SIEM/SOAR Valuation: Strategic Analysis & Market Intelligence Report (Q1 2026)

Executive Summary: The Great Bifurcation of 2026

We are currently navigating through the first quarter of 2026, and the valuation landscape for Security Information and Event Management, alongside Security Orchestration, Automation, and Response technologies, has undergone a profound structural transformation. The market has moved definitively beyond the growth at all costs era that defined 2021 and has settled into a new regime characterized by rationalized quality. This phase is defined by a sharp and unforgiving bifurcation in valuation multiples. It is no longer accurate or useful to view the sector as a singular cybersecurity market. Instead, we are observing two distinct asset classes with vastly different investment profiles: AI-Native Platforms and Legacy Transitioners.

Our analysis indicates that while global cybersecurity spending is projected to exceed $522 billion by the end of 2026, driven by a consistent 15% year-over-year growth rate 1, the distribution of this enterprise value is highly concentrated. Premium valuations, specifically those exceeding 20x Enterprise Value to Revenue, are exclusively reserved for platforms that have demonstrated hyperscale efficiency. This elite status is defined by the simultaneous achievement of high revenue growth exceeding 20%, robust free cash flow margins above 30%, and the successful deployment of Agentic AI architectures. CrowdStrike serves as the primary exemplar of this tier, trading at approximately 24.7x EV/Revenue.2

Conversely, the market has been less kind to legacy SIEM providers and vendors that are still in the middle of complex cloud transitions. These entities are trading at significantly compressed multiples, ranging from 1.7x to 5x EV/Revenue.4 This deep discount reflects a growing investor skepticism regarding the durability of on-premise revenue streams and the substantial technical debt associated with retrofitting Generative AI capabilities onto legacy codebases.

The Merger and Acquisition environment has responded to this valuation gap with two distinct deal archetypes. On one hand, we see strategic consolidation driven by private equity firms seeking to combine distressed assets into profitable portfolios, such as Thoma Bravo’s orchestration of the LogRhythm-Exabeam merger. On the other hand, we see capability acquisition by non-traditional buyers seeking data dominance, best illustrated by Mastercard’s acquisition of Recorded Future for $2.65 billion.6

This report provides a comprehensive valuation framework for cybersecurity founders and investors. It analyzes the financial benchmarks, macroeconomic drivers, and competitive dynamics shaping the SIEM and SOAR markets in Q1 2026, offering actionable intelligence for navigating this bifurcated landscape.

Macroeconomic Context & Capital Markets Outlook

Understanding the specific valuations of SIEM and SOAR assets requires framing them within the broader macroeconomic environment of 2026. This environment has stabilized relative to the volatility experienced in 2023 and 2024, yet capital markets remain discerning regarding risk assets.

The “Equilibrium Management” Phase

According to Morgan Stanley’s 2026 Investment Outlook, the U.S. economy has entered a phase described as equilibrium management by central banks. The Federal Reserve is expected to lower interest rates into mid-2026, creating a favorable environment for equity valuations, particularly for long-duration assets like high-growth software.8

The impact on discount rates is significant. As the yield on the U.S. 10-year Treasury declines, the discount rates applied to future cash flows for SaaS companies have compressed. Theoretically, this expands valuation multiples across the board. However, investors have not returned to the indiscriminate buying patterns of the past; capital allocation is strictly meritocratic. Furthermore, a reduction of $129 billion in corporate tax bills through 2026 and 2027 is expected to bolster the free cash flow profiles of profitable tech companies, further incentivizing the market’s shift toward profitability over pure growth.8

The AI Capex Supercycle

A dominant theme for 2026 is the AI Capex Supercycle. Investment banks note that Big Tech is driving unprecedented capital expenditure into AI infrastructure. Microsoft alone spent nearly $50 billion YTD in 2025 on AI data centers, while Meta raised its capex guidance to $64–72 billion.9

