Every few years in security, a category shows up that makes you think: “This market should have never existed.”

The “security data pipeline / data fabric / routing” universe is exactly that. Impressive companies in the space, smart founders, great execution and (thank you Observo!) great exists already. But the fact that there is a market here is the real indictment. This category is nothing more than a gap SIEM vendors left wide open. And the pipelines walked right in.

A Market That Shouldn’t Exist

Let’s be honest: Splunk, Elastic, Sentinel, Exabeam… they all ignored the ingest problem for too long. Cost, routing, shaping, tiering — none of it was solved cleanly. So Cribl et al solved it for them. But here’s the twist. By solving it, they also became the neutral abstraction layer. The thing sitting between customers and their SIEM. That layer is now the switching fabric. It isn’t just “optimize your Splunk bill.”
It’s:

• Reduce SIEM ingestion.
• Store everything in our “cheap” data lake.
• Oh, and here’s some lightweight analytics while you’re here.
• Or how about you go ahead and try out another SIEM? We can easily forward your data to multiple places while you evaluate moving away and then switching in a matter of hours.

That’s the Trojan Horse. You invite it in to help. And suddenly it controls the keys to the castle.

History Is Repeating Itself

We’ve seen this play before:

• UEBA -> first standalone products slowly morphed into adding data stores, analytics, and then became full SIEMs
• SOAR -> got absorbed into SIEM
• Ingest pipelines -> now becoming lakes -> and eventually a SIEM

Cribl already has Cribl Lake. Give it time and it becomes a SIEM-lite. Then a SIEM.

This is the cycle: Start as an add-on -> become indispensable -> become the platform.

We keep acting surprised. But it’s the same movie every time. And again, keep thinking about the switching costs. This layer enables every customer to easily evaluate new solutions and switch over fairly easily.

If You’re Splunk… I mean Cisco…

You’re one of the few players that can still turn this around — if you execute sharply and fast.

Here’s what Splunk must own again:

• Reclaim the ingest pipeline.
• Make cost the advantage, not the penalty.
• Federate search across data lakes natively. (I think you are almost there)
• Make tiering and reduction a first-class feature.
• Kill the routing layer through pure convenience.
• Figure out your real-time story. Crowdstrike is going strong on messaging how fast attackers act these days and a batch approach won’t work anymore.

If Splunk doesn’t own the control plane, Cribl will. And once you lose the control plane, you lose the customer. No matter how good your detection content is. Cisco gives Splunk a rare opportunity: distribution, integration leverage, and a chance to fix what was ignored for too long. But they can’t let another category grow unchecked. Not again.

My Take

Data pipeline products aren’t the problem. They are the symptom.

The problem is the complacency that let the ingest layer drift outside the SIEM in the first place. Because once a neutral fabric handles all your data, the SIEM becomes swappable. The next SIEM won’t start as a SIEM. It will start exactly where Cribl started; as a pipeline (Abstract Security, anyone)? That’s the Trojan Horse.

Over the past weeks, I’ve had a series of conversations across the cybersecurity ecosystem. Founders in early-stage security startups, VC firms exploring new segments, PE groups accelerating roll-ups, MSP leaders navigating change, and friends pushing the boundaries of what AI can do.

Individually, each conversation was fascinating. Taken together, they paint a picture of where the industry is heading — and where the real opportunities are emerging.

1. Network Security Isn’t Dead at All

One of the more surprising conversations was with a founder building something genuinely innovative in network security. For years, many assumed the category had settled — but the reality is that architectures, workloads, and adversaries continue to evolve. Even the DDoS and WAF spaces are not dead. To my surprise when I worked with one of the PEs to look at the space in more detail again.

The lesson: even “mature” markets have seams where real innovation can take hold.

2. The MSP Landscape Is Vast — and Misunderstood

I spoke with a VC firm considering deeper investments in the MSP ecosystem. There’s real opportunity, but also complexity that outsiders often underestimate:

• Segmentation
• Pricing mechanics
• Packaged offerings
• Integrations into broader ecosystems
• and perhaps most importantly, helping MSPs actually sell security

Products don’t win in MSP without empathy for how MSPs operate and make money.

