You are not asked about market structure directly. You are asked why a tool was chosen, why a renewal went badly, or what you would do if a vendor is acquired — and the answers come from here.

The correction worth carrying: both Google/Wiz and Palo Alto/CyberArk are still routinely described as “pending” or “awaiting regulatory approval”. Both have closed. Google's public commitment is that Wiz products continue to work across all major clouds including its competitors' — whether that survives five years of Google Cloud sales incentives is the open question, and it is the one to raise if asked.

One firm's cybersecurity portfolio alone spans Proofpoint, SailPoint, Darktrace, Ping Identity, Sophos, Imprivata and Exabeam — over $60B of enterprise value and roughly $8B of combined revenue. The playbook is roll-up, cost discipline, price increases at renewal, and eventual re-IPO or sale. That is not inherently bad — SailPoint was taken private and returned to public markets — but it predicts a specific pattern: slower innovation, harder renewals, and integration performed by acquisition rather than by engineering. If a tool you depend on is bought by PE, model a renewal price rise.

Commercially, unambiguously yes. Next-generation security ARR growing 33% to $6.33B with record operating margins, while discounting aggressively, is the signature of successful bundling. The vendors are winning this argument.

Technically, partially. Real integration exists where products share a data plane. It is thin where products were merely co-sold. And the buyer's actual trade-off is rarely stated honestly by either side: platforms win on correlation, procurement overhead and total cost; best-of-breed wins on depth and replaceability. The under-priced risk of platformisation is concentration — one vendor relationship, one renewal negotiation with no leverage, one outage surface, and one integration to unpick if you leave.

Meanwhile the fragmentation platforms promise to solve is real and measured: an average of 10.9 consoles per security operations centre, with only 59% of tools pushing data to the SIEM. Note who commissioned that research, though — it was Microsoft, and its conclusion is “unify now”.