Hey {{First Name | there}}. Palo Alto closed its purchase of IBM's QRadar SaaS business in 2024, and Claude still ranks IBM QRadar the No. 3 SIEM. If your category's answer layer is two years stale, ranking spend is fighting history. Perplexity names Palo Alto's Cortex XSIAM in that same slot. Below: three incidents and a $400 million round.
🎯 Buying Windows
This week's windows: 3 incidents.
An incident cluster (Sep 23). Attackers exploited Check Point management servers and F5 access gateways, making the security appliance itself the way in. First buys: Appliance inventory, emergency patch workflow. source
An incident cluster (Sep 24). Water utilities in at least seven states were targeted, and federal agencies are investigating the intrusions. First buys: OT asset discovery, network segmentation. source
An incident cluster (Sep 23). A phishing service selling stolen session tokens reached 12,000 inboxes across more than 10,000 organizations before takedown. First buys: Phishing-resistant MFA, token replay detection. source
Three incidents. No leadership change, compliance clock or deal cleared the window's date bar.
→ Lead Radar scores every window for your ICP and attaches verified contacts. See yours in GTMfusion.
🤖 The AI Shortlist Index — SIEM week
Four engines, one buyer question. Who makes each top 5, measured this week:
# | Vendor | On engines |
|---|---|---|
1 | Microsoft (Sentinel) | 3/4 |
2 | Splunk (Splunk / Enterprise Security) | 3/4 |
3 | CrowdStrike (Falcon LogScale / Next-Gen SIEM) | 3/4 |
4 | Google (Chronicle / Security Operations) | 2/4 |
5 | IBM QRadar | 1/4 |
6 | Palo Alto Networks (Cortex XSIAM) | 1/4 |
The ghost: Claude's No. 3, IBM QRadar, is the business Palo Alto bought in 2024 and migrated to Cortex XSIAM, which Perplexity ranks No. 3. ChatGPT returned no list. Method: one prompt per engine, measured Sep 28.
The rotation: SIEM (this issue) → IAM Oct 6 → AppSec Oct 13 → Email security Oct 20 → CSPM Oct 27 → EDR Nov 3.
🧭 Vendor Moves
Island raised a deserved $400 million Series F at a $6.4 billion valuation. Your move: agent control is a funded category now; name your position this week. source
Gurucul shipped analytics tying AI activity back to a named identity. Your move: expect an agent-attribution question in every SIEM deal; write the answer. source
Cloud Range built a testing range for AI agents, so buyers demand proof not demos. Your move: assume a bake-off you do not control; prepare the evidence. source
Also: Apple (moved impersonation detection into the operating system) · OpenAI (cut API prices by half, which resets everyone's AI feature margins).
Launching something that changes selling conditions? Reply with the announcement. If it clears our bar it runs here, with the source link.
📈 The Number: Two years. How long IBM QRadar has outlived its own sale inside an AI SIEM shortlist. Source: Cyber GTM Signals, measured Sep 28, 2026. |
📅 On the calendar
When | Event | Where |
|---|---|---|
Oct 27-29 | it-sa Expo&Congress | Nuremberg |
Nov 15-18 | CyberMarketingCon | Austin |
Nov 30-Dec 4 | AWS re:Invent | Las Vegas |
Booking a booth or briefings? The windows above tell you who to get meetings with.
🔗 Worth your time
Ireland fined Google 403 million euros over location data and gave it six months to comply. Help Net Security
A screenshot tool leaked 23.6 million records. Check what shadow SaaS your teams installed. Help Net Security
The Play
Ask all four engines to name your category's top vendors, then check every name against the last three years of corporate actions. Fix the ghost before you fight the leader.
Our call: By March 31, 2027, IBM QRadar no longer appears in any engine's top five SIEM answer.
See you next Tuesday. Forward this to the CMO who still thinks AI search is SEO.
— Martin
Measured, not opined. One prompt per engine, temperature 0. Want your brand's AI-visibility report? Reply with your domain. One report, no pitch. |
The personalized version, with names, scores, and your own AI-answer share, is what GTMfusion sends its users every Monday. Start your 14-day trial →
Forwarded this? Subscribe here. This newsletter grows by referral, not by ads.
Cyber GTM Signals · a GTMfusion publication