3. PE Roll-Ups Are Accelerating

One PE firm I talked to is running hard at the roll-up opportunity as the first generation of MSP founders, many starting in the late 90s, look to exit. Their playbook is all around optimized processes and joint buying power. While a European firm I am in touch with, is exploring consolidation not just for scale, but under a unified security platform strategy.

Two very different visions, both valid.

4. Connecting Leaders Amplifies Outcomes

A conversation with a European PE group was refreshing — they emphasize connecting portfolio company leaders so they can cross-pollinate learnings.

Having spent the past 18 months deep in my own leadership work (attending school for the past 18 months is a conversation for another day), I’ve become even more convinced that people dynamics are the highest leverage variable in cybersecurity execution. And it’s not just on the level of leadership that is being discussed widely. It’s about the differences in people and their unique styles. Again, a conversation for another day.

5. Building for MSPs Requires Being in Their Shoes

An MSP leader reminded me of a simple truth:

If you don’t understand the day-to-day realities of MSP life, you can’t build for them.

This applies to product, packaging, GTM, support, and everything in between.

6. AI: Beyond the Hype, Toward Real Value

I caught up with a friend who recently joined an AI company, and we talked about emerging approaches that leverage data inside the model and how one can connect their existing data stores to the various models. Love what they are building and I would have thought they were one of the hockey-stick companies, but it turns out, execution in a startup is hard and requires a lot of elbow greese.

The Unifying Thread

Across all these conversations, I keep coming back to one conclusion:

Security is fragmenting and converging at the same time: The biggest opportunities — for vendors, investors, and operators — are in the seams.

Ecosystems matter. Empathy matters. And clarity of execution matters more than ever.

It’s an exciting moment to be building in this industry.

At the Summa Equity Annual Investor Meeting in Oslo, I had the privilege of joining Jacob Frandsen on stage for a conversation about the state of cybersecurity and the broader forces shaping technology companies today. The dialogue revolved around four big questions. Each one central to how investors, founders, and operators should be thinking about the future:

1. Balancing Investing in Innovation vs. Delivering Profitability

“It’s not innovation or profitability. It’s knowing when and how to balance the two engines that drive growth.”

• Innovation as survival – At smaller scale, innovation is paramount and innovation creates the moat that ensures relevance. Without it, companies risk being commoditized.
• Profitability as discipline – Operational excellence, sales efficiency, and cost control are non-negotiable as you scale.
• Two-engine model – Run one engine for profitability, another to push the edge of innovation.
• AI disruption – Both of areas of profitability and innovation are nicely coming together with AI: AI applied in any are of a company are driving profitability, time to market, etc. On the other hand, entire cyber products are being rewritten with AI at the core. Missing the AI wave on either side kills your future relevance.

2. AI and Cyber: Opportunity and Risk

“AI is both a multiplier of capability and a source of new risks. Success comes from knowing when and how to use it.”

• Force multiplier – AI accelerates development, marketing, sales, detection engineering, and lowers barriers for non-experts.
• AI-led attacks – Still emerging, but attackers will adopt quickly — as defenders we must keep pace.
• Security for AI – A number of new challenges we are facing. This will likely grow into its own market, but the fundamentals (data protection, trust, governance) remain the same.

3. Defensible Positions for Emerging Cyber Companies

Especially in the light of large security platforms like Crowdstrike or Microsoft or SentinelOne, how can smaller companies and startups be relevant at all?

“In cybersecurity, defensibility isn’t just about tech.”

• Wedge strategy – Start narrow, with an overlooked market or product gap. For example, the MSP / SMB segment is still significantly underserved but presents a vast opportunity.
• Data gravity – Unique datasets become the backbone of long-term defensibility, especially with AI to mine the data and make it actionable.
• Ecosystem first – Build API-driven integrations that make you indispensable within workflows, rather than standing alone. Modern security organizations that are using one of the large platforms are still using about 20 other products to fill gaps. If those products are integrated into the larger platform it greatly reduces the complexity and ease for the operators. For the security vendors it opens up the opportunity for technology partnerships on the flip side.

4. Europe vs. US: Different Playbooks

“US is about speed and boldness; Europe is about trust and staying power — the opportunity for EU business is bridging both playbooks.”

