---
title: "The Cybersecurity Decision Matrix: How to Choose Security Platforms Across Every Layer"
description: "Cybersecurity is a stack—not one product. This decision matrix maps 16 security layers, vendor maturity ratings, CI/CD supply-chain controls, and procurement scorecards for founders, operators, and portfolio buyers."
date: 2026-08-10T00:00:00.000Z
tags: ["vc-explainers", "cybersecurity", "investor-education", "portfolio-management", "operator-playbooks"]
source: https://venturecapitaltracker.com/cybersecurity-decision-matrix-how-to-choose-security-platforms
---

# The Cybersecurity Decision Matrix: How to Choose Security Platforms Across Every Layer

> Cybersecurity is a stack—not one product. This decision matrix maps 16 security layers, vendor maturity ratings, CI/CD supply-chain controls, and procurement scorecards for founders, operators, and portfolio buyers.

**Cybersecurity is not one product category.** It is a stack covering the public internet edge, networks, identities, endpoints, applications, cloud infrastructure, Kubernetes, CI/CD pipelines, data, suppliers, detection, and recovery. The best vendor depends on which layers matter most, what technology the company already uses, and whether the organization has the people to operate the tools.

A company can buy market-leading endpoint detection and still be exposed through DNS, an unprotected API, a compromised CI/CD runner, an overprivileged SaaS vendor, or an unsigned container image. Vendor selection should start with an **architectural decision matrix**—not a product demo.

This guide provides:

* A complete map of the major cybersecurity layers
* A maturity framework for evaluating products and vendors
* A comparative vendor decision matrix
* A dedicated CI/CD and software-supply-chain security model
* Pricing and scaling considerations
* Reference architectures for companies at different maturity levels
* A practical procurement scorecard

Portfolio buyers and operators evaluating [cybersecurity funding trends in 2026](/2026-cybersecurity-funding-may-june-2026) will recognize the same pattern: capital flows to the **trust layer** ([Cyera](/startup/cyera) at $12B is one signal)—but buying one category leader does not close gaps between identity, cloud, SaaS, CI/CD, and suppliers.

## Key takeaways

1. **No vendor is best at every layer.** Broad platforms simplify procurement; specialists often provide greater depth.
2. **Coverage is not the same as maturity.** A feature added through acquisition or partner integration may not be operationally equivalent to a mature native product.
3. **The biggest security gaps increasingly sit between products.** Identity, cloud, SaaS, CI/CD, and suppliers often belong to different owners.
4. **Software supply-chain security must cover source code, dependencies, build systems, artifacts, and deployment—not only vulnerability scanning.**
5. **Cybersecurity pricing scales across several dimensions:** employees, devices, workloads, developers, applications, domains, traffic, log volume, and protected data.
6. **Organizations should buy according to risk outcomes, not the number of products included in a vendor bundle.**

## 1. The complete cybersecurity stack

A useful security architecture can be divided into **16 major layers**.