This massive infrastructure build-out is a direct driver for the cybersecurity market. Gartner predicts that AI spending will top $2 trillion in 2026, creating a massive new attack surface that requires AI Security Platforms to defend.10 Consequently, companies that position themselves as essential defenders of this AI infrastructure, or securing the AI stack, are decoupling from general software indices. Morgan Stanley analysts note that rising momentum in AI provides long-term catalysts for Cybersecurity, with the market remaining underweight on cyber names relative to core AI enablers.12

The Return of “Animal Spirits” in M&A

Credit markets are signaling a resurgence in deal-making. Morgan Stanley projects M&A volume growth of 20% in 2026, following a 32% recovery in 2025.8 While investment-grade spreads may widen due to heavy debt issuance for AI funding, high-yield markets remain insulated. This provides ample dry powder for private equity leverage.

For the cyber sector, the availability of credit facilitates take-private transactions for undervalued public cyber companies. This dynamic sets a valuation floor for mid-cap SIEM vendors trading below 5x revenue, as they become attractive targets for financial sponsors looking to arbitrage the gap between public market sentiment and private market intrinsic value.8

SIEM & SOAR Market Landscape: Sizing and Segmentation

The market for Security Operations technologies is expanding, but the traditional boundaries between SIEM, SOAR, and XDR are dissolving.

Market Sizing and Growth Projections

The total addressable market for SIEM is experiencing robust double-digit growth, though it is increasingly being redefined as part of broader Threat Detection, Investigation, and Response spending. The core SIEM market is projected to reach $11.3 billion by 2026, growing at a CAGR of 14.5%.13 This growth is driven by compliance mandates, such as SEC rules and GDPR, and the necessity of log retention for forensic analysis.

Broader global spending on cybersecurity products and services is forecast to hit $522 billion in 2026, with a 15% year-over-year growth rate.1 A critical trend within this spending is the shift in purchasing power. Approximately 15% of cybersecurity spending now originates outside the CISO’s office, from departments such as DevOps, Legal, and IT. This segment is growing at a 24% CAGR, outpacing traditional security budgets.1 Founders must essentially value their companies based on their ability to tap into these adjacent budget pools.

Key Growth Vectors for Q1 2026

Data from Gartner and IDC identifies specific sub-segments that are outpacing the general market. Cloud Security is projected to grow at a 25.9% CAGR, making it the fastest of all segments.14 SIEM vendors that effectively market Cloud-Native SIEM or Cloud Detection and Response are capturing this premium.

Managed Security Services are growing at 15.0%, driven largely by the global talent shortage.14 Vendors with strong MSSP multi-tenancy features are seeing higher retention rates. Furthermore, Infrastructure Protection is expected to grow at 13.1% to reach $51.2 billion, fueled by the urgent need to secure AI models and Large Language Models.14

Table 1: 2026 Market Size and Growth Forecasts by Segment

The “Agentic” Shift in SOAR

The standalone SOAR market is effectively being subsumed by Agentic AI. Gartner identifies Multiagent Systems and AI Security Platforms as top trends for 2026.11 Traditional SOAR relied on static playbooks, but 2026 valuations favor Agentic systems where AI agents autonomously plan and execute remediation without pre-defined scripts.15

This shift has profound implications for market positioning. Companies branding themselves as Agentic AI SOC platforms, such as Radiant Security or crowdsourced agents, are viewed as high-growth disruptors. In contrast, playbook-based SOAR is increasingly viewed as legacy technology, commanding lower multiples.15

Public Company Valuation Benchmarks

Public market valuations provide the most transparent data points for establishing valuation baselines. In Q1 2026, the dispersion between top-quartile and bottom-quartile performers is at historic highs.

The Valuation Hierarchy

Investors have segmented the market into distinct tiers based on Platformization and AI-Nativity.

