The platform-versus-best-of-breed debate is usually staged between CrowdStrike, Palo Alto Networks and Microsoft. Big logos, big ARR, big earnings calls. Meanwhile the more decisive version of that fight is running in companies with three-person IT teams. And there, the platform is winning without much argument.

Exhibit A landed Oct 8. CyberFOX, the Tampa vendor behind AutoElevate privileged access and a password manager, acquired Optimize365, which continuously monitors and hardens Microsoft 365 tenants. Terms: Undisclosed. Optimize365 keeps its brand near term, and CyberFOX says it will fold it into its partner program and roadmap over the coming quarters (CyberFOX via GlobeNewswire).

Count the pieces. CyberFOX now sells PAM, password management, AI-powered DNS filtering, ZTNA through Timus Networks, which it bought in June 2026, and M365 posture. All of it after what the company calls a nine-figure growth investment led by Level Equity and Radian Capital in February 2026 (same release). Exact size of that round: not published.

That’s a classic growth-equity playbook. Raise a big check. Buy adjacent tools that the same buyer already purchases through the same channel. Bundle. Cross-sell. Expand margin.

The interesting part is which adjacency they picked.

M365 is the real perimeter for small companies. For a 200-person firm, the tenant is the identity provider, the mail server, the file share and the collaboration layer. Most of the incidents that hurt those firms run through it: a phished session, a forwarding rule nobody noticed, a consent grant to a shady app, MFA quietly disabled during a helpdesk call. Configuration drift is the enemy, and the release leans on exactly that: catch drift, prioritize risky changes, automate the fix.

Pair that with PAM on the endpoint and you get an access story that actually maps to how small businesses get breached. Admin rights on the laptop. Weak settings in the tenant. One vendor watching both. That’s coherent. It isn’t just a shopping list.

Why best-of-breed loses down-market. Best-of-breed assumes someone has time to integrate, tune and correlate. The mid-market doesn’t. The buyer here is often a managed service provider juggling dozens of tenants. They want one portal, one invoice, one partner program and a deploy that takes hours. CyberFOX says as much in its pitch: products that deploy in hours and run with minimal upkeep.

So the enterprise argument flips. At the top of the market, platforms have to prove they’re as good as the specialists. At the bottom, specialists have to prove they’re worth a separate login. Most can’t.

The risk in the roll-up. Bundles built through acquisition carry seams. Four products bought over a year usually means four consoles, four agents and four data models until engineering catches up. The release promises integration “over the coming quarters,” which is honest and also the part to watch. If the M365 signals don’t feed the PAM and access decisions, it’s a catalog, not a platform.

There’s also the Microsoft question. Microsoft keeps pushing more posture and security tooling into its own licensing tiers. Any vendor selling M365 hardening is betting it can be simpler and more MSP-friendly than Microsoft’s own tools. That bet has worked for years. It’s not guaranteed to keep working.

What to ask if you’re an MSP or a lean IT buyer. Does one policy engine see both the endpoint and the tenant? Can a risky tenant change trigger a privilege action on the device, or the reverse? Is multi-tenant management native, or bolted on? What happens to Optimize365 pricing once it’s in the bundle?

The read. Expect more of this. Growth-equity-backed mid-market vendors with a channel motion are the quiet consolidators in cyber right now. The deals are small and usually Undisclosed, so they rarely make headlines. They still decide which tools a huge share of companies actually run.