--- title: "All 3 SIEMs on our old SMB list changed hands; 8 of 31 named tools moved" summary: "The 31 products our April 2023 startup security list named, followed to September 2026: who changed owner, which four jobs to buy differently, and what starts free." url: https://www.thetechbag.com/blog/top-10-security-tools-startups-smbs-safeguarding format: Analysis desk: "Security operations" published: 2025-07-29 facts_checked: 2026-09-30 author: TechBag (The TechBag Journal) tags: ["SMB security","startups","SIEM","LevelBlue","QRadar","LogRhythm","Exabeam","ZTNA","VPN","MFA","Cisco Duo","Cloudflare","Wazuh","CERT-In","DPDP"] cover: https://www.thetechbag.com/blog/covers/top-10-security-tools-startups-smbs-safeguarding.png --- # All 3 SIEMs on our old SMB list changed hands; 8 of 31 named tools moved *The 31 products our April 2023 startup security list named, followed to September 2026: who changed owner, which four jobs to buy differently, and what starts free.* Analysis · Security operations · By TechBag · Published 2025-07-29 · Facts checked 2026-09-30 · Canonical: https://www.thetechbag.com/blog/top-10-security-tools-startups-smbs-safeguarding The short version - Eight of the 31 products our April 2023 list named had changed owner, name or platform by September 2026, and all three SIEMs we recommended to small businesses changed hands: AlienVault to LevelBlue, QRadar SaaS to Palo Alto Networks, LogRhythm into Exabeam.[1] [2] - The ten jobs still stand. Four of them should be bought differently now: a consumer VPN is the wrong tool for staff access, antivirus means endpoint detection, two-factor means phishing-resistant keys, and a startup’s SIEM is usually someone else’s. - A team of ten can start three of the jobs at no licence cost: zero-trust access free to 50 users, MFA free to 10, and an open-source SIEM with no agent cap.[8] [9] [1] The 2023 version of this piece answered a founder’s question, “which security tools does a startup actually need?”, with ten categories and three brand names under each. The categories were sensible. The brand names aged fast, and a list of names is only useful if the names still mean what they meant. So this rewrite does two things: it follows every product the original named to where it stood at the end of September 2026, and it asks which of the ten jobs a twenty-person Indian startup should still buy the way the list suggested. ## Eight of 31 names moved, and the SIEM shelf emptied The original named 31 products across ten jobs: three each, and four for two-factor authentication. By September 2026 eight of them had changed owner, name or platform. The concentration is the story. All three SIEMs moved. AT&T’s cybersecurity business, which had owned AlienVault since 2018, became LevelBlue, a joint venture with WillJam Ventures, in May 2024.[2] Palo Alto Networks bought IBM’s QRadar SaaS business, closing in September 2024, and is moving those customers to Cortex XSIAM; IBM keeps the on-premises product. LogRhythm merged with Exabeam in July 2024, and its Axon cloud SIEM was retired in favour of Exabeam’s platform.[1] [3] Elsewhere the changes were one per job. Thales completed its US$3.6 billion purchase of Imperva in December 2023.[4] EQT took a majority stake in Acronis in 2025.[5] LastPass completed its separation from GoTo on 1 May 2024 and now runs as an independent company.[6] Twilio ended the Authy desktop apps on 19 March 2024, leaving the phone app.[7] And one name was already stale when we printed it: PhishMe trades as Cofense.[10] **Figure: Every SIEM we named changed hands; no other job lost more than one name** *Products named in the April 2023 list that changed owner, name or platform by 30 September 2026, by job (three named per job, four for two-factor)* SIEM 3 3 products Password manager (LastPass) 1 2 3 products Backup (Acronis) 1 2 3 products Web app firewall (Imperva) 1 2 3 products Two-factor (Authy desktop) 1 3 4 products Awareness (PhishMe) 1 2 3 products Firewall 3 3 products Antivirus 3 3 products VPN 3 3 products Email security 3 3 products | | Changed owner, name or platform | No change found | | --- | --- | --- | | SIEM | 3 | 0 | | Password manager (LastPass) | 1 | 2 | | Backup (Acronis) | 1 | 2 | | Web app firewall (Imperva) | 1 | 2 | | Two-factor (Authy desktop) | 1 | 3 | | Awareness (PhishMe) | 1 | 2 | | Firewall | 0 | 3 | | Antivirus | 0 | 3 | | VPN | 0 | 3 | | Email security | 0 | 3 | Source: TechBag intel pages and SIEM guide; LevelBlue, LastPass and Twilio announcements; TechBag count · as of 30 September 2026 · PhishMe's rename to Cofense predates the 2023 list; it is counted because the list printed the old name TechBag countTechBag count We checked each of the 31 names against TechBag’s intel pages as they stood on 30 September 2026 and, where the estate does not cover a product, against the vendor’s or a trade publication’s dated announcement. A product counts as changed if its owner changed, it was renamed, or the platform we named was retired or folded into another. Zero means we found no such change, not that we proved none happened. Why SIEM, of all the jobs? Because it is the one where size decides economics. A SIEM is priced by the data it ingests and earns its keep through the analysts who read it, so the market rewards whoever can spread both costs over the most customers. Small vendors sold, merged or were split. For a buyer, the lesson is that the SIEM is the line most likely to change underneath you, and the contract should say what happens to your data and your price when it does. The stable rows say something too. For the firewalls (Fortinet, Cisco Meraki, pfSense), the email filters (Mimecast, Proofpoint, Barracuda), the consumer antivirus brands and the consumer VPNs, we found no change of owner or name over the period. Stability is not the same as fit, though. Two of those four stable rows, the antivirus and the VPN, are the ones we would now buy differently, which is the subject of the next section. ## The ten jobs still stand; four should be bought differently None of the ten categories is wrong. A startup still needs to stop malware, protect email, control who logs in, keep a copy of its data and train its people. What changed is the form some of them should take for a company whose servers are someone else’s cloud and whose office is a laptop. **Figure: Four of the 2023 jobs have a different answer in 2026: access, endpoint, two-factor and SIEM** *The 2023 list's tool for each changed job against the form we would buy for a 20-person cloud-first startup, September 2026* What the 2023 list said - A VPN (NordVPN, ExpressVPN, CyberGhost) for secure connections - Antivirus (Norton, McAfee, Avast) for malware - Two-factor codes from an authenticator app - A SIEM (AlienVault, QRadar, LogRhythm) run in-house What we would buy now - Zero-trust access per application, with Indian points of presence - Endpoint protection with detection and response, business edition - Phishing-resistant MFA: FIDO2 keys or passkeys for admins first - Managed detection and response, or an open-source SIEM with a support contract Source: TechBag zero-trust, endpoint, IAM and SIEM guides · as of 30 September 2026 The VPN line is the one to delete rather than update. The three products the original named are consumer privacy services; they hide a user’s traffic from the network they sit on, which is the opposite of what a company needs, which is to see and control who reaches its applications. India adds a specific reason: CERT-In’s 2022 Directions require VPN service providers to keep subscriber names, addresses, IP addresses and the purpose of use for five years.[11] Zero-trust network access does the job the original meant. Cloudflare’s version is free to 50 users and US$7 a user a month after that, with points of presence in Mumbai, Chennai, New Delhi, Bengaluru, Kolkata and Nagpur.[8] Our view Our view: for a team under fifty, the SIEM line should usually become a managed service. Nobody on a twenty-person payroll reads alerts at 3 a.m., and an unread SIEM is a storage bill. The exception is the startup with an engineer who wants to run Wazuh, whose platform is free under GPLv2 with no agent cap; then pay for support, not for a licence.[1] Two-factor deserves a word because the original treated all second factors as equal. App codes stop password reuse; they do not stop a convincing fake login page that asks for the code too. Cisco Duo supports FIDO2 keys, and TechBag’s IAM guide records phishing resistance for every product it lists.