Tier 1: The Platform Kings (20x+ EV/Revenue)

At the very top of the market sits CrowdStrike (CRWD). As of January 2026, CrowdStrike trades at a massive 24.7x EV/Revenue multiple.2 This premium is justified by its successful transition from EDR to a holistic XDR/SIEM platform. The company’s financial metrics are stellar, boasting 22% revenue growth, 75% gross margins, and a “Rule of 40” score of 30% (SaaS specific) but a “Rule of X” score of 82%.3 CrowdStrike’s valuation serves as proof that the market rewards the consolidation of security categories (Endpoint + Identity + SIEM) into a single agent.

Tier 2: The Efficient Growers (10x – 15x EV/Revenue)

Just below the platform kings are the efficient growers. Datadog (DDOG) trades at 14.5x EV/Revenue.17 While primarily an observability player, Datadog’s expansion into Cloud SIEM validates the convergence of IT Ops and SecOps. Similarly, Zscaler (ZS) trades at 12.2x EV/Revenue with 77.8x EV/EBITDA.18 Zscaler’s “Rule of 80” performance, which combines 25% growth and 55% FCF margin, keeps it firmly in the premium tier.

Tier 3: The Challengers & Transitioners (4x – 8x EV/Revenue)

In the middle tier, we find companies like SentinelOne (S), trading at 4.7x EV/Revenue.5 Despite 20% revenue growth and moving toward profitability with a 7% operating margin in Q3 FY26 21, SentinelOne suffers a discount relative to CrowdStrike due to its smaller scale and the market perception of it being a follower in the platform race. Elastic (ESTC) also falls into this category, trading at 4.3x EV/Revenue.22 Elastic is pivoting to “Search AI,” but its legacy open-source background and lower profitability profile (Rule of 40 at 13%) compress its multiple.

Tier 4: Legacy Value (1x – 3x EV/Revenue)

Finally, at the lower end, we have Rapid7 (RPD) trading at 1.7x EV/Revenue.4 With growth slowing to roughly 1% and a negative Rule of 40 performance of -4%, Rapid7 is valued as a distressed asset or potential PE takeout target rather than a growth equity.4

Table 2: Public Company Valuation Multiples (January 2026)

Sources:.2

Benchmark Analysis

Data from the SEG SaaS Index and Bessemer Venture Partners highlights the broader context. The median EV/Revenue for high-performing security companies is 8.9x, significantly higher than the broader SaaS median of 5.6x.26 Retention remains key; companies with Net Revenue Retention above 120% command a median multiple of 11.7x, a 109% premium over peers.26 Additionally, the AI Multiplier is real, as AI-centric companies in the Cloud 100 trade at 24x revenue, versus 19x for non-AI peers.27

M&A Transaction Analysis

The M&A landscape has been defined by private equity seeking to arbitrage the valuation gap between public markets and intrinsic value, and strategic buyers acquiring data capabilities.

The Private Equity Consolidation Wave

Private equity firms, particularly Thoma Bravo and Francisco Partners, have been aggressive consolidators in this space. Darktrace was acquired by Thoma Bravo for $5.3 billion in late 2024. The deal commanded multiples of 8.1x EV/Revenue and 34.2x EV/Adjusted EBITDA.28 Despite some controversy surrounding the company, Darktrace’s high EBITDA margins and AI-native marketing justified a premium valuation relative to legacy peers. Thoma Bravo is betting on operationalizing its ActiveAI platform globally.

In a move indicative of defensive consolidation, Thoma Bravo merged its portfolio company LogRhythm with Exabeam (previously valued at $2.5B).6 Merging LogRhythm’s on-premise install base with Exabeam’s cloud-native UEBA allows the combined entity to compete against hyperscalers like Microsoft Sentinel. This signals that standalone SIEMs increasingly lack the scale to survive independently.30

Additionally, Sumo Logic was taken private by Francisco Partners for $1.7 billion at ~5.6x Revenue.31 This deal effectively established a valuation floor for cloud-native data analytics firms. The 57% premium paid over its unaffected stock price highlights just how much public markets had undervalued the asset relative to private market expectations.