• Speed vs. trust – US rewards rapid scaling and bold claims; Europe emphasizes trust, compliance, references, and credibility. European customers are rarely early movers on new technologies.
• Market fragmentation – Europe is highly localized; VARs and telcos dominate, with significant regional differences in regulation and go-to-market.
• Talent edge – Europe offers strong technical talent from world-class universities. ETH anyone? 🙂
• Opportunity – EU players can win by leaning into local strength; US entrants will struggle to replicate that quickly in all the markets. Adapting a product to local markets with different languages, different tax codes, cultures, labor laws, data privacy laws, etc. is a lot of work. That is why you see most US companies expand into UKI first and then slowly entering some of the countries in mainland Europe.

Closing Thoughts

The conversation reinforced for me that cybersecurity doesn’t exist in a vacuum. It intersects with innovation cycles, global talent pools, regulatory environments, and the transformative force of AI. Companies that thrive will be those that balance innovation with discipline, embrace ecosystems, and play the long game across diverse markets.

I left the stage energized. Not just by the challenges, but by the opportunities for European companies to seize if we approach them with clarity and conviction.

I had the pleasure to attend the Summa Equity Annual Investor meeting today in Oslo. It was inspiring to hear about companies in the Summa portfolio that are making a real difference. Taking a step back from day-to-day cybersecurity and business conversations, it’s refreshing to dive into themes that truly matter for humanity. At the Annual Investor Meeting in Oslo, Summa’s four investment areas came into sharp focus and they highlight both the scale of the challenges and the opportunities ahead.

Four Themes Shaping the Future

Here are the four themes that Summa invests in and some interesting facts that I gathered during the presentations:

Circularity

• Desalination as a pathway to more clean water
• How little of our waste is recycled, despite mounting pressure on resources
• The ongoing pollution of water, air, and soil and the need to stop it at the source

Sustainable Food

• The world will need ~55% more calories in the near future
• Aquaculture (fish farming) is essential if we want to feed the planet sustainably – there is not enough grass to feed the cows that we’d need to feed the world
• 26% of global greenhouse gas emissions come from the food system

Energy Transition

• Electricity demand is projected to double by 2050
• Outdated grids will struggle to keep up with demand, especially from data centers
• In Europe, electricity price volatility has surged 150% in just four years

Tech-Enabled Resilience

• Cybercrime now costs the global economy more than $10 trillion annually
• Resilience is not optional — from cybersecurity to supply chains, it underpins progress in every other theme

Why It Matters

These themes may sound broad, but they tie directly to the choices we make today. Food, water, energy, and digital resilience are the foundation of a thriving future. Hearing how Summa is approaching them — and backing real companies solving real problems — is both sobering and energizing.

As someone deeply engaged in cybersecurity, it’s eye-opening to connect that work to the bigger picture: resilience, sustainability, and how we ensure humanity thrives well into the future.

Thanks to Summa Equity for hosting such a thought-provoking gathering and for having me speak about cyber security.

Bringing a new product to market is hard—especially for small companies with limited sales resources. While large players can rely on global sales teams, most startups and scale-ups need to be smarter in how they approach their go-to-market (GTM) and route-to-market (RTM) strategies.

Recently, I walked through a set of practical approaches for some of the companies that I work with as an advisor and board member. I wanted to share these lessons more broadly as they might be useful for others as well. These lessons apply broadly to any small technology firm looking to punch above its weight.

Start with Segmentation and ICP Clarity

The first step in any GTM journey is understanding who exactly you are selling to. Segment your market carefully and define your Ideal Customer Profile (ICP). A well-defined ICP keeps you focused and helps you avoid wasting precious time on prospects that aren’t a good fit.

Match the Route-to-Market to Each Segment

Different customer types buy differently. Some may prefer to purchase through a distributor, others via a managed service provider (MSP) or a systems integrator (SI). Aligning your RTM strategy with each ICP segment ensures you meet your buyers where they already are.

Distributors: Give Before You Get

One of the biggest misconceptions startups have is that distributors will automatically champion your product. In reality, distributors expect you to bring them demand first. Show them you can generate business and they’ll start paying attention.

Leverage Technical Partnerships

Forming technical partnerships with larger vendors is often one of the fastest ways to expand reach. These companies already have distribution networks, customer relationships, and market credibility. By integrating or aligning with them, you can ride their coattails into places you couldn’t reach alone.

