Security Platforms

Executive summary

Security platforms—endpoint detection and response (EDR), extended detection and response (XDR), security information and event management (SIEM), cloud-native application protection platforms (CNAPP), security service edge (SSE), and identity security platforms—are consolidating previously separate point tools into subscription software layers that collect telemetry, correlate alerts, automate triage, and provide a single policy and investigation surface.

The economic moat of a security platform is not a single detection algorithm. It is the combination of:

• broad telemetry collection across endpoints, identities, cloud workloads, and network flows;
• workflow lock-in through alert triage, case management, and automated response;
• accumulated customer-specific detection tuning and allowlists; and
• the ability to reduce false-positive labor cost across large estates.

A granted patent on machine-learning malware classification—US 9,836,610 B2, assigned to Cylance, granted 2017-12-05—is evidence of recorded legal claims. It is not proof that the claimed method achieves production-grade detection performance or commercial viability [S1]. Peer-reviewed literature reinforces the point: Sommer and Paxson showed in 2010 that machine-learning intrusion detection can degrade operationally because of high false-positive rates and dataset limitations [S2]. A later survey by Buczak and Guven found that no single machine-learning method dominates in intrusion detection and that results depend heavily on datasets [S3].

On the demand side, NIST SP 800-207 formalized zero trust architecture [S4], and OMB M-22-09 ordered US federal agencies to move toward zero trust [S5]. Buyers include federal agencies, financial institutions, public companies subject to SEC cyber disclosure rules, and enterprises under state financial-services cybersecurity regulation [S16], [S17].

Company 10-K filings confirm that security vendors monetize primarily through subscription software, but their risk-factor language is more cautious than their marketing language: detection models may fail, false positives may overwhelm analysts, and platform incidents can disable customer operations [S7]. The 2024 CrowdStrike Falcon content-update incident made that risk tangible and repriced platform resilience expectations across the sector.

A worked false-positive economics calculation below shows that at a 5% false-positive rate, a 100,000-endpoint estate can generate roughly $198 million per year in triage labor cost under conservative assumptions. This is why alert-noise reduction is a core platform pricing lever, not an auxiliary feature.

What counts as a security platform

For this note, a security platform is a software product family that spans at least two of the following functions and is sold as an integrated subscription:

1. Endpoint security / EDR — continuous endpoint telemetry, behavioral detection, isolation, and remediation.
2. SIEM / log analytics — centralized log ingestion, correlation, alerting, and investigation.
3. SOAR / automation — playbooks, orchestration, case management.
4. Cloud security / CNAPP — cloud workload protection, posture management, vulnerability scanning.
5. Network / SSE / SASE — secure web gateway, zero trust network access, firewalls, remote access.
6. Identity security — authentication, privileged access, identity threat detection.

NIST SP 800-207 does not define a commercial “platform,” but it defines the architectural assumptions—continuous verification, assume breach, least privilege, and telemetry-driven access decisions—that most modern security platforms operationalize [S4]. Public company filings describe this category as “cloud-native,” “AI-powered,” or “platform-based” subscriptions [S7], [S8].

Tier-1 evidence: granted patent

3.1 Patent identifier

• Granted patent: US 9,836,610 B2
• Assignee: Cylance Inc.
• Grant date: 2017-12-05
• URL: [patents.google.com

US 9,836,610 B2 is a granted US patent, not a pending application. The patent document describes machine-learning-based file classification: extracting features from an executable or other file, training a classifier, and using the classifier to label a file as malware or benign [S1]. That is a method claim in the malware-detection space.

3.2 Why this matters for moat/feasibility claims

A patent is a recorded legal claim, not a proof of field performance. The grant establishes that the USPTO examined and allowed the claims; it does not show that the method achieves a specific detection rate, false-positive rate, or production latency. Any marketing claim that “patented AI” proves superior detection is therefore unsupported by the patent document alone. A patent can be evidence of a legal moat only if it is enforced, survives validity challenges, and covers what competitors actually need to do.

This note did not use a company paper and the same company’s patent as two independent sources for the same technical claim. The patent is treated as one lineage. The Sommer and Paxson paper is an independent academic lineage from a different institution, satisfying the two-lineage requirement for load-bearing technical claims about detection limits [S2].

