Hey {{First Name | there}}. Ask Gemini to name the top AppSec vendors and it puts Synopsys first. Synopsys sold that business in 2024; it trades as Black Duck now. That story is in this week’s Index. First, though: five breach disclosures in six days, and the buying windows they opened.
🎯 Buying Windows
This week's windows: 5 incidents.
Boston Scientific (breach, Aug 26). Stopped processing and shipping customer orders worldwide after an August 25 intrusion; no restoration timeline given. First buys: OT segmentation, incident response retainer. source
McKesson (breach, Aug 31). Confirmed an SEC-disclosed breach of two business units while an extortion group ran a September 1 deadline. First buys: exfiltration detection, third-party access controls. source
ATF (breach, Aug 27). Declared a major incident after intruders reached a system holding information on its investigation targets. First buys: standalone-system monitoring, data classification. source
Also opened: Hasbro · Paylogix.
No leadership-change, M&A, or funding windows cleared our canonical-date bar this week.
→ Lead Radar scores every window for your ICP and attaches verified contacts. See yours in GTMfusion.
🤖 The AI Shortlist Index — AppSec week
Four engines, one buyer question. Who makes each top 5, measured this week:
# | Vendor | On engines |
|---|---|---|
1 | Checkmarx | 3/4 |
2 | Veracode | 3/4 |
3 | Synopsys (sold its AppSec business in 2024) | 2/4 |
4 | Snyk | 2/4 |
5 | Acunetix | 2/4 |
6 | Burp Suite | 2/4 |
7 | OpenText (Fortify) | 2/4 |
Gemini ranks Synopsys first, two years after Synopsys sold that business; it trades as Black Duck now. Perplexity shares only two brands with the other three engines. Method: one prompt per engine, temperature 0, measured Aug 31.
The rotation: AppSec (this issue) → Email security Sep 9 → CSPM Sep 16 → EDR Sep 23 → SIEM Sep 30 → IAM Oct 7.
🧭 Vendor Moves
Echo acquired Minimus's entire asset base after the container-hardening startup wound down. That pushes its category another step toward platform consolidation. Your move: if you sell hardened images or SBOM tooling, every Minimus customer is in market. source
OpenAI signed roughly 130 companies including Microsoft, Google and CrowdStrike onto an AI cyber-defense pledge. That moves one vendor squarely into the AI-security conversation. Your move: expect AI-defense commitments in your next enterprise RFP; have your answer written. source
Abnormal AI extended email security into outbound DLP and phishing-simulation training, generally available August 31. That takes an established vendor into an adjacent category — battlecards against it just aged a quarter. Your move: if you sell standalone DLP or awareness training, your renewal now competes with a bundle. source
Also: RightCrowd (mobile, badge and biometric credentials in one platform).
Launching something that changes selling conditions? Reply with the announcement. If it clears our bar it runs here, with the source link.
📈 The Number: 0 of 11. Eleven AppSec brands make an engine's top five; none makes all four. IAM had three last week. Source: Cyber GTM Signals, measured Aug 31, 2026. |
📅 On the calendar
When | Event | Where |
|---|---|---|
Sep 14-16 | GSX 2026 | Atlanta |
Nov 15-18 | CyberMarketingCon 2026 | Austin |
Booking a booth or briefings? The windows above tell you who to get meetings with.
🔗 Worth your time
AI agents took 17,600 actions inside a production environment in four days. Your access model was not built for that. SecurityWeek
Unit 42 says frontier models now find a year's worth of vulnerabilities in months. Buyers will ask about it. Cybersecurity Dive
The Play
If you sell AppSec, run the four engines against your category prompt this week and screenshot where your brand is missing. One of the seven multi-engine brands names a company that sold the product in 2024. Take that to your demand-gen lead.
Our call: At least one of the five companies that disclosed a breach this week names a new CISO or head of security before December 31, 2026.
See you next Wednesday. Forward this to the CMO who still thinks AI search is SEO.
— Martin
Measured, not opined. One prompt per engine, temperature 0. Want your brand's AI-visibility report? Reply with your domain. One report, no pitch. |
The personalized version, with names, scores, and your own AI-answer share, is what GTMfusion sends its users every Monday. Start your 14-day trial →
Forwarded this? Subscribe here. This newsletter grows by referral, not by ads.
Cyber GTM Signals · a GTMfusion publication