State of the space · AUG 2026
Cloud Defense Agents
Who is on this map
What this category does
- Detect - flag anomalous cloud runtime activity as it occurs using cloud-native telemetry.
- Investigate - correlate signals against a live model of the customer's cloud environment to reconstruct an attack path.
- Contain - isolate compromised workloads, identities, or cloud resources before lateral movement spreads.
- Model - maintain a continuously updated map of cloud assets, identities, and permissions that grounds detection and response.
The agentic shift
From posture alerts to modeled runtime response
Cloud security work in this category started as posture scanning, checking configuration against known misconfigurations without acting on live traffic. Sysdig extended its Falco-based runtime engine into a dedicated detection and response workflow inside Sysdig Secure, and in 2024 added Sysdig Sage, an assistant that correlates runtime findings for analysts investigating an incident, according to Sysdig's own press materials.
Wiz shipped Wiz Defend in 2024 as a runtime detection and response layer on top of its existing cloud environment model, moving the company from posture assessment into live incident work, per Wiz's product announcement. Sweet Security, Upwind, and Stream.Security each launched as runtime-first cloud detection and response products from founding, built around continuous environment modeling rather than periodic scans.
Vendors in this category largely decline to publish list pricing, instead quoting workload counts, cloud account counts, or consumption volume during procurement conversations, a pattern consistent across Wiz, Sysdig, Sweet Security, Upwind, and Stream.Security. Sysdig has disclosed recurring revenue milestones publicly, including references to its annual recurring revenue growth in company press releases, without publishing a per-unit price list.
Funding activity across the emerging tier signals investor confidence in the consumption model: Sweet Security raised a Series A round in 2024, Upwind raised a Series B round the same year, and Stream.Security closed an earlier funding round, all disclosed in company or press coverage rather than in pricing pages. Every roster vendor this edition anchors its commercial terms to a workload-consumption meter tied to the size of the protected cloud estate.
Sources: wiz.io, sysdig.com, techcrunch.com, upwind.io, stream.securitySources:category analysis,NDR comparison,Vendr
- Workload-consumption pricing - Wiz and Sysdig scale contract value with the number of protected cloud workloads rather than named user seats.
- Pricing not public by default - Sweet Security, Upwind, and Stream.Security route buyers to sales conversations instead of publishing rate cards.
- Funding as traction signal in place of disclosed revenue - Sweet Security and Upwind each cite recent funding rounds as evidence of customer demand rather than publishing customer counts.
This quarter
May - Aug 2026 ·gold = a monetization move· grey = product, market, or capital
PRICING
Procurement data published this year gives the clearest picture yet of how the category actually transacts. Darktrace lists 12 to 22% above Vectra and 8 to 18% above ExtraHop for the same NDR scope, and multi-module bundles routinely close 15 to 30% below list. Since the Thoma Bravo acquisition, buyers report that Darktrace discounts less on small deals and more on the large multi-module ones. The pricing model itself has not moved, and what has changed is how hard buyers push against it.
Source: VendorBenchmark, Vendr
COMPETITIVE WEDGE
A newer group of agentic SOC vendors has started selling directly against this category. Their argument, as they make it, is that detection quality has become similar across vendors and that the valuable work is the triage, investigation, and response after an alert fires. We report that as their sales claim, and we note that it is aimed at work the NDR vendors genuinely perform with AI and do not charge for as a separate item.
Source: market analysis
PLATFORM PRESSURE
At RSAC 2026, CrowdStrike, Cisco, and Palo Alto all released agentic SOC products that take NDR data as input and sell the triage and investigation layer separately. The vendors on this map now share the alert pipeline with platform agents that charge for steps NDR includes in coverage.
Source: VentureBeat
MARKET
The category's center of gravity keeps moving toward the cloud. The younger half of this map detects from cloud telemetry instead of network appliances, and all four established vendors now sell cloud sensors alongside their original deployments. Buying guides published this year treat cloud and OT coverage as standard evaluation criteria instead of extras.
Source: category review
The long arc
2022 to 2026: from posture scanning to modeled runtime response
2021
APPLIANCE PRICING
Darktrace listed on the London Stock Exchange, and Bain Capital took ExtraHop private at about $900 million. The whole category priced by devices, sensors, and bandwidth in those years, largely because that is what security budgets were set up to buy.