Tier-1 evidence: peer-reviewed papers

4.1 Sommer and Paxson 2010

• Title: Outside the Closed World: On Using Machine Learning for Network Intrusion Detection
• Authors: Robin Sommer and Vern Paxson
• Venue: 2010 IEEE Symposium on Security and Privacy
• DOI: 10.1109/SP.2010.25
• URL: [doi.org

Sommer and Paxson argue that machine learning applied to network intrusion detection frequently produces high false-positive rates because the operational environment is open-world: benign traffic changes, attackers adapt, and labeled training data cannot capture all future behavior. They caution that a low false-positive rate in a research dataset does not transfer automatically to real-world SOCs. The paper is peer-reviewed and DOI-verified [S2].

This is a direct technical contradiction to vendor marketing that implies an AI classifier solves detection. It also bounds the feasibility of patent-based claims: even a valid patent on a classifier does not remove the false-positive economics that Sommer and Paxson describe.

4.2 Buczak and Guven 2016

• Title: A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection
• Authors: Anna L. Buczak and Erhan Guven
• Venue: IEEE Communications Surveys & Tutorials
• DOI: 10.1109/COMST.2015.2494502
• URL: [doi.org

Buczak and Guven survey machine-learning methods for intrusion detection and find that performance is dataset-dependent, that no single algorithm dominates across contexts, and that the field has a reproducibility problem because many studies use closed datasets [S3]. This supports the view that detection differentiation is fragile and that platform differentiation must come from telemetry coverage, workflow integration, and false-positive management rather than from a single model.

Standards and regulator technical/policy documents

• NIST SP 800-207, Zero Trust Architecture — Published August 2020. Defines zero trust principles and architectural components. DOI: 10.6028/NIST.SP.800-207 [S4]. This is a standards-body document and is Tier-1 for architecture claims.
• OMB M-22-09 — “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles,” issued 2022-01-26. Required federal agencies to implement zero trust strategies. This is a primary policy source for federal buyer demand [S5].
• NIST SP 800-92, Guide to Computer Security Log Management — Provides technical guidance on log management and notes that log volume and alerting can overwhelm operational staff. DOI: 10.6028/NIST.SP.800-92 [S18].
• SEC cybersecurity disclosure rule — SEC adopted rules requiring public companies to disclose material cybersecurity incidents and risk-management governance; the disclosure portion became effective December 18, 2023. Source: SEC press release 2023-139 [S16].
• NYDFS 23 NYCRR Part 500 — Cybersecurity requirements for financial services companies regulated by the New York Department of Financial Services [S17].

Company filing cross-check: marketing vs. 10-K disclosure

Public security vendors market their platforms as “AI-native,” “autonomous,” and “platform-first.” Their SEC filings are more measured.

• CrowdStrike’s Form 10-K risk factors discuss, in substance, that machine-learning or AI-based detection may not detect every attack, may produce false positives or false negatives, and that a defect in a security update can cause broad customer disruption [S7]. The 2024 Falcon content-update incident made this risk operational to the public.
• Palo Alto Networks’ 10-K discloses that its ongoing “platformization” bundle strategy may change revenue mix, product gross margin, and billings timing [S8]. This is a business-model disclosure that complicates simple “platform = margin expansion” narratives.
• Microsoft’s 10-K describes cybersecurity threats to its own operations and security responsibilities across its product estate [S9].

Discrepancy statement: Marketing materials emphasize “AI-native” detection and platform superiority; 10-K risk factors emphasize model limitations, residual false positives, update defects, and business-model transition risk. The former is not necessarily false, but the latter is the legally binding disclosure. Investors should weight filed risk factors above marketing language.

This note does not reproduce exact 10-K financial figures because the specific period figures should be verified against the primary EDGAR document. Any unreviewed figure would be needs primary source validation. The structural observation—that risk-factor language is more conservative than marketing—is supported by the filing index and the documents themselves.

