Founder, Software Analyst Cyber Research | Tweets on Cybersecurity & AI/ML | Catholic. Distance Runner. | Ex Cyber Research | Ex AI PM.
🍁 || Toronto & NYC
Joined September 2020
- Tweets12K
- Following1K
- Followers34.2K
- Likes22.3K
Pinned Tweet
This #DataPrivacyWeek, we published our SACR Cybersecurity Outlook for 2026.
After a “wait and see” 2024, the market reopened in force in 2025 with $96B in M&A across 400 deals, driven by platform consolidation and AI-first security bets.
2026 is gearing up for a reset that will define platforms vs point solutions.
Here’s how SACR sees 2026 taking shape across six critical areas:
1/ Identity reset for humans, machines, AI agents
2/ Security shifts from models to agents
3/ Cloud security moves to runtime
4/ AI reshapes AppSec and exposure management
5/ SOC evolves from alerts to decisions
6/ Cyber resilience becomes operational
We write more in the report below. At SACR, this is where our research is headed next. Security that operates at machine speed, while SOC, identity and data are treated as first-class controls.
We’re already seeing early execution signals across identity, cloud runtime, data security, and SOC platforms. Some of the top cybersecurity companies shaping these shifts include: @PaloAltoNtwks, @CrowdStrike, @Microsoft, @wiz_io, @okta, @zscaler, @cribl_io, @SecuritiAI, @cyera_io, @orcasec, and @SentinelOne
There are many other additional vendors, and we will highlight them as our 2026 research coverage expands across each domain.
**
Read more from our publication here 👉 softwareanalyst.substack.com…
Francis retweeted
In April 2017, robinhood:0x86923f96303d656e4aa86d9d42d1e57ad2023fdc was worth $14B.
On Monday, it crossed $1 trillion for the first time.
It is now the fourth US chipmaker worth over $1T, alongside Nvidia, Broadcom and Micron.
Here is how far each has come since April 2017:
▪️ solana:4aG547Y9PPAgpd8dQEMn8n87oVtFYPAP6vhqEYDHmoon : $64B to ~$5T
▪️ $AVGO.NE : $88B to ~$2T
▪️ $MU.NE : Technology: $32B to ~$1T
▪️ robinhood:0x86923f96303d656e4aa86d9d42d1e57ad2023fdc : $14B to ~$1T
And each of these address a different AI bottleneck:
➡️ NVIDIA: GPUs for model training
➡️ Broadcom: custom accelerators and networking
➡️ Micron: high-bandwidth memory
➡️ AMD: the agent era, which has put CPUs back in the conversation
What is driving the move for AMD?
It’s AI agents boosting demand for CPUs.
Unlike the model training era, which was GPU-heavy, AI Agents require significantly more CPUs per GPU when executing workflows.
Last week, Intel CEO Lip-Bu Tan said Intel can meet only about half of customer demand for CPUs.
Who do you think joins the trillion-dollar club next?
#Semiconductors #CPUs #AIInfrastructure
video credits: @InvestingVisual
Francis retweeted
Everyone is debating open vs. closed AI.
Hardware investors should be asking a different question.
Who benefits from each?
First, what's the difference?
▪️ Closed models keep their weights private.
You access them through an API and pay per token.
Examples include Anthropic, OpenAI.
▪️Open models publish their weights.
Anyone can download, fine-tune, and run them.
Examples include Llama, DeepSeek, Kimi, and Mistral.
The tradeoffs go beyond technology.
Open models make AI cheaper and more accessible.
They reduce vendor lock-in and give developers and enterprises an alternative to a handful of providers.
Closed models concentrate the most advanced AI capabilities within a few companies.
That enables those labs to earn attractive returns and continue pushing the frontier.
But it also concentrates critical AI infrastructure, making resilience and cybersecurity increasingly important.
So who wins?
Nvidia benefits from open models.
Every new open model creates more developers, more applications, and more demand for GPUs.
The rest of the hardware ecosystem is more nuanced.
As frontier models scale, workloads are likely to go to custom silicon and Nvidia alternatives (AMD, Trainium).
That creates opportunities for ASICs, networking, optics, and semiconductor equipment companies.
Open expands the market.
Closed broadens the set of hardware beneficiaries.
