AI security's share war: how to read who is gaining ground and who is giving it up

The read: consolidation is deciding the winners

The clearest pattern in this quarter's security reports is not a new product. It is customers moving several jobs onto one vendor. SentinelOne, for example, won a leading aerospace and defense enterprise that is consolidating endpoint, data, cloud and AI security with it.²

That matters for AI workloads because every new model, agent and prompt is another thing to protect, and buyers would rather add it to an existing platform than buy one more tool. SentinelOne's win with Bell Canada for Prompt Security, a product for protecting AI prompts, shows that AI-specific security is already being sold into large accounts.⁵

So the question for investors is less 'who has the best feature' and more 'who is collecting the bundle'. The reports give a fairly direct answer.

Palo Alto Networks: taking share in SASE

The sharpest share-gain number in the data comes from PANW. On its fiscal 2026 fourth-quarter call, Palo Alto Networks said its competitive SASE displacements rose from $200 million to $450 million over 9 months.¹ SASE, short for secure access service edge, is the cloud-delivered bundle of network access and security that replaces older office hardware.

A displacement means a rival's product was pulled out and PANW's put in, so this is share taken, not just market growth. In its 10-K, the company names Cisco Systems and Check Point Software Technologies among its competitors, which tells you whose installed base is in play.^6,7

Two things in the filing help explain why it can keep doing this. The company points to its channel partners' distribution as a moat, meaning resellers and integrators carry its products into accounts it would struggle to reach alone.⁸ And it held gross margin at 70.4% in fiscal 2026 despite supply chain challenges, with product gross margin at 75.1%.⁹ Winning deals without giving up margin is the signature of a share gainer rather than a discounter.

Palo Alto Networks leads our score among the names here, which fits the share story the call describes.¹

Fortinet: the build-it-yourself argument

Fortinet is the counterweight to any simple PANW narrative. On its second-quarter call, the company said it continues to win SASE deals against all of the top SASE competitors.⁴ Both companies cannot be taking every deal, so SASE is a live contest, not a settled one.

Fortinet's pitch is architectural. It says it develops all the key components of its SASE firewall in-house and runs them on a single operating system, FortiOS.¹⁰ It argues this lets it outperform competitors that bought technology through acquisitions and did not build their own.¹¹ In plain terms, Fortinet is betting that one integrated code base beats a stitched-together portfolio.

It also claims a quieter advantage. Fortinet calls itself a leader in OT security, protecting industrial and operational systems, and says it sees no significant competitor focus in that area.¹² A segment with few serious rivals is the kind of position that tends to hold. And the company says it keeps its gross margin policy by adjusting prices monthly based on cost, which shows it is willing to pass costs on rather than trade margin for volume.¹³

Fortinet ranks third in our data, a reminder that a contested SASE market can still support more than one strong position.⁴

CrowdStrike and SentinelOne: expanding from the endpoint outward

The second route to the bundle starts at the endpoint, the laptops and servers where attacks land. Palo Alto Networks' own 10-K lists CrowdStrike Holdings as a competitor, so these platforms are increasingly meeting in the same accounts.¹⁴

CrowdStrike's lever is how it sells. Its FalconFlex motion, which lets customers draw on a pool of spending across modules, drove record flex deal volume, with more than 935 Flex accounts added in the quarter.³ Its NextGen SIEM, the system that gathers and analyses security logs, is already enabled for every customer and switches on with a license entitlement, using first-party data and connecting to other sources.¹⁵

That is a consolidation engine by design: the product is already installed, and adding the next module is a licensing step rather than a new procurement. CrowdStrike ranks second in our data, which lines up with a model built to expand inside existing customers.³

SentinelOne is the challenger on this route. The aerospace and defense consolidation and the Bell Canada Prompt Security win show it competing for exactly the AI security budgets the larger platforms want.^2,5

Zscaler and the crowded middle

Zscaler's 10-K gives the best map of who is under pressure. It names three groups of competitors: legacy on-premises appliance vendors, large networking, cloud service and other vendors, and companies selling point solutions.^16,17,18

Read alongside the share claims, the picture is consistent. Legacy appliances are the installed base that cloud delivery is replacing, and point solutions are what consolidation squeezes when a buyer moves to one platform.^16,18 The group with the most to lose is the vendor that does one thing, in a market where buyers want fewer vendors.

The harder fight is among the platforms themselves. Palo Alto Networks and Fortinet both describe winning in SASE, and both name rivals whose installed base they are going after.^1,4,6 That is where share will actually be decided.

What to watch next

The most useful signal is whether Palo Alto Networks keeps reporting competitive displacements and whether the figure keeps growing from the $450 million it cited.¹ A steady climb would support the view that SASE share is consolidating toward it; a plateau would suggest Fortinet's in-house approach is holding its ground.¹⁰

For CrowdStrike, watch the Flex account adds and whether NextGen SIEM activations turn into paid modules, since that is where the bundle shows up.^3,15 For SentinelOne, the question is whether AI security wins like Prompt Security become repeatable rather than isolated.⁵

The practical way to think about this group: rank each company by how many jobs a customer runs on it, then check whether that count is rising in the next reports. The leaders in our data, Palo Alto Networks, CrowdStrike and Fortinet, each have a different answer to that question, which makes the coming quarters informative rather than predictable.^1,3,10