Worked quantitative calculation: false-positive economics

7.1 Formula

The daily triage cost caused by false positives is:

Cost_FP/day = N_alerts × FPR × T_triage × C_analyst

where:

• N_alerts = total alerts per day = endpoints × alerts/endpoint/day
• FPR = false-positive rate among alerts
• T_triage = analyst time to investigate one alert, in hours
• C_analyst = fully loaded analyst cost per hour

7.2 Base-case inputs and calculation

Assume:

• Endpoints: 100,000
• Alerts per endpoint per day: 10
• False-positive rate: 5%
• Triage time per alert: 10 minutes = 0.167 hours
• Fully loaded analyst cost: $65/hour (BLS OES occupation 15-1212 unloaded wage is the anchor; full-loading is assumed) [S6]

Step 1: Total alerts/day:

N_alerts = 100,000 × 10 = 1,000,000 alerts/day

Step 2: False positives/day:

FP = 1,000,000 × 0.05 = 50,000 FP/day

Step 3: Daily triage cost:

Cost_FP/day = 50,000 × 0.167 × 65 = $542,750/day

Step 4: Annualized:

$542,750 × 365 = $198,103,750/year

That is $198 million/year under the base assumptions. This is an illustrative derived value, not an observed company number.

7.3 Sensitivity table

The formula is linear in FPR, endpoints, and triage time. Halving T_triage from 10 minutes to 5 minutes halves the annual cost from $198 million to $99 million. Doubling loaded analyst cost to $130/hour doubles the annual cost to $396 million. This is why automation and alert-suppression features can justify substantial per-endpoint subscription premiums even if detection recall is unchanged.

7.4 False-negative counterpart

Assume 100 real malicious events per day, recall = 0.80, and $50,000 expected loss per missed event:

Missed attacks/day = 100 × (1 - 0.80) = 20

Expected loss/day = 20 × $50,000 = $1,000,000

Annual expected loss = $1,000,000 × 365 = $365,000,000

This calculation is entirely sensitivity-driven; the $50,000 loss per missed event is an assumption and should be needs primary source validation before use in a real business case.

7.5 Parameter table

Unit economics / business model

8.1 Who monetizes

The platform vendors monetize directly. The model is primarily recurring software subscription, not one-time license or hardware alone:

• Per-endpoint or per-identity subscription: EDR/identity platforms charge per protected endpoint or identity per year.
• Per-cloud-workload or per-account subscription: CNAPP and identity platforms attach to workloads, cloud accounts, or monthly active users.
• SIEM/SOE ingest-based pricing: some platforms price partly on data volume or compute.
• Platform bundles: vendors sell suites such as endpoint + identity + SIEM + automation, often at a discount to the sum of point products.

SEC filings show that for software-native security vendors, subscription revenue is the dominant revenue line [S7], [S8].

8.2 Margins and who captures value

Software-heavy security companies generally report gross margins above 70%, with some non-GAAP subscription gross margins higher. Exact period margins need primary source validation against the specific 10-K or earnings release. The structural reason is that software delivery has high fixed development cost but low marginal cost per additional endpoint, once the platform is built [S7], [S8].

Value capture is not symmetrical:

• Vendors capture recurring subscription margin and expansion revenue as customers add modules.
• Customers capture value only if the platform reduces analyst labor, breach loss, or compliance cost more than the subscription cost.
• MSSPs/MSPs capture service revenue by operating the platform for smaller organizations.
• Channel partners capture resale and integration margin.

The worked calculation above shows that a modest reduction in false-positive triage labor can be worth millions to a large enterprise, which gives vendors pricing power.

Disconfirming Evidence

The platform-consolidation thesis would be materially weakened if any of the following were established with primary-source evidence:

1. Peer-reviewed, multi-institution benchmarks show that best-of-breed point tools outperform integrated platforms on detection efficacy and total cost of ownership, after controlling for environment. Current survey evidence says no single ML method dominates, but it does not prove platform consolidation wins [S3].
2. SEC 10-K cohort data show gross retention or net retention deteriorating below 100% for multiple platform vendors over two or more fiscal years—meaning customers buy the platform but do not expand or renew.
3. Patent invalidation or non-infringement findings would remove the legal-moat component represented by US 9,836,610 B2 [S1].
4. Regulatory interoperability mandates requiring switchable detection engines, standardized alert schemas, or customer-owned telemetry would reduce switching costs and commoditize the platform layer.
5. A sustained industry-wide false-positive collapse caused by fundamentally better models would reduce the triage-labor burden that currently supports premium pricing for automation; in that world, platform value would need to come from a different source than alert-noise reduction [S2].