[12] Start with the people who hold admin rights to email, cloud and code; they are the accounts an attacker wants, and there are few enough of them to issue hardware keys this week. Antivirus is the fourth line to reread. Norton, McAfee and Avast are consumer brands first, sold one device at a time. A company needs a console that shows every laptop it owns, isolates the one that is misbehaving and keeps a record of what ran on it, because that record is what the incident report will ask for. That is endpoint detection and response, sold per device in business editions; the [endpoint protection guide](https://www.thetechbag.com/browse/security/endpoint-protection) separates the prevention-only products from the ones that detect and respond.[17] The six other jobs keep their shape, with smaller shifts. Email security for a company on Microsoft 365 or Google Workspace now usually sits on the mailbox through the provider’s API rather than in front of it as a gateway. Backup has to include the SaaS data, since neither suite keeps your deleted mail and files for ever. The web application firewall is, for most startups, a setting on the CDN in front of the website rather than a separate purchase. The firewall earns its place once there is an office network with printers and guests on it, and not before. The password manager and awareness training are what they were in 2023. ## A team of ten can start three jobs at no licence cost The 2023 list did not price anything. The useful fact for a seed-stage company is that three of the ten jobs now have free tiers large enough to run in production. **Figure: Access, MFA and SIEM can all start free for a team of ten** *Users or agents covered by each free tier, as published, September 2026* 50 users Cloudflare zero-trust access, free tier; US$7 a user a month beyond TechBag ZTNA guide 10 users Cisco Duo Free MFA; Essentials US$3, Advantage US$6, Premier US$9 a user a month Duo pricing page No cap Wazuh SIEM and XDR, free under GPLv2; support and hosting are what is sold TechBag SIEM guide Source: TechBag zero-trust access and SIEM guides; Cisco Duo editions and pricing · as of 30 September 2026 Free tiers end, and they end at a seat count, so plan the step. At twenty users Duo Free no longer covers the team; Duo Essentials for twenty is US$60 a month at list.[9] Cloudflare’s tier holds until the fifty-first user. The jobs that do not start free are the ones with real per-seat cost: endpoint protection, email security, backup and training. For endpoint, an Indian-built option lists at ₹1,250 a device a year through an Indian marketplace.[13] Our [costed security budget](https://www.thetechbag.com/blog/5-security-services-tools-every-organization) works those lines for a 100-person company. TechBag countTechBag arithmetic Twenty users × US$3 a month = US$60 a month, or US$720 a year at Duo Essentials list, before GST and any reseller margin. The same twenty users sit inside Cloudflare’s free tier. If you are buying this in India Most of the tools above list in US dollars. Bought through an Indian reseller they are quoted in INR with 18% GST on the invoice, which a GST-registered company can usually claim back as input credit; bought by card from a foreign vendor, the company pays the same 18% itself under reverse charge. TechBag resells Cloudflare and Fortinet, both named in this piece, as its intel pages record.[14] The regulation that bites a startup first is CERT-In’s Directions of 28 April 2022: report a listed cyber incident within six hours and keep logs of ICT systems for 180 days within Indian jurisdiction.[11] The free SIEM tier above is only compliant if someone keeps those logs for six months. The DPDP Rules were notified on 13 November 2025; the security-safeguard and breach-intimation duties apply from 13 May 2027.[15] A fintech startup regulated by SEBI has been inside the Cybersecurity and Cyber Resilience Framework since 31 August 2025, which sets its own logging and audit duties by entity size.[16] How we did this Figures as of 30 September 2026 The 31 product names are taken from the April 2023 original. Ownership and product facts were checked against TechBag’s intel pages and guides as committed on 30 September 2026 (SIEM guide, Microsoft Sentinel, Thales, Acronis and Proofpoint pages), and otherwise against the dated announcements cited. The free-tier and price figures are list prices from the TechBag guides of the same date and from Cisco Duo’s pricing page; they exclude GST, reseller margin and annual-commitment discounts. The ₹1,250 endpoint figure is a marketplace listing recorded in an earlier TechBag piece. The 2023 original opened with four statistics on breach costs and attack rates; none was re-checked here and all are dropped. The “what we would buy now” column is our view, not a count. