Diego and I are lying on the sofa somewhere in Central Asia. He is relaxing. I am looking at yet another cybersecurity market ranking. Logos, billions, confident positions from first to fifteenth. Amazing. Trailblazer. Great. Of course.
I add up the numbers. They come to $15.3 billion for 2026. In the accompanying text, the entire market is supposed to reach just $7.5 billion by 2034. On the forecast publisher’s website, the same figures have already migrated to 2025–2035 in another table.
Perhaps the authors were counting different segments or mixed up the years. Without a methodology, there is no way to tell, but explaining the discrepancy was their job. As it stands, fifteen companies in this chart have somehow sold twice the size of the future market. Diego seems less impressed than LinkedIn.
What interests me is how readily we share a graphic like this when our own logo sits high enough. Sometimes a calculator is all it takes to break the marketing spell.
Cybersecurity used to tell a simpler story: a threat emerged, a startup developed a defence, found a niche, grew, got acquired or disappeared. Of course, competitors always existed, and not every startup invented a new category. But specialisation at least made it possible to explain what the customer was paying for.
One comparison has stayed with me from those “sweet 2000s”: margins of 20–30% on certain security deals versus 3–5% on fiercely competitive hardware. That is a personal recollection of channel economics, not an established industry average. Vendor, distributor and integrator margins are different things; a discount off list price is not profit.
Still, the appeal of the business is clear. You can charge more for scarce expertise and credible protection than for another almost interchangeable box.
This is where, for me, the extra work of presales begins. A good engineer understands how a solution works. A good presales engineer must also explain why the customer should pay for this particular solution, what it costs to operate and which other purchase will have to wait. Being technically right does not, by itself, unlock a budget.
And budgets are limited. An agent and a firewall may solve different problems while competing for the same money. Eventually, a vendor asks a wonderful question: why keep justifying a standalone product when you could offer the whole package?
Enter homegrown alternatives to adjacent products, startup acquisitions, bundles and ecosystems. Palo Alto Networks calls it platformization: bringing separate tools together on a single platform. Increasingly, I hear Californication: everyone is integrating with everyone, buying each other and promising the customer an exclusive relationship while eyeing the budget next door. Writing this, I feel a little like Hank Moody - just without the old Porsche. Yet.
The customer may genuinely have fewer integration headaches. The vendor gets a larger share of spending, and leaving becomes more expensive for the customer. Both can be true at once.
Big IT companies are expanding into security too. They already have users, clouds, enterprise contracts and sales channels. Why leave the adjacent budget to someone else? Sometimes the result is a strong product. Sometimes it is a promise that will never catch up with the presentation. Fake it till you make it. Sleep. Rave. Repeat.
I think of American Beauty and that familiar obsession with appearing successful. It fits the corporate stage remarkably well.
This year, I started watching stock-market candlesticks and became much less responsive to “amazing.” I began asking more often how a beautiful story turns into revenue, cash flow and company value.
Market capitalisation affects compensation, fundraising and the ability to buy competitors. The Wolf of Wall Street comes to mind as a film about selling the desire to get rich. A compelling story about the future becomes a valuable commodity in its own right.
In AI, the familiar plot has been put on fast-forward. At the top are countless assistants, agents and services making similar promises. Underneath sit capital-intensive models, clouds, chips, data centres and electricity. Building an application may become cheaper, while competing at the frontier of model development takes resources on an entirely different scale.
Cybersecurity and AI are already intertwined in the same cycle: AI helps attack, AI helps defend, and AI itself needs protection. Anthropic describes the use of its models in cyber operations and its efforts to counter that misuse. The markets still have boundaries, but the technology creating new opportunities also expands the attack surface and demand for oversight. The security industry knows this economic logic well.
“Everyone is a programmer now” is a wonderful slogan. Getting a working prototype has become easier. Making it reliable, securing it, maintaining it and finding a paying customer is a separate job. If building an app is easy for you, it is easy for your competitor too.
AI can deliver enormous benefits and still disappoint investors in individual companies. Growing usage guarantees neither high margins nor returns that justify every valuation. Hardware buyers, cloud providers and application developers capture different portions of the cash flow.
Then I read Dario Amodei’s new essay. He warns that within 6–12 months, a more capable swarm of AI agents acting against human intentions could be able to take over the internet with a persistent botnet. That is his risk scenario. But in my head, the corporate prose has already been shortened to: “AI will build a botnet and kill the internet.”
This is where the two stories fully converge. The industry promises a technology that will change everything, then warns that without sufficient oversight it could destroy the infrastructure it runs on. The warnings of catastrophe are getting louder. And the commercial duality is striking: capabilities drive demand for adoption; dangers drive demand for protection and regulation.
Amodei proposes external evaluators embedded in labs, coordination within what Amodei calls “democratic countries” and global agreements. We should scrutinise both the risks and the rules: who will pay for compliance, who gets to evaluate everyone else, and how open will the market remain to new entrants? A sincere concern for safety can coexist with measures that strengthen the market leaders.
Conversations with colleagues in the US, the UK and the EU have left me with the impression that the American market is mostly absorbed in its own reflection, while the rest of us catch the spray. I can speak for those conversations, not for the whole world. Semiconductors, energy, research and demand exist far beyond the United States. Wall Street may set the volume, but it does not make all the music.
So my oversaturation hypothesis is specific: in parts of cybersecurity and AI, there are too many interchangeable offerings relative to customers’ willingness to pay for them separately. That does not mean the world has enough protection or that AI is useless. It means that justifying one more subscription is getting harder.
People will say I am taking too broad a view. Perhaps. The window of my childhood bedroom, on the ninth and top floor, looked out over the endless Kazakh steppe. Where others saw neighbouring windows, a slide, benches and a sandpit - or even their own swimming pool and barbecue grill - I had a horizon.
That does not make me smarter. It just taught me to look beyond my own courtyard.
But these days, before discussing the market’s horizons, I try to add up the numbers. Diego approves, if only because it does not require getting off the sofa.
© 2026 Michaił Domalewski / Naked CyberSec. All rights reserved.