| Layer | What it protects | Typical controls | Common pricing driver |
| --- | --- | --- | --- |
| CDN and edge delivery | Websites and applications | Caching, TLS termination, origin shielding | Traffic, requests, bandwidth |
| DDoS protection | Public services and networks | Volumetric mitigation, rate limiting, scrubbing | Traffic, protected assets |
| DNS security | Domains and user requests | Authoritative DNS, DNS filtering, DNSSEC | Queries, users, domains |
| Firewall and segmentation | Networks and workloads | NGFW, IDS/IPS, microsegmentation | Appliance, throughput, workload |
| WAF and bot protection | Web applications | WAF rules, bot detection, abuse prevention | Requests, applications, traffic |
| API security | APIs and machine interfaces | Discovery, schema validation, runtime detection | APIs, requests, environments |
| Zero trust and SASE | Workforce and branch access | ZTNA, SWG, CASB, FWaaS | Users, sites, bandwidth |
| Identity and privileged access | Human and machine identities | SSO, MFA, PAM, IGA, ITDR | Users, identities, administrators |
| Email and collaboration | Email, chat and file sharing | Anti-phishing, impersonation detection, sandboxing | Mailboxes, users |
| Endpoint and mobile | Laptops, servers and phones | EPP, EDR, XDR, MDM | Devices, servers, users |
| Application security | Source code and applications | SAST, DAST, SCA, secrets and API testing | Developers, repositories, apps |
| CI/CD and supply chain | Build and release systems | Signing, attestations, SBOMs, runner security | Committers, builds, repositories |
| Cloud and Kubernetes | Cloud resources and workloads | CSPM, CWPP, CIEM, KSPM, runtime security | Workloads, resources, cloud accounts |
| Data security | Sensitive and regulated data | DLP, DSPM, encryption, classification | Users, data volume, repositories |
| Detection and response | Security telemetry and incidents | SIEM, SOAR, XDR, MDR | Events, data ingestion, endpoints |
| Resilience and recovery | Business continuity | Immutable backups, recovery testing, IR retainers | Data volume, systems, service tier |

A mature architecture also includes governance, third-party risk, vulnerability management, security awareness, cyber insurance, and incident-response planning.

## 2. Security maturity rating model

This article uses the following maturity scale.

| Rating | Meaning |
| ---: | --- |
| **0** | No meaningful product coverage |
| **1** | Integration, partnership or limited adjacent functionality |
| **2** | Basic capability, narrow use case or relatively immature offering |
| **3** | Credible production capability with normal enterprise limitations |
| **4** | Mature enterprise-grade product with strong integrations and operations |
| **5** | Category-leading capability with deep functionality and proven scale |

The score should reflect product depth, deployment maturity, integration quality, administrative consistency, threat intelligence, enterprise support, reporting and APIs, multi-account management, global availability, operational burden, product velocity, and heterogeneous-environment fit.

A high score does not mean a vendor is automatically the right choice. A technically excellent product may be too expensive or operationally complex for a small team.

## 3. Vendor decision matrix

### Legend

* **5** — category leader
* **4** — mature and highly competitive
* **3** — credible enterprise coverage
* **2** — partial or developing capability
* **1** — primarily integration or adjacent coverage
* **—** — no meaningful native offering

### Platform and infrastructure security

| Vendor | CDN / Edge | DDoS | DNS | Firewall | WAF / Bots | API security | SASE / ZTNA | Cloud / CNAPP | K8s runtime |
| --- | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: |
| **Cloudflare** | 5 | 5 | 5 | 4 | 5 | 4 | 4 | 2 | 2 |
| **Akamai** | 5 | 5 | 5 | 3 | 5 | 5 | 4 | 2 | 2 |
| **Palo Alto Networks** | 2 | 3 | 2 | 5 | 4 | 4 | 5 | 5 | 4 |
| **Fortinet** | 2 | 4 | 3 | 5 | 4 | 3 | 4 | 4 | 3 |
| **Cisco** | 2 | 4 | 5 | 5 | 3 | 3 | 4 | 3 | 3 |
| **Zscaler** | 1 | 2 | 3 | 4 | 3 | 3 | 5 | 3 | 2 |
| **Microsoft** | 3 | 4 | 4 | 4 | 4 | 4 | 4 | 5 | 4 |
| **Google Cloud** | 4 | 5 | 4 | 4 | 5 | 4 | 4 | 5 | 4 |
| **AWS** | 4 | 5 | 4 | 4 | 4 | 4 | 3 | 5 | 4 |
| **Wiz** | — | — | — | 1 | — | 2 | — | 5 | 4 |
| **Orca Security** | — | — | — | 1 | — | 2 | — | 5 | 4 |
| **Sysdig** | — | — | — | 1 | — | 2 | — | 4 | 5 |
| **Aqua Security** | — | — | — | 1 | — | 2 | — | 4 | 5 |

#### Interpretation

**Cloudflare and Akamai** lead at the public internet edge—strongest when primary risks are availability, DDoS, public DNS, WAF, bots, API abuse, and global application delivery.