Strategic Acquisitions: Data is the New Perimeter

On the strategic side, Mastercard acquired threat intelligence firm Recorded Future in a landmark $2.65 billion deal.7 The multiple was approximately 6.5x Revenue.33 This deal confirms that threat intelligence and data are becoming critical infrastructure for non-security verticals like FinTech. It validates the Data Layer thesis, which posits that companies owning proprietary data (threat intel) command higher multiples than those that merely process logs.

Furthermore, Palo Alto Networks acquired IBM QRadar SaaS in a $500 million asset purchase.34 This was fundamentally a customer acquisition deal. IBM effectively exited the SaaS SIEM market, conceding to Palo Alto’s Cortex platform. It underscores the death of legacy SIEM and the rising dominance of integrated XDR platforms.

Table 3: Major SIEM/SOAR M&A Transactions (2024-2026)

Valuation Drivers: The “Premium” Framework

To command a Tier 1 valuation in 2026, companies must excel across three specific dimensions.

Financial Efficiency: Rule of 40 vs. Rule of X

Investors have graduated from the simple Rule of 40 (Growth + Margin) to the Rule of X (Growth * Multiplier + FCF), which rewards growth efficiency more aggressively. CrowdStrike’s Rule of X score of 82% is the primary mathematical justification for its 24x multiple.3 Founders must demonstrate that every dollar of burn generates more than a dollar of ARR. For benchmarking, top-quartile SaaS companies in 2025 had a median Rule of 40 of 40%+, while median performers struggled at ~13% (like Elastic).23

The “AI-Native” Architecture

The market penalizes “AI-Washing,” which we define as bolting ChatGPT onto a legacy UI, and rewards “AI-Native” architectures. The highest value accrues to platforms using Agentic AI that can autonomous investigate and remediate threats, effectively replacing Tier 1 SOC analysts.15 Additionally, platforms that act as the system of record for security data (Data Lake) are valued higher than those that merely act as a pane of glass over other tools, due to the concept of Data Gravity.

Platform Consolidation

Single-point solutions are seeing valuation compression. The market favors platforms that unify SIEM + SOAR + EDR + Identity. With 75% of organizations pursuing vendor consolidation, platforms like Palo Alto Networks (Cortex) and CrowdStrike (Falcon) are winning budget share from standalone SIEMs. This structural tailwind supports their premium multiples.38

Competitive Landscape Dynamics

The Hyperscaler Threat

Microsoft and Google have fundamentally altered the economics of the SIEM market. Microsoft Sentinel has commoditized the ingestion layer of SIEM by bundling Sentinel with E5 licenses and Azure consumption. Pure-play vendors can no longer compete on log storage price alone; they must compete on security analytics efficacy.39 Similarly, Google Security Operations (Chronicle), named a Leader in the 2025 Gartner Magic Quadrant, is leveraging its planet-scale search capability to win large enterprise deals, offering speed and scale that on-premise legacy SIEMs cannot match.40

The Pure-Play Counter-Attack

Splunk (Cisco) remains the market share leader but faces the innovator’s dilemma under Cisco’s ownership. Its focus is on Digital Resilience and Observability to expand beyond pure security.41 Meanwhile, Elastic is positioning itself as the “Open” alternative. By emphasizing Search AI and RAG (Retrieval-Augmented Generation) for security contexts, Elastic attempts to undercut hyperscalers on flexibility and cost.42

Strategic Implications for Founders

For cybersecurity founders aiming for a premium exit or valuation in 2026, the following benchmarks are critical.

Operational metrics must be best-in-class. The Growth Rate must exceed 30% YoY to be considered High Growth. Net Revenue Retention must be 120%+, which acts as the floor for premium valuation and proves the land and expand platform thesis.26 Gross Margins must be 75%+; lower margins suggest a service-heavy model or inefficient infrastructure costs.3 Finally, the Rule of 40 must exceed 40%. Ideally, this is balanced as 30% Growth + 10% FCF Margin.