Ask Your Customers How They Buy

Your existing customers are one of your best sources of intelligence. Ask them:

• Do they prefer working with MSPs? Who do you work with yourself?
• Do they use certain distributors?
• Do they have go-to SIs or VARs?

Not only will you learn more about your market’s buying habits, but customers can often introduce you directly to their providers to short-circuiting months of cold outreach.

Regional VARs: An Untapped Opportunity

Large VARs are tempting, but it’s hard to get their attention. Smaller, regional VARs are usually more receptive, hungry for growth, and open to building mutually beneficial offers. For many startups, these local relationships turn out to be far more productive.

Don’t Rely on Cold Calling Alone

While direct sales will always play some role, scaling purely through cold outreach is rarely sustainable for startups. Partnerships, integrations, and channel leverage amplify your reach, making each sales dollar work harder.

Closing Thoughts

For small companies, success isn’t about brute-forcing your way into the market. It’s about smart leverage. By segmenting effectively, aligning routes-to-market, and building the right partnerships, startups can create multiplier effects that would be impossible through direct selling alone.

The road to market is rarely straight, but with the right GTM strategy, even small players can carve out a strong position in highly competitive industries like cybersecurity.

Yesterday, we brought Security Chat back to Zurich for its sixth edition and it was everything I had hoped for: brilliant talks, a packed room, and the joy of reconnecting with friends old and new. What started back in 2012 as an informal gathering of security enthusiasts has grown into a tradition where community and ideas come together.

This year we had five lightning talks. Each one very different in style, but all equally thought-provoking:

Candid Wüest – Why AI-Powered Malware Won’t Kill You (Yet)

Candid cut through the hype around “AI-driven malware.” He explained the difference between AI-generated malware (just code produced by LLMs) and AI-powered malware (where AI runs inside the malicious code). While there are proof-of-concepts in the wild, protection stacks still hold up. Behavior-based detection and layered defenses remain effective. His takeaway: AI will eventually give attackers new tools, but defenders are not out of the game.

Joshua Rawles – The Global Impact of a Modern Phishing-as-a-Service Operation

Josh gave us an inside look at the booming phishing-as-a-service industry. For as little as $50 a month, criminals can buy turnkey kits that bypass MFA, come with 24/7 “support,” and scale to tens of thousands of victims. His case study on Storm-1167 (“FluorStorm”) showed just how industrialized this has become, with thousands of domains, Telegram bots for real-time stolen credentials, and devastating impact on nonprofits. His message: MFA is necessary but not sufficient; phishing-resistant authentication and faster takedowns are critical.

Barbara Dravec – Drawn to Encrypt: A Visual Trail from OTP to RSA

Barbara brought cryptography to life with a visual storytelling approach. Mapping concepts like one-time pads, pseudo-random generators, and RSA to vivid imagery from the natural world (snakes, owls, octopuses, and more). It was a refreshing, creative reminder that explaining security to non-experts requires more than equations. It sometimes requires narratives that people can connect to.

Advije Rizvani – AI on Wall Street: Smart, Fast… and Surprisingly Fragile

Advije, a PhD student in Liechtenstein, showed how machine learning systems that drive algorithmic trading can be tricked with subtle, temporary data manipulations. A single manipulated data point can cause wrong trades, eroding portfolio performance over time. Her research raises a sobering question: in high-stakes financial markets, how do we know whether losses are due to bad luck, bad models… or deliberate attacks?

Elliott – When Cookies Collide: The Overlooked Attack Vector

Elliott closed the night with a deep dive into cookie tossing, a little-known but powerful web attack. By controlling a subdomain, an attacker can “toss” malicious cookies that hijack authentication flows or manipulate transactions on the parent domain. He walked us through real-world cases and defenses and highlighting how a small misconfiguration can open the door to session hijacking and data theft.

More Than Talks—It’s About Community

What I loved most about Security Chat 6.0 wasn’t just the talks, but the variety of voices and the energy in the room. We had people flying in from London, driving hours through traffic, and carving out time to share ideas. We had job seekers and companies hiring. We had old friends, new connections, and plenty of wine and bagel bites to keep conversations flowing.

A big thank you to our sponsor 1Password for supporting the evening, to the speakers for sharing their insights, and to everyone who showed up to make this community vibrant.

