What's moving in data security
A weekly signal-to-noise pass across the data security category. Product announcements, company signals, analyst commentary, and pricing moves. Editorially curated — not a raw social feed.
What practitioners are saying
What the market is saying — from the source
The most reliable signal about where each vendor is headed comes not from their marketing pages but from what their executives say under oath to investors. We read the transcripts so you don't have to. Below are the signals worth knowing from the most recent reporting cycle.
This came from Satya Nadella on the investor call — not a press release. The AI monitoring use case is real and scaling at a rate that validates Purview's position as the dominant Copilot governance layer. Security Copilot agents now rolling out to all E5 customers, not just E7.
Rubrik is the most improved health story in the category this cycle. $238M FCF is more than any private pure-play DSPM vendor has disclosed generating — ever. The identity business hit 900 customers in one year. Rubrik Agent Cloud for AI agent monitoring is live. This is no longer a backup company with a DSPM module.
Prisma AIRS is the most credible AI security platform launch in recent memory — launched a few quarters ago and already at nine-figure pipeline. Nikesh Arora's framing on the earnings call is worth noting: LLMs require 100% accuracy for security use cases and cannot replace security platforms — they enhance them. This is a vendor CEO publicly setting realistic expectations, which is unusual.
Cyera crossed $100M ARR in June 2025 and was named a Forrester Wave Leader in Q2 2026. The Ryft acquisition in April 2026 — a secure data lake for AI agents — extends the platform into AI agent data infrastructure. Growth is real; the 90x ARR valuation remains the buyer risk. Profitability data still not disclosed.
BigID, Sentra, Immuta, Concentric, Normalyze, and Privacera do not hold earnings calls, do not publish audited financials, and decline to disclose profitability, burn rate, or customer retention data. The most recent financial data for each is their last funding press release. Analyst firms that cover these vendors are subject to the same information vacuum — their ratings reflect vendor briefings and customer interviews, not financial disclosure. VendorAudit's health scores for private vendors reflect this structural uncertainty.
The full picture of Varonis's financial position — disclosed in public SEC filings — is stronger than the Q3 2025 stock reaction suggested. $132M in free cash flow, 20-year operating history, 8,000+ customers, founder-led, near non-GAAP breakeven. The AllTrue.ai acquisition makes Varonis the only vendor that connects AI agent observability to an existing enterprise data access graph. Securities class action from SaaS conversion disclosures remains an overhang.
"2026 is the year we moved from asking chatbots questions to letting agents take actions. That changes everything about how you think about data security."
Cyera's post-conference blog — the most candid vendor assessment of the week — noted that buyers are officially over "death by a thousand cuts" and that one customer said they'd rather wait months for Cyera to build a capability than add another standalone vendor. That's the platform consolidation dynamic playing out in real time on buying decisions.
This section is updated following each major earnings reporting cycle. Public company data is sourced directly from SEC filings and earnings call transcripts. Private vendor data is sourced from press releases, funding announcements, and publicly available investor materials. No vendor has reviewed or approved this analysis. Full methodology →
Editorial signals · Week of 21 April 2026
Analyst and industry commentary
The section below uses Claude + live web search to surface real-time signals.
Treat results as a research starting point, not published VendorAudit analysis.