ETR Observatory for Cloud Security

This is a summary of the full report. ETR clients receive the complete findings; use the form at the bottom to request access to the complete findings.

Key Takeaways

• Wiz CNAPP leads the 2026 study with the highest Net Score (73%) and Net Usage (84%), with 56% of current users expecting to remain on the platform for at least three years; the vendor was also the top preference in rebuilding cloud security from scratch (20%), edging out Microsoft (19%) in an increasingly contested top tier.
• Palo Alto Networks Cortex Cloud posts the sharpest year-over-year gain among Leading vendors, with Net Score climbing by 10 percentage points to 58% and Net Usage rising to 57%; this is anchored by Increasing share (58%) and ranks third in both Everything Expected of a CNAPP product (80%) and Difficulty of Replacement (49%).
• Visibility and detection leads the CNAPP feature priority list at 47%, followed by integration and compatibility (38%) and automation/AI (31%); leading perceptions on ecosystem integration are Microsoft at 86% and Wiz at 76% agreement rates, holding a structural advantage as buyers consolidate their cloud security stacks.
• Microsoft Defender for Cloud and Zscaler Posture Control both show year-over-year Net Score declines (Microsoft -5 ppts to 55%, Zscaler -14ppts to 45%), and CrowdStrike Falcon Cloud Security dropped by 11 ppts to 40%, evidence of competitive headwinds in platform consolidation even for large incumbents.
• Dynatrace is the biggest momentum mover in the Advancing quadrant, with Net Score surging from 48% to 64% and Net Usage improving to 56% y/y, fueled by zero negative responses albeit on a somewhat limited sample size; in the same quadrant, Rapid7 falls to the study's lowest Net Score at 23%, down sharply from 54% in 2025.

Executive Summary

The 2026 ETR Observatory for Cloud Security surveyed 300 enterprise IT decision makers in May 2026 on spending intentions and product perceptions across the Cloud Native Application Protection Platform (CNAPP) market. The respondent base skews upmarket, with 60% of respondents from Large organizations, and includes 55 Fortune 500 and 81 Global 2000 members. North America represents 72% of respondents, EMEA 17%, and APAC 11%. Top industries represented include Services/Consulting (22%), Financial Services (19%), and IT/Telecom (16%). The study covers 14 vendors with citation counts meeting the N>=15 inclusion threshold, with four additional vendors (Aqua Security, Orca Security, Sysdig, and Upwind) excluded from vendor-level analysis due to the limited sample sizes.
 
On the back of its acquisition by Google, Wiz CNAPP holds a Net Score of 73% and Net Usage of 84%, the highest marks in the study across both metrics, and remains voted the Most Innovative vendor at 24% of citations. Palo Alto Networks makes the most significant year-over-year advance among Leading vendors, with Net Score rising from 48% to 58% as Cortex Cloud consolidates its position as an enterprise platform anchor across multiple security domains. Microsoft Defender for Cloud commands the largest respondent base and leads the field in perceptions of ecosystem integration (86%), though its Net Score declined slightly year-over-year. However, Zscaler Posture Control and CrowdStrike both post notable Net Score declines, demonstrating that high Presence does not insulate vendors from competitive headwinds. In the Advancing quadrant, Dynatrace surges to 64% Net Score, while Rapid7 falls to a survey-low 23%, in what may reflect broader uncertainty about its CNAPP platform trajectory.

Introduction

Cloud Native Application Protection Platforms (CNAPP) have rapidly become a centerpiece of enterprise security strategy as organizations migrate workloads to multi-cloud and hybrid environments. Originally conceived as the convergence of Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platforms (CWPP), CNAPP has expanded to encompass Cloud Infrastructure Entitlement Management (CIEM), infrastructure-as-code scanning, software supply chain security, and increasingly, AI-assisted threat detection. The result is a market where buyers are actively consolidating from point solutions to integrated platforms and the 2026 study reflects a market in transition. Established security platforms with broad footprints, including Palo Alto Networks, Microsoft, CrowdStrike, and Zscaler, hold high Presence in enterprise accounts, but momentum trajectories diverge sharply. Purpose-built CNAPP vendor Wiz, despite its integration into Google, continues to set the pace for Net Score and Net Usage, while some adjacent software offerings like that of Dynatrace show better intentions. This report covers 14 vendors, while four additional vendors (Aqua Security, Orca Security, Sysdig, and Upwind) are included in the study but do not meet the N>=15 threshold for Net Score chart inclusion or discussion.

The Observatory Report

The ETR Observatory is a structured survey research program designed to track vendor-level momentum and product perception across key enterprise technology markets. Unlike the ETR Technology Spending Intentions Survey (TSIS), which measures macro-level spending intentions across thousands of respondents, the Observatory focuses on a defined subsector and solicits product-specific responses from practitioners who actively use or evaluate the tools in scope. Momentum is a composite of two primary signals. Net Score reflects net spending intent, calculated as the sum of respondents who are Adopting plus those planning to Increase spend, minus those planning to Decrease spend or Replace the product. Net Usage measures the direction of actual usage change over the prior 12 months, calculated as the share reporting increased usage minus those reporting decreased usage. 

Conclusion – Cybersecurity Industry Under Constant Transformation Shifts Rankings Rapidly

The Observatory for Cloud Security captures a market in active consolidation, where buyers are narrowing their vendor lists and raising the bar for what a platform must deliver across visibility and detection, ecosystem integration, and AI-driven automation for critical cloud security tasks. The best positioned vendors heading into 2027 are those that can demonstrate a combination of top level protection capabilities, ecosystem integration, and acceptable ROI. The Leading, Advancing, Tracking, and Pursuing designations reflect a moment in time rather than a permanent ranking, and the pace of product development in CNAPP is fast enough that a single platform release or go-to-market shift can move a vendor meaningfully within a single survey cycle. ETR will continue tracking these dynamics in future Observatory editions.

About ETR

ETR is an enterprise technology market research firm that delivers actionable, transparent, and unbiased insights to technology companies, institutional investors, and a trusted community of technology leaders, empowering them to make smarter, faster decisions. ETR’s proprietary approach is grounded in their vision to reinvent technology market research so that business leaders can strategically position their organizations to outperform the competition. In fact, no other firm harnesses the same scale and makeup of their vetted community to quickly deliver the unbiased data and analysis that financial and enterprise organizations need to achieve better outcomes.

We use our two quarterly surveys (Technology Spending Intentions Survey and the Macro Views Survey) to collect data and insights directly from the ETR Community. Use this data and insights to navigate the complex enterprise technology landscape and our proprietary visualizations and models to mine insights and unearth predictors of enterprise technology performance.

Beyond our core surveys, we also offer custom market research surveys. These can be commissioned with a targeted group and are guided by our expert content team to determine the best audience, topics, and questions. Additionally, the target group cannot only be based on their organization size, sector, and title, but also on our proprietary research around a firm’s spending intentions and technology stack.

Methodology
If you’re interested in the process behind the data, you’ll find it in the methodology section on our website.