USA, but still KRITIS and e.g. EUDI Wallet as customers
- In the meantime, only validated submissions are accepted (with PoC and taking realistic security measures into account). With good submissions, the reputation score => This then invites you to lucrative challenges.
- Nevertheless, an estimated 70-80% of the submissions are not usable. In order to relieve customers of the burden of evaluation, a triage service is offered for this purpose
- Also deliver code improvements and provide Agentic Pentesting as a supplement
- If you’re looking for a side hustle: Out of ~100,000 active bounty hunters, 7 have already earned more than US$ 1 million this year. Significantly better rate than Spotify or as a conference CISO.
Novastor:
- Backup & Recovery from Switzerland with a major subsidiary in – attention – HAMBURG! They still exist, the good things in life. Owner-managed, ~200 employees worldwide
- Interestingly, it emerged about 25 years ago from a spin-off of Deutsche Telekom
- ~1000 customers, many of them medical practices or the like via system houses and MSSP, but also about 200 medium-sized customers such as municipal utilities or hospitals. German customers then have the German company as a contractual partner
- German development + technical support, all hosted in D
- Recovery tests and documentation are probably selling like sliced bread at the moment
- Connectors for common source and target systems. Experience with securing large amounts of data and energy-efficient architecture, also with tapes
- Also attractively priced – so definitely worth a look
Â
Suit (Tutao):
- Freemail from Hanover (10 million private customers), but now also ~10k SMEs (e.g. medical practices, tax offices) for business packages (mail, calendar, file storage, integration with Nextcloud)
- The whole thing with just 50 employees (hats off), all servers in Lower Saxony
- Interesting use case: Selected group of employees (e.g. management, admins) receive their own subdomain
- PQC E2E encryption, provider has no access to data. In-house development based on PGP, unfortunately not yet compatible with S/MIME (on roadmap, I was told – also because of foreseeable demand that authorities / companies must digitally sign all mails) => Currently, password must be exchanged with external recipients
As always, nothing here is AI-generated. Questions, suggestions, comments, experience reports, topic requests and also opposing opinions or corrections are welcome by email. Ditto for unsubscribing from the mailing list.
For the people who have received the market commentary for the first time: Here you can register if you are interested or defrost the archive.
Best regards,
Jannis Stemmann