**Palo Alto Networks, Fortinet, and Cisco** are stronger when the organization needs deep firewalling, network segmentation, branch security, hybrid connectivity, and broader platform consolidation.

**Zscaler** is strongest in cloud-delivered workforce access and security service edge architecture—not a general replacement for every network, endpoint, or cloud workload control.

**Microsoft, AWS, and Google Cloud** become more attractive when the company is heavily standardized on the corresponding ecosystem.

**[Wiz](/startup/wiz)**, Orca, Sysdig, and Aqua should be evaluated as cloud and workload specialists rather than replacements for edge, identity, or endpoint platforms.

### Identity, endpoint and security operations

| Vendor | Identity | PAM / IGA | Email | Endpoint / EDR | XDR | SIEM | SOAR | MDR |
| --- | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: |
| **Microsoft** | 5 | 4 | 5 | 5 | 5 | 5 | 4 | 4 |
| **CrowdStrike** | 4 | 2 | 2 | 5 | 5 | 4 | 3 | 5 |
| **Palo Alto Networks** | 3 | 2 | 2 | 5 | 5 | 5 | 5 | 4 |
| **SentinelOne** | 3 | 1 | 1 | 5 | 5 | 4 | 3 | 4 |
| **Cisco** | 4 | 2 | 4 | 4 | 4 | 5* | 4 | 4 |
| **Fortinet** | 3 | 2 | 4 | 4 | 4 | 4 | 4 | 4 |
| **Okta** | 5 | 4 | — | 1 | 2 | — | 2 | — |
| **CyberArk** | 4 | 5 | — | 2 | 2 | — | 2 | — |
| **SailPoint** | 4 | 5 | — | — | 1 | — | 1 | — |
| **Proofpoint** | 3 | 1 | 5 | 2 | 2 | 2 | 2 | 3 |
| **Mimecast** | 2 | 1 | 5 | 1 | 2 | 2 | 2 | 3 |
| **Huntress** | 3 | 1 | 3 | 4 | 3 | 2 | 2 | 5 |
| **Sophos** | 3 | 1 | 4 | 4 | 4 | 3 | 3 | 5 |

*Cisco's SIEM position includes Splunk.

#### Interpretation

**Microsoft** offers one of the broadest integrated security stacks—correlating signals across identity, devices, email, cloud, productivity services, and SIEM.

**CrowdStrike and SentinelOne** are endpoint-led platforms—especially strong where endpoint detection, threat hunting, and managed response are strategic priorities.

**[Okta](/startup/okta)**, CyberArk, and SailPoint address different identity problems: Okta (workforce and customer authentication), CyberArk (privileged access), SailPoint (identity governance). They overlap but are not interchangeable.

**Proofpoint and Mimecast** remain relevant where email fraud, impersonation, phishing, and human-layer risk demand greater depth than productivity-suite defaults.

**Huntress and Sophos MDR** fit organizations that need an operational service—not simply another alert-generating product.

### Application, CI/CD and supply-chain security

| Vendor | SAST | SCA / Dependencies | Secrets | IaC | Container scanning | SBOM | Signing / Attestation | CI/CD integration |
| --- | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: |
| **GitHub Advanced Security** | 5 | 5 | 5 | 3 | 3 | 4 | 5 | 5 |
| **GitLab Ultimate** | 4 | 4 | 4 | 4 | 4 | 4 | 4 | 5 |
| **Snyk** | 4 | 5 | 4 | 5 | 5 | 4 | 2 | 5 |
| **Veracode** | 5 | 4 | 3 | 3 | 3 | 4 | 1 | 4 |
| **Checkmarx** | 5 | 4 | 4 | 4 | 4 | 4 | 1 | 4 |
| **SonarQube / SonarCloud** | 5 | 2 | 3 | 2 | 1 | 1 | — | 5 |
| **Mend.io** | 3 | 5 | 3 | 3 | 4 | 5 | 2 | 4 |
| **JFrog** | 2 | 5 | 4 | 3 | 5 | 5 | 5 | 5 |
| **Chainguard** | 1 | 4 | 2 | 1 | 5 | 5 | 5 | 4 |
| **Docker** | 1 | 3 | 3 | 1 | 4 | 4 | 4 | 4 |
| **Wiz** | 3 | 4 | 4 | 5 | 5 | 4 | 2 | 4 |
| **Aqua Security** | 3 | 5 | 4 | 5 | 5 | 5 | 4 | 5 |
| **Sysdig** | 2 | 4 | 3 | 4 | 5 | 4 | 3 | 5 |