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [TechBag, SIEM & log management guide (QRadar SaaS customers migrating to Palo Alto; July 2024 LogRhythm merger and Axon retired; Wazuh free under GPLv2, no agent cap)](https://www.thetechbag.com/browse/security/siem-log-management) — as of 30 September 2026 2. [SecurityWeek, AT&T launches new managed cybersecurity services business LevelBlue (WillJam Ventures joint venture; AlienVault acquired 2018)](https://www.securityweek.com/att-launches-new-managed-cybersecurity-services-business-levelblue/) — 7 May 2024 3. [TechBag, Microsoft Sentinel intel page (Palo Alto acquired IBM's QRadar SaaS assets, closing September 2024; IBM supports on-premises QRadar)](https://www.thetechbag.com/microsoft/microsoft-sentinel) — as of 30 September 2026 4. [TechBag, Thales vendor hub (Imperva acquired for US$3.6 billion, completed December 2023)](https://www.thetechbag.com/thales) — as of 30 September 2026 5. [TechBag, Acronis vendor hub (majority-owned by EQT since 2025)](https://www.thetechbag.com/acronis) — as of 30 September 2026 6. [LastPass via Business Wire, LastPass completes journey to become an independent company](https://www.businesswire.com/news/home/20240501835392/en) — 1 May 2024 7. [Twilio changelog, End of life of Twilio Authy desktop apps (19 March 2024)](https://twilio.com/en-us/changelog/end-of-life--eol--of-twilio-authy-desktop-apps) — 19 February 2024 8. [TechBag, Zero trust access guide (Cloudflare free to 50 users, then US$7 a user a month; Indian points of presence)](https://www.thetechbag.com/browse/network-security-sase/zero-trust-access) — as of 30 September 2026 9. [Cisco Duo, Editions and pricing (Free up to 10 users; Essentials US$3, Advantage US$6, Premier US$9 a user a month)](https://duo.com/editions-and-pricing) — undated page 10. [TechBag, Proofpoint Security Awareness intel page (Cofense, formerly PhishMe)](https://www.thetechbag.com/proofpoint/proofpoint-awareness-training) — as of 30 September 2026 11. [CERT-In, Directions under section 70B(6) of the IT Act, 2000 (six-hour reporting; 180 days of logs in India; VPN subscriber records for five years)](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) — 28 April 2022 12. [TechBag, IAM, SSO & MFA guide (Cisco Duo: FIDO2, ~US$3 to US$9 a user a month)](https://www.thetechbag.com/browse/identity-access/iam-sso-mfa) — as of 30 September 2026 13. [TechBag, Seqrite at ₹1,250 vs Kaspersky at ₹5,200 (marketplace INR lists per endpoint per year)](https://www.thetechbag.com/blog/seqrite-vs-kaspersky-endpoint-india) — facts checked September 2026 14. [TechBag, Barracuda Application Protection intel page (TechBag sells Cloudflare and Fortinet)](https://www.thetechbag.com/barracuda/barracuda-application-protection) — as of 30 September 2026 15. [Legismith Partners, DPDP Rules 2025 commencement timeline](https://legismith.com/dpdp-rules-2025-timeline/) — notified 13 November 2025 16. [SEBI, Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities](https://www.sebi.gov.in/legal/circulars/aug-2024/cybersecurity-and-cyber-resilience-framework-cscrf-for-sebi-regulated-entities-res-_85964.html) — 20 August 2024; in force 31 August 2025 17. [TechBag, Endpoint protection guide (EPP, EDR, XDR: prevention against detection-and-response tiers)](https://www.thetechbag.com/browse/security/endpoint-protection) — as of 30 September 2026 Related on TechBag: the [zero trust access guide](https://www.thetechbag.com/browse/network-security-sase/zero-trust-access) prices the VPN replacement; the [SIEM & log management guide](https://www.thetechbag.com/browse/security/siem-log-management) covers who owns which SIEM now. **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [SIEM & log management guide](https://www.thetechbag.com/browse/security/siem-log-management) — who owns which SIEM now, and the 180 days of logs CERT-In asks for - [Zero trust access guide](https://www.thetechbag.com/browse/network-security-sase/zero-trust-access) — the VPN replacement, free to 50 users at the low end - [IAM, SSO & MFA guide](https://www.thetechbag.com/browse/identity-access/iam-sso-mfa) — phishing-resistant MFA, product by product