Positioning for 2026 requires moving beyond legacy terminology. Founders should drop SIEM for TDIR or Security Data Fabric, as the term SIEM carries legacy baggage (high cost, low value).13 There is also a massive greenfield opportunity in focusing on Non-Human Identities. With the explosion of AI agents, securing non-human identities is a massive market. Most importantly, you must prove the AI Efficiency Dividend. Don’t just show AI features; show how your AI reduces customer OPEX. This ROI-first sales motion is required in the 2026 budget environment.43

Conclusion

The Q1 2026 SIEM/SOAR market is robust but strictly meritocratic. The rising tide of cybersecurity spending ($522B) is no longer lifting all boats equally. Valuations have decoupled: AI-Native Platforms enjoy a scarcity premium (20x+ Revenue), while Legacy Tools face commoditization pressure (2-4x Revenue).

For founders, the path to value creation lies in navigating this bifurcation. It requires a relentless focus on the Rule of 40, the architectural courage to build Agentic workflows, and the strategic foresight to position not as a tool for analysts, but as an automated platform for business resilience. The window for growth at all costs is closed; the era of efficient, AI-driven scale has begun.

Sources:

• 13 Splunk SIEM Market Data
• 1 Cybersecurity Ventures 2026 Report
• 15 Radiant Security SOAR AI
• 14 Gartner Security Forecast
• 11 Gartner Top Tech Trends 2026
• 9 Aranca IT M&A Report
• 8 Morgan Stanley 2026 Outlook
• 22 Elastic Valuation & Financials
• 5 SentinelOne Valuation & Earnings
• 17 Datadog Valuation
• 4 Rapid7 Valuation
• 6 LogRhythm/Exabeam Merger
• 34 Palo Alto/QRadar Acquisition
• 2 CrowdStrike Valuation & Earnings
• 18 Zscaler Valuation & Earnings
• 26 SEG SaaS Report
• 27 Bessemer Cloud 100
• 28 Darktrace Acquisition
• 31 Sumo Logic Acquisition
• 47 Gartner IT Spending
• 7 Mastercard/Recorded Future Acquisition
• 40 Google SIEM Leadership
• 39 SentinelOne SIEM Landscape