#### Interpretation

**GitHub Advanced Security** is strongest when GitHub is the development system of record—code scanning, dependency analysis, secret protection, and developer workflow integration. GitHub prices Secret Protection and Code Security by active committers.

**GitLab** offers a highly integrated DevSecOps model—source control, CI/CD, and many security capabilities in one platform.

**Snyk** is particularly strong in developer-friendly dependency, container, and infrastructure-as-code scanning.

**Veracode and Checkmarx** are mature application-security platforms for formal enterprise AppSec programmes.

**Sonar** is highly effective for code quality and static analysis but should not be treated as a complete supply-chain security platform.

**JFrog** matters when artifact management, package governance, container registries, provenance, and release integrity are central.

**Chainguard** focuses on reducing container risk through minimal images, secure build practices, signatures, and software provenance.

## 4. CI/CD security: the layer many companies underestimate

Most security programmes protect production but trust the systems that create production. A compromised CI/CD platform can allow an attacker to steal cloud credentials, modify source code, replace dependencies, inject malicious build steps, alter container images, exfiltrate signing keys, publish poisoned packages, bypass change controls, and deploy directly into production.

A mature software-supply-chain programme must protect **five linked stages**.

### Stage 1: Source-code security

Minimum controls:

* Mandatory multifactor authentication
* Protected branches
* Required pull-request reviews
* CODEOWNERS for sensitive paths
* Signed commits where practical
* Secret scanning with push protection
* SAST on pull requests
* Dependency review
* Restricted administrator permissions
* Audit-log retention
* Verified third-party integrations

The goal is to prevent unauthorized or unsafe changes from entering the trusted codebase.

### Stage 2: Dependency security

Applications inherit risk from open-source packages, container base images, CI/CD actions, plugins, and build tools.

Minimum controls:

* Software composition analysis
* Direct and transitive dependency visibility
* Automated vulnerability notifications
* Dependency pinning
* Lock files committed to source control
* Approved package registries
* Package namespace protection
* Malicious-package detection
* Automated update pull requests
* Licence-policy checks
* Dependency review during pull requests

A vulnerability scanner alone is insufficient. Teams must also defend against dependency confusion, typosquatting, abandoned packages, and compromised maintainers.

### Stage 3: Build-system security

The build environment should be treated as production infrastructure.

Minimum controls:

* Ephemeral and isolated runners
* No long-lived cloud credentials
* OIDC workload identity for cloud access
* Least-privilege pipeline tokens
* Network egress restrictions
* Approved and pinned CI/CD actions
* Separation between pull-request and release workflows
* Protected deployment environments
* Independent approval for sensitive releases
* Centralized pipeline templates
* Build-log retention
* Runner patching and inventory
* Secret redaction
* Detection of unusual pipeline activity

Self-hosted runners require particular care—a runner that processes untrusted code and retains credentials or network access can become a bridge into internal systems.

### Stage 4: Artifact integrity

Organizations should be able to answer: what source produced this artifact; which workflow built it; which dependencies were used; was the build environment trusted; has the artifact changed since build; who approved release?

