The hottest take in AI security is that the category is fragmenting. The second-hottest is that it already consolidated. This week’s tape says both, if you stop treating “AI security” as one market.
Start with the stack. On March 11, Google closed the Wiz acquisition — $32 billion, all cash, the largest deal in Google’s history. Wiz keeps its brand and, Google says, will still secure AWS, Azure, Oracle Cloud, and Google Cloud. That is the hyperscaler answer to CNAPP: buy the independent that already sat on every cloud, then wire it to threat intelligence and security operations. Palo Alto’s answer was different and earlier. It closed CyberArk on February 11 and declared identity a platform pillar. CrowdStrike’s answer, printed August 26, is not a trophy logo. It is Falcon attaching. Record $332.8 million of net new ARR. George Kurtz, in the company’s statement: “The Mythos moment translated into mass-market acceptance that AI adoption needs security, and that’s CrowdStrike.” The module machine does not need a new brand when the installed base keeps expanding.
Okta, this week, closed Permiso Security at roughly $200 million and told CNBC it will keep doing tuck-ins rather than “buy some big legacy company just to have more revenue.” That is consolidation at a smaller scale: identity plus threat detection for the identities that now include agents.
Then look at the model layer, where the category is still a mess of names. Alice raised $140 million on August 25 to test and guardrail frontier models. Obsidian raised $85 million on August 4 at $1.1 billion to govern agents inside third-party apps. This week SecurityWeek reported Corma out of stealth with $60 million of seed from Sequoia Capital, Khosla Ventures, and Coatue for a foundation model built for defensive cyber. Those are not the same product. One red-teams the model. One watches the agent in SaaS. One trains a defender model. Buyers will fund all three this year because none of the platforms can claim they already solved “AI security.”
Corma’s pitch is the fragment in a sentence. CEO Alon Pluda, via SecurityWeek: general-purpose models from OpenAI and Anthropic could run end-to-end attacks in tests and failed to defend against the same class of attacks. If that holds, “AI security” is not a SKU on Falcon or Prisma. It is a new model stack. If it does not hold, Corma is a research lab with a venture round.
The platforms know the risk. CrowdStrike’s “Mythos moment” language, from the June quarter through this week’s record print, is an attempt to pull the fragment back in. Google’s Wiz close came with the same three-part pitch: detect threats created by AI, protect AI models, use AI to hunt. Nikesh Arora, on Palo Alto’s June 2 Q3 call, said the latest advancements at the AI frontier had “redefined the shape of the industry for the coming years.” That is a platform CEO telling you the fragment is a feature he intends to absorb.
The pattern is familiar. Cloud security fragmented into CSPM, CWPP, CIEM, then CNAPP ate the acronyms, then Google ate Wiz. Identity is in the middle of that movie: CyberArk inside Palo Alto, Okta still independent, agent identity still a startup land grab. Model security is at the beginning of it.
So: is AI security fragmenting or consolidating? The control planes are consolidating. The new attack surfaces — agents, model jailbreaks, non-human identities in SaaS — are minting specialists faster than the platforms can rename a SKU. That is not a permanent state. It is a window. The window closes when a platform can show AI-security ARR that is not a press-release pipeline. CrowdStrike has not published AIDR as a material ARR line. Okta’s finance team said AI is immaterial to fiscal 2027. Palo Alto’s NGS ARR is a platform number, not an AI-security number. Until one of them prints a real AI-security dollar, the specialists keep raising.
Named companies, two lists. Consolidators: Google/Wiz, Palo Alto/CyberArk, CrowdStrike/Falcon, Okta/Permiso. Fragmenters: Alice, Obsidian, Corma, and whoever ships the next agent-guardrail this fall. If you are allocating, do not pick a side of the slogan. Pick a layer.