Works cited

1. 2026 Cybersecurity Market Report – Cybercrime Magazine, accessed January 11, 2026, https://cybersecurityventures.com/wp-content/uploads/2023/11/Official2026CybersecurityMarketReport-1-1.pdf
2. CRWD (CrowdStrike Holdings) EV-to-Revenue – GuruFocus, accessed January 11, 2026, https://www.gurufocus.com/term/enterprise-value-to-revenue/CRWD
3. CrowdStrike – Public Comps and Valuation Multiples, accessed January 11, 2026, https://multiples.vc/public-comps/crowdstrike-valuation-multiples
4. Rapid7 – Public Comps and Valuation Multiples, accessed January 11, 2026, https://multiples.vc/public-comps/rapid7-valuation-multiples
5. SentinelOne – Public Comps and Valuation Multiples, accessed January 11, 2026, https://multiples.vc/public-comps/sentinelone-valuation-multiples
6. Thoma Bravo-Owned LogRhythm Announces Merger With Rival …, accessed January 11, 2026, https://www.securityweek.com/thoma-bravo-owned-logrhythm-announces-merger-with-rival-exabeam/
7. Mastercard Buying Recorded Future for $2.65 Billion, accessed January 11, 2026, https://www.channelfutures.com/mergers-acquisitions/mastercard-buying-recorded-future-for-2-65-billion
8. Investment Outlook 2026: U.S. Stock Market to Guide Growth, accessed January 11, 2026, https://www.morganstanley.com/insights/articles/stock-market-investment-outlook-2026
9. IT M&A Deal Trends – Q2,2025 – Aranca, accessed January 11, 2026, https://www.aranca.com/assets/docs/IT_MA_Newsletter_V07.pdf
10. Gartner: AI spending >$2 trillion in 2026 driven by hyperscalers data …, accessed January 11, 2026, https://techblog.comsoc.org/2025/09/17/gartner-ai-spending-to-top-2-trillion-in-2026/
11. Gartner Identifies the Top Strategic Technology Trends for 2026, accessed January 11, 2026, https://www.gartner.com/en/newsroom/press-releases/2025-10-20-gartner-identifies-the-top-strategic-technology-trends-for-2026
12. Cybersecurity risks may be an “overlooked” investment opportunity, accessed January 11, 2026, https://www.investing.com/news/stock-market-news/cybersecurity-risks-may-be-an-overlooked-investment-opportunity–morgan-stanley-4401334
13. SIEM: Security Information & Event Management Explained – Splunk, accessed January 11, 2026, https://www.splunk.com/en_us/blog/learn/siem-security-information-event-management.html
14. Top 10 fastest-growing segments from Gartner’s latest information …, accessed January 11, 2026, https://softwarestrategiesblog.com/2025/01/02/top-10-fastest-growing-segments-from-gartners-latest-information-security-forecast-q4-2024/
15. SOAR Tools: Key Capabilities and 10 Solutions to Know in 2026, accessed January 11, 2026, https://radiantsecurity.ai/learn/soar-tools-key-capabilities-and-10-solutions-to-know-in-2026/
16. CrowdStrike Reports Third Quarter Fiscal Year 2026 Financial Results, accessed January 11, 2026, https://ir.crowdstrike.com/news-releases/news-release-details/crowdstrike-reports-third-quarter-fiscal-year-2026-financial/
17. DDOG (Datadog) EV-to-Revenue – GuruFocus, accessed January 11, 2026, https://www.gurufocus.com/term/enterprise-value-to-revenue/DDOG
18. ZS (Zscaler) EV-to-Revenue – GuruFocus, accessed January 11, 2026, https://www.gurufocus.com/term/enterprise-value-to-revenue/ZS
19. Zscaler – Public Comps and Valuation Multiples, accessed January 11, 2026, https://multiples.vc/public-comps/zscaler-valuation-multiples
20. S (SentinelOne) Enterprise Value – GuruFocus, accessed January 11, 2026, https://www.gurufocus.com/term/enterprise-value/S
21. SentinelOne signals durable growth with $1B FY 2026 revenue …, accessed January 11, 2026, https://seekingalpha.com/news/4528762-sentinelone-signals-durable-growth-with-1b-fy-2026-revenue-outlook-as-cfo-transition-begins
22. ESTC (Elastic NV) EV-to-Revenue – GuruFocus, accessed January 11, 2026, https://www.gurufocus.com/term/enterprise-value-to-revenue/ESTC
23. Elastic – Public Comps and Valuation Multiples, accessed January 11, 2026, https://multiples.vc/public-comps/elastic-valuation-multiples