As I said on stage: cybersecurity has given me so much over the years. Events like this are my way of giving back by fostering connection, sparking ideas, and reminding us all that innovation doesn’t happen in isolation.

See you at the next Security Chat – whenever and wherever it may be.

Thanks to everyone who joined the panel at the BlackHat Innovators & Investors Summit — it was a fast, practical session and full of real, repeatable advice. Below I’ve distilled the conversation into the speakers and the most actionable takeaways founders, investors and channel leaders can use.

Who Spoke

• Daniel “DB” Bernard — Chief Business Officer, CrowdStrike
• Matt Berry — Global Field CTO, Cyber, World Wide Technology (WWT)
• Chris Bisnett — Co-founder & CTO, Huntress
• Peter Bryant — Market Analyst, Canalys
• Moderator: Raffael Marty, Operating Advisor

Top-line Thesis

Great product is necessary but not sufficient. If you want scale and durability you must design product, GTM, pricing and operations for the channel — MSPs, VARs, MSSPs, distributors and hyperscaler marketplaces. Get those pieces aligned and the channel becomes your growth engine and a moat.

The Most Important, Actionable Insights

1) Start with real customer evidence — then bring partners in

• Close a first few deals directly and then ask: Who do you buy through? If the customer uses a reseller or integrator, bring that partner into the next conversation.
• A partner introduced by a customer is infinitely more effective than cold outreach.

2) Target, pilot, then scale (regional first)

• Don’t boil the ocean. Pick a geography or vertical where a partner has influence, run an enablement-intensive pilot, close a few joint deals, and let the wins spread organically through the partner organization.
• Grassroots wins (regional proof points) are how startup products get noticed inside large SIs and disti sales orgs.

3) Engineer the product for MSPs and scale

• Some technical must-haves for MSPs: multi-tenancy, frictionless provisioning, usage-based billing, robust reporting, and minimal support overhead (no reboots, simple deployment).
• Build integrations with RMM/PSA tools. Partners won’t adopt tools that don’t fit their stack.

4) Use hyperscaler marketplaces as a growth hack

• AWS/Azure/Google marketplaces are a procurement shortcut — customers can spend cloud credits and close without long vendor approvals. CrowdStrike and others proved this: marketplace adoption accelerated scale dramatically.
• Prioritize marketplace readiness early (billing, security/compliance, packaging).

5) Think of channel margin as external sales / commission

• Yes, margins look worse on paper — but compare to the true CAC of building a direct sales force. That margin buys you reach and reduces acquisition risk (you only pay when a partner sells).
• Measure partner-sourced vs partner-influenced revenue and the CAC of each.

6) Don’t assume distis/VARs will sell without support

• Listing in a distributor catalog is not the finish line. You must: enable, co-market, provide lead flow, run joint sales plays, and sometimes front-end incentives to get sellers focused on your SKU.
• Short-term investment in enablement and marketing is how you get long-term pull-through.

7) Build partner economics and enablement as products

• Provide free (or low-cost) certification, sales playbooks, demo environments, one-click onboarding, and co-branded assets. These reduce time-to-first-deal and lower partner friction.
• Consider usage-based billing to match MSP economics: partners want to align cost with consumed endpoints/services.

8) Decide and double-down on one partner type first

• MSP vs MSSP vs VAR vs SI: each requires a different product shape and GTM. Nail one, then expand. Trying to serve all at once dilutes focus and kills momentum.

9) Invest in partner success and low-touch CSM automation

• With thousands of SMB endpoints, you can’t scale human CSM for every account. Automate onboarding, monitoring, renewal nudges and migration tools — make it easy for MSPs to manage many customers.

10) Metrics you should be tracking from day 1

• Time-to-first-deal with partner (by partner type)
• Partner-sourced pipeline and partner-influenced revenue
• Onboarding time per MSP customer (time-to-live)
• Churn by partner / churn during partner transitions
• Net retention for partner-sourced customers

Practical checklist for founders (do this tomorrow)

1. Pull your top 3 customers and ask: who did you buy through?
2. Pick one partner (regional or niche) and design a 90-day pilot with joint enablement and a measurable close objective.
3. Audit product integration: do you have PSA/RMM connectors? If not, roadmap one.
4. Prepare an AWS/Azure/Google marketplace package (billing, security, description, packaging).
5. Create a partner enablement kit: demo script, short playbook, 1-page technical install guide, and a free certification.
6. Model partner economics as commission vs. CAC — present it to your board/investors as external sales.
7. Instrument partner metrics in your analytics and report them weekly.

