Hey {{First Name | there}}. Three brands appear on all four AI engines for email security: Proofpoint, Microsoft, Mimecast. Four more split what is left, and two engines name one of them by a brand it retired in 2025. AppSec produced zero consensus brands last week. Below: five buying windows and $100M into AI security.
🎯 Buying Windows
This week's windows: 1 leadership change · 3 incidents · 1 funded round.
Thomson Reuters (breach, Sep 3). Disclosed that its court records platform was breached in March and went unnoticed for three months. First buys: third-party assurance, dwell-time detection. source
Gigamon (new CISO, Sep 2). Appointed a new CISO over product security, IT operations and GRC, reporting to the COO. First buys: product security tooling, GRC automation. source
HiddenLayer (funded, Sep 2). Raised $100M Series B as AI security spend runs 83% above last year, with ARR up tenfold. First buys: AI model security, red teaming. source
Also opened: IDScan · Mathspace.
No compliance-clock or M&A window cleared our canonical-date bar this week.
→ Lead Radar scores every window for your ICP and attaches verified contacts. See yours in GTMfusion.
🤖 The AI Shortlist Index — Email security week
Four engines, one buyer question. Who makes each top 5, measured this week:
# | Vendor | On engines |
|---|---|---|
1 | Proofpoint | 4/4 |
2 | Microsoft (Defender for Office 365) | 4/4 |
3 | Mimecast | 4/4 |
4 | Cisco (Email Security / Secure Email / Cisco) | 3/4 |
5 | Abnormal Security (renamed Abnormal AI in 2025) | 2/4 |
6 | Barracuda (Networks) | 2/4 |
7 | Google (Workspace Security) | 1/4 |
Two engines still say Abnormal Security, a name the company retired in April 2025 when it became Abnormal AI. Cisco appears under three different labels across three engines. Method: one prompt per engine, temperature 0, measured Sep 7.
The rotation: Email security (this issue) → CSPM Sep 16 → EDR Sep 23 → SIEM Sep 30 → IAM Oct 7 → AppSec Oct 14.
🧭 Vendor Moves
OpenAI shipped Astra, the first model it rates critical for cyber capability. That moves one vendor squarely into the AI-security conversation. Your move: pentest and AppSec buyers will ask what your tool finds that Astra misses. source
CrowdStrike has no patch yet for a public Falcon zero-day granting SYSTEM privileges. Your move: endpoint competitors will raise it in every bake-off; write the response now. source
Nvidia is buying Hugging Face for $13 billion, two months after its systems were hacked. That pushes its category another step toward platform consolidation. Your move: model supply chain security is about to have one owner; position against it. source
Also: Guardio ($1.1 billion valuation for consumer browser security) · Visa (account-to-account fraud scoring extended).
Launching something that changes selling conditions? Reply with the announcement. If it clears our bar it runs here, with the source link.
📈 The Number: 3 of 7. Three email security brands appear on all four AI engines. AppSec produced zero of eleven last week. Source: Cyber GTM Signals, measured Sep 7, 2026. |
📅 On the calendar
When | Event | Where |
|---|---|---|
Sep 14-16 | GSX 2026 | Atlanta |
Sep 15-16 | ENISA Trust Services and eID Forum / CA Day | Tallinn |
Oct 8 | 9th Cybersecurity Energy Forum | Brussels |
Nov 4-5 | European Cybersecurity Skills Conference | Larnaca |
Nov 15-18 | CyberMarketingCon 2026 | Austin |
Booking a booth or briefings? The windows above tell you who to get meetings with.
🔗 Worth your time
A business now sells stripped-guardrail versions of open models. Your AI security messaging needs an answer to it. TechCrunch
Researchers published 39 ways to defeat passkeys. Every passwordless-solves-phishing slide in your deck just aged. BleepingComputer
The Play
If you sell email security and are not Proofpoint, Microsoft or Mimecast, the AI answer is already three names deep. Have someone run the four engines against your category prompt and record which name each uses for you. Fix the name before the ranking.
Our call: By December 31, 2026, at least one of the four engines names Abnormal AI by its current name in an email security answer.
See you next Wednesday. Forward this to the CMO who still thinks AI search is SEO.
— Martin
Measured, not opined. One prompt per engine, temperature 0. Want your brand's AI-visibility report? Reply with your domain. One report, no pitch. |
The personalized version, with names, scores, and your own AI-answer share, is what GTMfusion sends its users every Monday. Start your 14-day trial →
Forwarded this? Subscribe here. This newsletter grows by referral, not by ads.
Cyber GTM Signals · a GTMfusion publication