Francis retweeted
I’ll be teaching alongside Lawrence Pingree, Head of Research, a legend and his expertise in bringing together market research, frameworks for analyzing markets, and practical insights into cybersecurity leadership. This bootcamp is designed for CISOs, security leaders, investors, founders, and cybersecurity professionals who want a clear, strategic, and practical understanding of where AI and cybersecurity are heading. Registrations open today!
You can register on Maven.com: maven.com/cybersecuritybootc…
*** PS: We are offering a 20% discount for early bird pricing within the first week. DM me for more details!! #Cybersecurity #AI #CyberLeadership #CISO #SecurityLeaders #CyberSecurityTraining #AI
🚨 Big announcement from our team today. Registrations are officially open for our AI Cybersecurity Bootcamp for Cyber Leaders 2026!
This is personal for me because since I started SACR, the bootcamp has always been at the foundation of everything.
This year is very different. Cybersecurity is entering a new era.
AI is changing how attackers operate, how defenders respond, how security teams scale, and how cyber leaders need to think about risk, architecture, tooling, and strategy.
That is why we are launching a new bootcamp built specifically for cyber leaders and operators who want to understand what AI means for the future of cybersecurity (beyond the hype).
Over the course of the bootcamp, we will break down:
▪️ How AI is reshaping the cybersecurity landscape
▪️ The new risks introduced by LLMs, agents, and enterprise AI adoption
▪️ How security teams should think about securing AI systems
▪️ Where AI is actually useful across the SOC, cloud, identity, application security, and data security
▪️ What cybersecurity leaders need to know as vendors, attackers, and enterprises all race to adopt AI
I’ll be teaching alongside Lawrence Pingree, Head of Research, a legend and his expertise in bringing together market research, frameworks for analyzing markets, and practical insights into cybersecurity leadership. This bootcamp is designed for CISOs, security leaders, investors, founders, and cybersecurity professionals who want a clear, strategic, and practical understanding of where AI and cybersecurity are heading. Registrations open today!
You can register on Maven.com: maven.com/cybersecuritybootc…
*** PS: We are offering a 20% discount for early bird pricing within the first week. DM me for more details!! #Cybersecurity #AI #CyberLeadership #CISO #SecurityLeaders #CyberSecurityTraining #AI
Francis retweeted
The Rise of UADP: Market Share, Growth, and the Consolidation of Security Platforms, by @InvestiAnalyst open.substack.com/pub/softwa…
Francis retweeted
As an analyst firm with a broad view of the cybersecurity market, here are a few high-level (and in some cases, unexpected) observations from #RSAC based on our conversations:
▪️ CISOs/security practitioners: The reality is that spending on securing AI is materially lagging behind the pace of adoption of the new technology tools.
▪️ Vendors: Many vendors are effective at securing LLMs and employee usage of AI, but few offer comprehensive solutions for securing autonomous agents (understandable given how quickly the tech is evolving).
▪️ Investors: There is a clear sense of urgency and FOMO among investors searching for the next “Wiz”-scale outcome.
As an analyst firm with a broad view of the cybersecurity market, here are a few high-level (and in some cases, unexpected) observations from #RSAC based on our conversations:
▪️ CISOs/security practitioners: The reality is that spending on securing AI is materially lagging behind the pace of adoption of the new technology tools.
▪️ Vendors: Many vendors are effective at securing LLMs and employee usage of AI, but few offer comprehensive solutions for securing autonomous agents (understandable given how quickly the tech is evolving).
▪️ Investors: There is a clear sense of urgency and FOMO among investors searching for the next “Wiz”-scale outcome.
Several category themes consistently emerged (and we see opportunities):
▪️Identity and data are the central control layer
▪️ New phishing attacks continue to prompt how email is evolving.
▪️ Debate on the flexible deployment models (MCPs, CLIs, APIs)
▪️ Growing emphasis on runtime enforcement on where the agent takes "action." Detection alone is no longer sufficient. Control and response are what will differentiate platforms in the future.
▪️ Highlight for me -> Endpoint agentic security 2.0: The endpoint is re-emerging as a critical control plane. Agent workflows are increasingly executed near the user and often inherit the user's permissions. This shifts risk back toward the device layer and underscores the importance of Next-gen EDR, DLP, and Insider risk management. This also directly connects to the risks introduced by MCPs and local agent tooling.
Bottom Line: Broadly, for the first time, this RSAC compared to 2025. The center of gravity moved from “AI as a feature” to agents as systems that introduce new identity, data, and SOC observability/runtime and control challenges for human controls.