24. FTNT (Fortinet) EV-to-EBITDA – GuruFocus, accessed January 11, 2026, https://www.gurufocus.com/term/enterprise-value-to-ebitda/FTNT
25. TENB (Tenable Holdings) EV-to-Revenue, accessed January 11, 2026, https://www.gurufocus.com/term/enterprise-value-to-revenue/TENB
26. SEG 2025 Annual SaaS Report – Software Equity Group, accessed January 11, 2026, https://softwareequity.com/research/annual-saas-report
27. The Cloud 100 Benchmarks Report 2025 – Bessemer Venture Partners, accessed January 11, 2026, https://www.bvp.com/atlas/the-cloud-100-benchmarks-report
28. Darktrace to Be Taken Private in $5.3 Billion Sale to Thoma Bravo, accessed January 11, 2026, https://www.securityweek.com/darktrace-to-be-taken-private-in-5-3-billion-sale-to-thoma-bravo/
29. Darktrace agrees £4.3bn sale to US private equity giant, accessed January 11, 2026, https://businesscloud.co.uk/news/darktrace-agrees-4-3bn-sale-to-us-private-equity-giant/
30. Opposites Attract: LogRhythm And Exabeam To Merge – Forrester, accessed January 11, 2026, https://www.forrester.com/blogs/opposites-attract-logrhythm-and-exabeam-to-merge/
31. PE Firm Francisco Partners to Purchase Sumo Logic for $1.7B, accessed January 11, 2026, https://www.bankinfosecurity.com/pe-firm-francisco-partners-to-purchase-sumo-logic-for-17b-a-21161
32. PE Firm Francisco Partners to Take Sumo Logic Private in $1.7B Deal, accessed January 11, 2026, https://www.securityweek.com/pe-firm-francisco-partners-to-take-sumo-logic-private-in-1-7b-deal/
33. Mastercard’s Bet on Recorded Future a Win for Cyber-Threat Intel, accessed January 11, 2026, https://www.darkreading.com/threat-intelligence/mastercard-bet-recorded-future-win-cti
34. Palo Alto closes $500M deal to buy IBM’s QRadar SaaS service, accessed January 11, 2026, https://www.theregister.com/2024/09/04/palo_alto_networks_ibm_qradar/
35. Nikesh Arora on Why Palo Alto Networks Is Buying IBM QRadar, accessed January 11, 2026, https://www.bankinfosecurity.com/nikesh-arora-on-palo-alto-networks-buying-ibm-qradar-a-25281
36. How Much Did Vectra AI Raise? Funding & Key Investors – TexAu, accessed January 11, 2026, https://www.texau.com/profiles/vectra-ai
37. Cybersecurity Valuation Report Q4 2025 – Windsor Drake, accessed January 11, 2026, https://windsordrake.com/cybersecurity-valuation-report/
38. Earnings call transcript: Elastic Q2 2026 beats earnings expectations, accessed January 11, 2026, https://www.investing.com/news/transcripts/earnings-call-transcript-elastic-q2-2026-beats-earnings-expectations-93CH-4371869
39. 10 SIEM Vendors for Advanced Security Monitoring in 2025, accessed January 11, 2026, https://www.sentinelone.com/cybersecurity-101/data-and-ai/siem-vendors/
40. 2025 Gartner® Magic Quadrant™ SIEM report | Google Cloud, accessed January 11, 2026, https://cloud.google.com/security/resources/siem-magic-quadrant-report
41. IDC SIEM Market Share Report – Splunk, accessed January 11, 2026, https://www.splunk.com/en_us/form/idc-siem-market-share-report.html
42. Elastic named a Leader in the IDC MarketScape, accessed January 11, 2026, https://www.elastic.co/blog/elastic-leader-idc-marketscape-2025
43. Predictions 2026: The Race To Trust And Value – Forrester, accessed January 11, 2026, https://www.forrester.com/predictions/
44. LogRhythm, Exabeam Announce Plan To Merge In SIEM … – CRN, accessed January 11, 2026, https://www.crn.com/news/security/2024/logrhythm-exabeam-announce-plan-to-merge-in-siem-consolidation
45. What Does the Merge Between LogRhythm and Exabeam Mean for …, accessed January 11, 2026, https://www.forenova.com/blog/logrhythm-exabeam-merger-key-takeways-for-cisos-and-cios/
46. Zscaler Q1 2026 slides: Revenue growth of 26% drives increased …, accessed January 11, 2026, https://www.investing.com/news/company-news/zscaler-q1-2026-slides-revenue-growth-of-26-drives-increased-fy26-guidance-93CH-4378583
47. Gartner IT forecast 2026: AI drives global IT growth – IT-Branschen, accessed January 11, 2026, https://itbranschen.com/en/gartner-it-forecast-2026-it-spending-ai-growth/