Minimum controls:

* Generate an SBOM for each release
* Sign packages and container images
* Produce build provenance
* Create artifact attestations
* Store artifacts in controlled registries
* Use immutable tags or digests
* Scan artifacts before promotion
* Separate build from release approval
* Verify signatures before deployment

An SBOM is an inventory, not a security guarantee. It becomes valuable when connected to vulnerability intelligence, ownership, deployment data, and remediation workflows.

### Stage 5: Deployment and runtime enforcement

Security checks should continue after the build.

Minimum controls:

* Admission policies for Kubernetes
* Signature and attestation verification
* Approved registry enforcement
* Prevention of privileged containers
* Restricted Linux capabilities
* Read-only filesystems where possible
* Network policies
* Workload identity
* Runtime threat detection
* Drift detection
* Deployment audit trails
* Automated rollback
* Continuous vulnerability monitoring

The NIST Secure Software Development Framework recommends integrating secure practices into the entire software development lifecycle rather than treating security as a final testing step.

## 5. A practical software-supply-chain maturity model

| Level | Characteristics |
| --- | --- |
| **Level 1 — Reactive** | Manual builds, shared credentials, limited scanning, mutable artifacts |
| **Level 2 — Basic controls** | Protected branches, SAST, SCA, secret scanning, vulnerability alerts |
| **Level 3 — Standardized** | Central pipelines, isolated runners, SBOMs, approved registries, deployment gates |
| **Level 4 — Verified** | Signed artifacts, attestations, OIDC, policy-as-code, admission enforcement |
| **Level 5 — Proven and continuously monitored** | Reproducible or highly controlled builds, strong provenance, runtime verification, automated containment |

Most companies should target **Level 3** as the minimum enterprise baseline. Companies operating critical software, financial systems, healthcare platforms, or widely distributed software products should target Level 4 or Level 5.

## 6. Kubernetes security decision framework

Kubernetes introduces risk across the control plane, worker nodes, workloads, identities, network, configuration, and software supply chain.

### Kubernetes security layers

| Area | Key controls | Common tools |
| --- | --- | --- |
| Cluster posture | CIS checks, RBAC review, control-plane settings | Wiz, Prisma Cloud, Aqua, Sysdig, cloud-native tools |
| Image security | Image scanning, approved registries, minimal images | Trivy, Snyk, JFrog, Aqua, Sysdig, Chainguard |
| Admission control | Block unsafe workloads before deployment | Kyverno, OPA Gatekeeper, cloud-native policy engines |
| Runtime detection | Detect suspicious process and network activity | Falco, Sysdig, Aqua, CrowdStrike, SentinelOne |
| Network security | Namespace and workload segmentation | Cilium, Calico, service meshes, cloud firewalls |
| Secrets | External secret stores, rotation, workload identity | Vault, cloud secret managers, External Secrets |
| Identity | Least-privilege RBAC and workload identity | Cloud IAM, Kubernetes RBAC, identity platforms |
| Supply chain | Signing, SBOMs and attestation verification | Cosign, Sigstore, GitHub, JFrog, Chainguard |
| Observability | Audit logs, metrics, traces and security events | SIEM, cloud logging, Datadog, Splunk, Elastic |
| Recovery | Backups of state and configuration | Velero, storage snapshots, managed backup platforms |

### Minimum Kubernetes baseline

Every production cluster should have:

* Private or tightly restricted control-plane access
* Central identity integration
* Least-privilege RBAC
* Audit logging
* Network policies
* Image scanning
* Admission policies
* Runtime detection
* Managed secrets
* Restricted privileged workloads
* Namespace isolation
* Patch and upgrade ownership
* Backup and recovery testing
* Container signature or provenance validation for critical workloads

## 7. Third-party and supplier security

Third-party access is one of the least visible but most consequential areas of security exposure.

Suppliers may have production credentials, API keys, VPN or zero-trust access, administrative SaaS roles, source-code access, CI/CD permissions, customer-data access, cloud-console access, support accounts, and persistent OAuth tokens.

Only a minority of companies comprehensively map their supplier ecosystem—even though third parties frequently hold credentials and production access.