We're in one of the biggest shifts where security will need to adapt accordingly. Interesting times. Deep dive next week.
Francis retweeted
That’s a wrap on #RSAC2026 for the SACR team. This year was special because we had a stronger on-the-ground team presence: meeting with clients, partners, founders, investors, and friends across the ecosystem.
We successfully co-hosted two CISO events at RSAC 2026 by partnering with friends. Thank you, Okta Ventures, IVP and CRV.
As always, the value of RSAC comes from the conversations. From CISOs to strategics to the investment community, our research team walked away with a true 360° view of where the market is heading.
The biggest takeaway: security is entering a new phase. AI is no longer a feature; it’s fundamentally reshaping how work gets done, and in turn, what needs to be secured.
We’re seeing this play out across multiple layers of the stack. Next week, we’ll be sharing deeper insights, themes, and breakdowns we heard across the halls in the coming weeks.
***
A special thank you to Lawrence Pingree and Edrianne Crisostomo for representing the broader 14-person SACR team.
That’s a wrap on #RSAC2026 for the SACR team. This year was special because we had a stronger on-the-ground team presence: meeting with clients, partners, founders, investors, and friends across the ecosystem.
We successfully co-hosted two CISO events at RSAC 2026 by partnering with friends. Thank you, Okta Ventures, IVP and CRV.
As always, the value of RSAC comes from the conversations. From CISOs to strategics to the investment community, our research team walked away with a true 360° view of where the market is heading.
The biggest takeaway: security is entering a new phase. AI is no longer a feature; it’s fundamentally reshaping how work gets done, and in turn, what needs to be secured.
We’re seeing this play out across multiple layers of the stack. Next week, we’ll be sharing deeper insights, themes, and breakdowns we heard across the halls in the coming weeks.
***
A special thank you to Lawrence Pingree and Edrianne Crisostomo for representing the broader 14-person SACR team.
My presentation on AI Agent security!
Have We Outgrown IAM? 🔐 Fireside chat happening now in the Trusted Access Lounge at #RSAC26
"Get your identity hygiene in place first. If you haven't fixed your human identity challenges, your agentic solutions are going to be a mess. You need to build on a good foundation."
-Francis Odum, @InvestiAnalyst, delivers an imperative for the identity security foundation of any enterprise.
#identitysecurity #RSAC #1Password
Francis retweeted
Have We Outgrown IAM? 🔐 Fireside chat happening now in the Trusted Access Lounge at #RSAC26
"Get your identity hygiene in place first. If you haven't fixed your human identity challenges, your agentic solutions are going to be a mess. You need to build on a good foundation."
-Francis Odum, @InvestiAnalyst, delivers an imperative for the identity security foundation of any enterprise.
#identitysecurity #RSAC #1Password
We just published a new research note on the future of Detection Engineering in Security Operations by Sean Sosnowski.
SecOps is broken, but not because we lack detections.
Here’s what’s actually changing 👇
1/ Detection engineering is shifting to a “decision runtime model.”
Today’s model is static + rule-driven:
▪️ Detection development
▪️ Testing & deployment
▪️ Tuning & maintenance
But as agents take over triage + investigation, this breaks.
Detection must evolve:
▪️ Dynamic evidence (not pre-defined)
▪️ Investigation-ready outputs (not raw alerts)
▪️ Continuous learning
Shift: alerts → real-time decision systems
2/ The real bottleneck isn’t data: it’s decision-making.
Telemetry scales infinitely. Human adjudication doesn’t.
Winning systems compress time-to-decision for humans + agents (AISOC), not signal volume.
Also: “Detection coverage” might be a vanity metric.
Mapping to MITRE ≠ success. Context is everything.
The winners won’t detect more: they’ll decide better:
→ Fewer, higher-quality cases
→ Real-time coverage integrity
3/ Who’s building toward this:
▪️ @cribl_io → fixing the evidence layer (accessible, queryable, affordable telemetry)
▪️ @runpanther → AI turning alerts into structured investigations + improving detections via feedback
▪️ Vega → federated search solving data fragmentation
▪️ Artemis (stealth) → AI-generated, context-rich detections
Other shout-outs: Spectrum and Brava Security
Bottom line:
Security is shifting from “Did we detect it?” → “Can we decide faster, consistently, at scale?”
Full breakdown + vendor analysis here: softwareanalyst.substack.com…