2023
AI SCRUTINY
Investors and buyers began questioning what "AI-powered" actually meant across the category, and vendors answered by competing on the quality of their signal instead of the volume of it. Vectra planted its flag on fewer, higher-confidence detections during this period. The pricing models came through the scrutiny untouched.
2024
CONSOLIDATION
Ownership changed hands. Thoma Bravo took Darktrace private for about $5.3 billion, Cisco closed its $28 billion purchase of Splunk, and Corelight raised $150 million to keep building the evidence layer. The new owners tightened the existing coverage model instead of replacing it.
2025
INVESTIGATION DEEPENS
Darktrace bought Cado Security and folded cloud forensics into its autonomous investigation product, while generative assistants for summarizing and investigating alerts spread across the rest of the category. Product autonomy kept increasing while the pricing metrics stayed exactly where they were.
2026
AGENTIC COMPETITION
Autonomous SOC platforms now run triage and investigation on top of NDR signal and sell that layer as a product of its own. NDR pricing, for now, remains coverage-based.
Vendor by vendor
Journalist first, analyst second
The core platform deploys an eBPF sensor alongside cloud API integrations and combines runtime execution data with configuration and inventory context. Documented capability includes asset inventory, misconfiguration findings, vulnerability prioritization based on whether a package is actually loaded at runtime, and identity and permission analysis. The stated purpose of the runtime layer is to reduce the volume of findings that reach analysts rather than to act without them (docs.upwind.io).
Pricing not public. Upwind does not publish list prices, rate cards, or tier prices on its website, and the commercial route is a sales conversation or demo request. There is no published per-seat price, per-workload price, or published minimum commitment that can be verified from primary sources (upwind.io).
Packaging is described publicly in module terms rather than price terms. Product and documentation material presents posture management, vulnerability management, workload and container protection, identity analysis, threat detection and response, and API security as parts of one platform served by a single sensor deployment, which suggests a platform subscription with module scope rather than separately metered point products. Contract length, discount schedules, and ramp terms are not disclosed in any public document reviewed for this edition (docs.upwind.io).
There is no public evidence that Upwind operates a separate meter for automated or agentic activity. Detection, correlation, and prioritization are presented as platform functions included with the subscription, not as consumption units priced per action, per investigation, or per remediation. Any customer-specific pricing structure would need to be confirmed from a quote or order form, which is not public.
Sysdig Sage is the company's generative AI cloud security analyst. It is exposed inside the Sysdig platform interface and works against the platform's own runtime, posture, and vulnerability data, summarizing findings, explaining detected activity, and guiding analysts through investigation steps. Public documentation and company materials describe it as an assistive layer for human analysts rather than an autonomous remediation engine. See sysdig.com and the Sysdig documentation.
Pricing not public. Sysdig does not publish enterprise list prices for Sysdig Secure or for Sysdig Sage on its public website, and commercial terms are handled through sales engagement. Buyers can review the company's commercial pages at sysdig.com, but no rate card, tier price, or per-unit list figure is available in public sources as of the research cutoff.
What is documented publicly is the shape of consumption rather than the price. Sysdig's documentation describes deployment through host and cluster agents and through agentless connections to cloud accounts, which establishes hosts, nodes, containers, and connected cloud accounts as the natural units of measurement for a subscription. Falco remains free and open source under the Cloud Native Computing Foundation, so the paid boundary sits at managed detection content, platform workflows, retention, and support rather than at the detection engine itself.
There is no public evidence that Sysdig Sage carries its own meter, credit pool, or separate price. Public materials present Sage as a capability inside the platform interface that operates on data the customer already sends to Sysdig, which means AI usage is bundled into the underlying platform subscription rather than charged as a distinct consumption line.
Not covered
Past editions
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
About this data
Everything on this page is a synthesis of public information: published reporting, analyst coverage, vendor documentation, and procurement data that anyone can access. We link to those sources throughout. Nothing on this page draws on private or confidential information, and the positions are Monetizely's analysis of that public record, refreshed monthly.