### Minimum supplier-security controls

* Complete supplier inventory
* Named internal owner for every supplier
* Business purpose and data classification
* Documented system access
* SSO and MFA where supported
* Time-limited privileged access
* Regular access recertification
* Token and credential rotation
* Immediate offboarding
* Breach-notification clauses
* Security requirements in contracts
* Subprocessor transparency
* Evidence of backup and recovery
* Right-to-audit provisions for critical suppliers
* Incident-response coordination
* Exit and data-deletion procedures

Supplier risk should be tiered. A marketing platform with public campaign data should not receive the same diligence as a payroll processor, cloud provider, or production MSP.

## 8. Data security and DSPM

Traditional data-loss prevention focuses on controlling data movement. **Data security posture management (DSPM)** focuses on discovering where sensitive data exists, who can access it, and how it is exposed.

A mature data-security programme should cover structured databases, object storage, data warehouses, SaaS platforms, endpoints, email and collaboration tools, source-code repositories, logs and observability platforms, backups, and AI and analytics systems.

### Key controls

* Data discovery
* Classification and labelling
* Access mapping
* Encryption
* Key management
* Tokenization
* Retention policies
* DLP
* Database activity monitoring
* SaaS posture management
* Data lineage
* Backup isolation
* Regulatory reporting
* AI data-governance controls

Common vendors include Microsoft Purview, Varonis, Netskope, Zscaler, Palo Alto Networks, BigID, Cyera, Sentra, and cloud-native services. [Cyera](/startup/cyera) has become a reference point for AI-era data security and DSPM—see our [June 2026 funding roundup](/2026-cyera-600m-12b-data-security) for context.

The correct product depends on whether the main problem is endpoint data movement, SaaS sharing, cloud data exposure, database monitoring, or governance.

## 9. Pricing: how cybersecurity costs actually scale

Security costs are rarely determined by a single metric.

### Common licensing units

| Category | Typical pricing metric |
| --- | --- |
| Endpoint security | Device, server or workload |
| Identity | User, identity or administrator |
| Email security | Mailbox |
| SASE and zero trust | User, location or bandwidth |
| CDN and DDoS | Requests, traffic, domains and service tier |
| WAF and API security | Applications, APIs, requests or traffic |
| Cloud security | Workloads, resources, accounts or cloud spend |
| Kubernetes security | Nodes, clusters, workloads or containers |
| AppSec | Active developers, committers, repositories or applications |
| SIEM | Data ingestion, retention and compute |
| MDR | Endpoints, users, identities or log volume |
| Data security | Users, repositories, databases or data volume |
| Backup | Protected workload and stored data |

### Why costs expand unexpectedly

**One employee creates multiple billable units.** A single employee may require an identity licence, endpoint licence, email-security licence, zero-trust licence, device-management licence, security-awareness training, and SIEM capacity for generated telemetry.

**Cloud resources grow faster than headcount.** A 300-person technology company may operate thousands of containers, cloud resources, service identities, and ephemeral workloads.

**SIEM volume can become the largest variable cost.** Sending every available log to a premium SIEM may create significant cost without improving detection. Classify telemetry as mandatory security data, operationally useful data, compliance-retention data, or low-value/duplicative data.

**Developer-security pricing can punish broad rollout.** Tools licensed by active developer or committer can become expensive across large engineering organizations. Clarify how bots, contractors, inactive contributors, forks, and shared repositories are counted.

**Acquisitions produce step changes.** An acquisition can add new users, domains, devices, clouds, clusters, applications, repositories, suppliers, logs, and compliance obligations. Portfolio buyers should model pricing at current state, expected organic growth, and acquisition scenarios.

## 10. Recommended architectures by company stage

### Small company: fewer than 100 employees

**Priorities:** identity, endpoints, email, backups, basic cloud posture, external attack surface, incident-response preparation.

**Practical architecture:**

* Microsoft 365 Business Premium or an equivalent integrated stack
* Managed endpoint detection
* Password manager
* Protected and tested backups
* Cloudflare or equivalent DNS, CDN, and WAF
* Security-awareness training
* Managed vulnerability scanning
* External incident-response partner

**Avoid:** building an internal SOC, buying a large SIEM without operators, deploying overlapping point products, or buying complex tools only for compliance appearances.

### Mid-market company: 100–1,000 employees

**Priorities:** centralized identity, managed endpoints, zero-trust access, cloud and SaaS posture, AppSec and CI/CD controls, central detection, supplier governance, tested incident response.

**Practical architecture:**

* Microsoft, Okta, or another identity control plane
* CrowdStrike, Microsoft, SentinelOne, or equivalent endpoint platform
* Cloudflare, Zscaler, Netskope, or Palo Alto for edge and workforce controls
* Wiz, Prisma Cloud, Orca, Sysdig, or Aqua for cloud and containers
* GitHub Advanced Security, GitLab, Snyk, or another AppSec platform
* Managed SIEM or MDR
* Central supplier-access inventory
* Quarterly security scorecard

**Avoid:** sending all logs to the SIEM without a detection strategy, running several endpoint agents with overlapping functions, allowing every engineering team to select unrelated security scanners, or treating an annual penetration test as continuous security.

### Enterprise or multi-company portfolio

**Priorities:** common minimum standards, central reporting, identity federation, segmentation, platform-wide supplier governance, shared detection and response, acquisition onboarding, insurance and lender requirements, exit-readiness evidence.

**Practical architecture:** standardize outcomes rather than forcing every company onto identical tools.

Require every business unit or portfolio company to demonstrate:

* MFA coverage
* Endpoint coverage
* Backup testing
* Critical vulnerability remediation
* External exposure management
* Supplier inventory
* Incident ownership
* Cloud posture
* CI/CD controls
* SBOM and artifact-security capabilities where relevant
* Central security-event reporting
* Insurance and contractual review

Portfolio buyers should treat minimum cybersecurity controls like a covenant: scan them regularly, score them consistently, and report them to leadership. See [emerging manager capital raising](/emerging-manager-capital-raising-2026) for parallel LP diligence patterns on governance scorecards.

## 11. Vendor-selection scorecard

Score each criterion from 1 to 5.

| Criterion | Weight |
| --- | ---: |
| Required security-layer coverage | 20% |
| Product depth | 15% |
| Integration with current architecture | 10% |
| Operational effort | 10% |
| Detection and response quality | 10% |
| Reporting and API quality | 5% |
| Multi-account or portfolio management | 5% |
| Pricing predictability | 10% |
| Vendor viability and roadmap | 5% |
| Implementation and migration risk | 5% |
| Data residency and compliance | 5% |

### Weighted-score formula

```text
Weighted score = Σ(vendor rating × criterion weight)
```

A vendor should also be rejected if it fails a mandatory requirement, regardless of total score.

Examples of mandatory requirements:

* Required data residency
* Kubernetes support
* Private-cloud deployment
* API access
* SSO and role-based administration
* Evidence retention
* Regulatory certification
* Multi-tenant portfolio management
* Integration with the existing SIEM
* Support for required operating systems

## 12. Questions to ask every cybersecurity vendor

### Product

1. Which capabilities are fully native?
2. Which capabilities came through acquisitions?
3. Which depend on third-party integrations?
4. Is there one policy engine and one data model?
5. Can an analyst investigate across products without switching consoles?
6. How quickly are new assets discovered?
7. What happens when an agent or integration stops reporting?

### Pricing

1. What is the exact billable unit?
2. What is the minimum annual commitment?
3. How are contractors, bots, and service identities counted?
4. Are servers and cloud workloads priced separately?
5. What retention is included?
6. What happens when usage exceeds the contract?
7. Which essential capabilities require add-ons?
8. How does an acquisition affect the contract?
9. Are implementation and training included?
10. What is the expected three-year total cost?