Suggested questions to ask a distributor / VAR / SI when exploring partnership

• Who in your organization will sell and who will implement our solution? (names/roles)
• What does success look like in the first 90 days? How many joint opportunities will you target?
• Which 3 vendors do you co-sell with today (and how do we integrate with them)?
• What enablement will you need from us (sales motion, demo environment, pricing, rebates)?
• How will leads/credit/margin be handled if a customer comes direct?

For investors: what to look for in a channel-first startup

• Product designed for the channel: multi-tenancy, RMM/PSA integrations, usage billing.
• Early partner proofs: paying partners or partner-introduced deals, not just distributor listings.
• A go-to-market playbook for partner enablement (documented processes, enablement kits, measurable time-to-first-deal).
• Marketplace strategy and early traction (even if small, momentum matters).

Closing takeaways (what I heard loud and clear)

• The channel is not a shortcut — it’s a discipline. If you commit, build for it, and invest in the partner motion, channel-first companies scale faster and with lower long-term CAC.
• Start with customers, pilot locally with partners, engineer for MSP realities, and use marketplaces to accelerate procurement.
• Win through repeatable partner plays and measurable enablement — wins scale inside partner organizations.

Thanks again to BlackHat for having us and to the panelists to take time out of their busy schedules to impart these very actionable insights.

Who knows, I might just pick up my blogging again at some point. For now, I posted a short leadership related post on my Leadership | Technology | Spirit blog. Check it out.

Well, not one of my normal blog posts, but I hope some of you geeks out there will find this useful anyways. I will definitely use this post as a reference frequently.

I have been using various flavors of UNIX and their command lines from ksh to bash and zsh for over 25 years and there is always something new to learn to make me faster at the jobs I am doing. One tool that I keep using (despite my growing command of Excel), is VIM coupled with UNIX command line tools. It saves me hours and hours of work all the time.

Well, here are some new things I learned and want to remember from the Well, here are some new things I learned and want to remember from the art of command line github repo:

• CTRL-W on the command line deletes the last word
• pgrep to search for processes rather than doing the longer version with awk
• lsof -iTCP -sTCP:LISTEN -P -n processes listening on TCP ports
• Diff two json files: diff <(jq --sort-keys . < file1.json) <(jq --sort-keys . < file2.json) | colordiff | less -R
• I totally forgot about csvkit – brew install csvkit
• • in2csv file1.xls > file1.csv
  • csvstat data.csv
  • csvsql --query "select name from data where age > 30" data.csv > old.csv

I just found some additional command son OSX that I wish I had known earlier:

• ditto copies one or more source files or directories to a destination directory. If the destination directory does not exist it will be created before the first source is copied. If the destination directory already exists then the source directories are merged with the previous contents of the destination.
• pbcopy past data from command line into the clipboard
• qlmanage quick view from the command line

This is a great repo as well for great OSX commands.

Last week I keynoted LogPoint’s customer conference with a talk about how to extract value from security data. Pretty much every company out there has tried to somehow leverage their log data to manage their infrastructure and protect their assets and information. The solution vendors have initially named the space log management and then security information and event management (SIEM). We have then seen new solutions pop up in adjacent spaces with adjacent use-cases; user and entity behavior analytics (UEBA) and security orchestration, automation, and response (SOAR) platforms became add-ons for SIEMs. As of late, extended detection and response (XDR) has been used by some vendors to try and regain some of the lost users that have been getting increasingly frustrated with their SIEM solutions and the cost associated for not the return that was hoped for.

In my keynote I expanded on the logging history (see separate post). I am touching on other areas like big data and open source solutions as well and go back two decades to the origins of log management. In the second section of the talk, I shift to the present to discuss some of the challenges that we face today with managing all of our security data and expand on some of the trends in the security analytics space. In the third section, we focus on the future. What does tomorrow hold in the SIEM / XDR / security data space? What are some of the key features we will see and how does this matter to the user of these approaches.

Enjoy the video and check out the slides below as well: