All 3 SIEMs on our old SMB list changed hands; 8 of 31 named tools moved

01Eight of 31 names moved, and the SIEM shelf emptied

The original named 31 products across ten jobs: three each, and four for two-factor authentication. By September 2026 eight of them had changed owner, name or platform. The concentration is the story. All three SIEMs moved. AT&T’s cybersecurity business, which had owned AlienVault since 2018, became LevelBlue, a joint venture with WillJam Ventures, in May 2024.² Palo Alto Networks bought IBM’s QRadar SaaS business, closing in September 2024, and is moving those customers to Cortex XSIAM; IBM keeps the on-premises product. LogRhythm merged with Exabeam in July 2024, and its Axon cloud SIEM was retired in favour of Exabeam’s platform.^{1 3}

Elsewhere the changes were one per job. Thales completed its US$3.6 billion purchase of Imperva in December 2023.⁴ EQT took a majority stake in Acronis in 2025.⁵ LastPass completed its separation from GoTo on 1 May 2024 and now runs as an independent company.⁶ Twilio ended the Authy desktop apps on 19 March 2024, leaving the phone app.⁷ And one name was already stale when we printed it: PhishMe trades as Cofense.¹⁰

Why SIEM, of all the jobs? Because it is the one where size decides economics. A SIEM is priced by the data it ingests and earns its keep through the analysts who read it, so the market rewards whoever can spread both costs over the most customers. Small vendors sold, merged or were split. For a buyer, the lesson is that the SIEM is the line most likely to change underneath you, and the contract should say what happens to your data and your price when it does.

The stable rows say something too. For the firewalls (Fortinet, Cisco Meraki, pfSense), the email filters (Mimecast, Proofpoint, Barracuda), the consumer antivirus brands and the consumer VPNs, we found no change of owner or name over the period. Stability is not the same as fit, though. Two of those four stable rows, the antivirus and the VPN, are the ones we would now buy differently, which is the subject of the next section.

02The ten jobs still stand; four should be bought differently

None of the ten categories is wrong. A startup still needs to stop malware, protect email, control who logs in, keep a copy of its data and train its people. What changed is the form some of them should take for a company whose servers are someone else’s cloud and whose office is a laptop.

The VPN line is the one to delete rather than update. The three products the original named are consumer privacy services; they hide a user’s traffic from the network they sit on, which is the opposite of what a company needs, which is to see and control who reaches its applications. India adds a specific reason: CERT-In’s 2022 Directions require VPN service providers to keep subscriber names, addresses, IP addresses and the purpose of use for five years.¹¹ Zero-trust network access does the job the original meant. Cloudflare’s version is free to 50 users and US$7 a user a month after that, with points of presence in Mumbai, Chennai, New Delhi, Bengaluru, Kolkata and Nagpur.⁸

Two-factor deserves a word because the original treated all second factors as equal. App codes stop password reuse; they do not stop a convincing fake login page that asks for the code too. Cisco Duo supports FIDO2 keys, and TechBag’s IAM guide records phishing resistance for every product it lists.¹² Start with the people who hold admin rights to email, cloud and code; they are the accounts an attacker wants, and there are few enough of them to issue hardware keys this week.

Antivirus is the fourth line to reread. Norton, McAfee and Avast are consumer brands first, sold one device at a time. A company needs a console that shows every laptop it owns, isolates the one that is misbehaving and keeps a record of what ran on it, because that record is what the incident report will ask for. That is endpoint detection and response, sold per device in business editions; the endpoint protection guide separates the prevention-only products from the ones that detect and respond.¹⁷

The six other jobs keep their shape, with smaller shifts. Email security for a company on Microsoft 365 or Google Workspace now usually sits on the mailbox through the provider’s API rather than in front of it as a gateway. Backup has to include the SaaS data, since neither suite keeps your deleted mail and files for ever. The web application firewall is, for most startups, a setting on the CDN in front of the website rather than a separate purchase. The firewall earns its place once there is an office network with printers and guests on it, and not before. The password manager and awareness training are what they were in 2023.

03A team of ten can start three jobs at no licence cost

The 2023 list did not price anything. The useful fact for a seed-stage company is that three of the ten jobs now have free tiers large enough to run in production.

Free tiers end, and they end at a seat count, so plan the step. At twenty users Duo Free no longer covers the team; Duo Essentials for twenty is US$60 a month at list.⁹ Cloudflare’s tier holds until the fifty-first user. The jobs that do not start free are the ones with real per-seat cost: endpoint protection, email security, backup and training. For endpoint, an Indian-built option lists at ₹1,250 a device a year through an Indian marketplace.¹³ Our costed security budget works those lines for a 100-person company.