### Operations

1. Who investigates alerts?
2. Is the service available 24 hours a day?
3. Can the vendor isolate systems or only recommend action?
4. What response-time commitment is contractual?
5. Can evidence be exported if the contract ends?
6. How are false positives tuned?
7. What internal staff and skills are required?

### Security and assurance

1. How does the vendor secure its own CI/CD system?
2. Does it produce SBOMs for its software?
3. Are releases signed?
4. Is build provenance available?
5. How are critical vulnerabilities disclosed?
6. Which subcontractors process customer data?
7. What is the incident-notification period?
8. How are support and administrative accounts protected?

## 13. Final recommendations

Do not start by asking which vendor has the largest platform.

Start by identifying:

1. Your most important assets
2. Your likely attack paths
3. Your regulatory and contractual obligations
4. Your existing technology ecosystem
5. Your internal operating capacity
6. Your expected growth and acquisition model
7. The layers where failure would create the greatest financial impact

Then decide where consolidation is beneficial and where specialist depth is justified.

A practical strategy is usually:

* **One primary identity platform**
* **One strategic endpoint platform**
* **One edge and zero-trust architecture**
* **One cloud and workload posture layer**
* **One standardized AppSec and CI/CD security approach**
* **One detection and response operating model**
* **One portfolio-wide baseline and reporting structure**

The objective is not to buy the most security products. It is to create a system in which identities are controlled, assets are visible, software is verifiable, data is protected, suspicious activity is detected, and the company can recover when prevention fails.

## Decision summary

| Requirement | Strong candidates |
| --- | --- |
| CDN, DNS, DDoS and WAF | Cloudflare, Akamai, AWS, Google Cloud |
| Enterprise firewalls and segmentation | Palo Alto Networks, Fortinet, Cisco |
| SASE and zero trust | Zscaler, Netskope, Palo Alto Networks, Cloudflare |
| Identity and SSO | Microsoft Entra, Okta, Ping Identity |
| Privileged access | CyberArk, BeyondTrust, Delinea |
| Identity governance | SailPoint, Saviynt, Microsoft |
| Endpoint and XDR | CrowdStrike, Microsoft, SentinelOne, Palo Alto Networks |
| Email security | Proofpoint, Mimecast, Microsoft, Abnormal Security |
| Cloud posture and CNAPP | Wiz, Palo Alto Prisma Cloud, Orca, Microsoft |
| Kubernetes runtime | Sysdig, Aqua, Palo Alto Networks, CrowdStrike |
| Application security | GitHub, GitLab, Snyk, Checkmarx, Veracode |
| Artifact and package security | JFrog, GitHub, GitLab, Chainguard |
| SIEM and analytics | Microsoft Sentinel, Splunk, Google Security Operations, Elastic |
| Managed detection | CrowdStrike, Microsoft partners, Huntress, Sophos, Arctic Wolf |
| Data security and DSPM | Microsoft Purview, Varonis, Cyera, BigID, Netskope |
| Portfolio-wide consolidation | Microsoft, Palo Alto Networks, Cisco, Fortinet |
| Public internet and application edge | Cloudflare, Akamai |
| Developer-centric security | GitHub, GitLab, Snyk |
| Cloud-native workload defence | Wiz, Sysdig, Aqua, Orca |

## Next steps

* [Cybersecurity funding May–June 2026](/2026-cybersecurity-funding-may-june-2026) — where capital is flowing in the trust layer
* [Cyera $600M at $12B](/2026-cyera-600m-12b-data-security) — data security as AI governance
* [AI security trust-layer funding](/2026-ai-security-trust-layer-funding-may-june-2026) — agentic and AI-native controls
* [Directory of funds we cover](/directory) — find investors active in cybersecurity

---

*Editorial note: Vendor maturity ratings are directional assessments intended for initial decision support. Product capabilities, packaging, and prices change frequently. Validate every shortlisted capability through technical testing, contractual review, and current vendor documentation before making a purchasing decision.*

*Educational / indicative. Not procurement or legal advice.*