Every vendor review I have written treats the vendor as a single decision: what it will receive, what it may do, how hard it would be to leave. That is the right frame for one contract and the wrong frame for a budget, which is a set of bets about where a market is going and what the money is supposed to produce. So I built a map of the market a small firm buys from. The technology landscape is a knowledge graph of 9 layers, 67 categories, 825 vendors and open-source projects, and 2,228 typed relations, each carrying the URL it was read from, open in my public library. Over it I laid two years of open signals: capital from SEC Form D filings and vendor announcements, attention from GitHub and Hacker News, adoption from package registries, and, in this revision, an attempt to read the exhibitor floors of RSAC, Black Hat, and DEF CON.
The first version of this piece described those numbers. This one argues them: for each part of the stack, what buyers are spending on, why, what the spend is expected to produce, and where I assume it goes next, with what would prove me wrong.
Source
How the map was built
The method is in the library's landscape README. Wikidata supplied each vendor's item, website, headquarters, founding year, and ownership under CC0; vendor documentation and integration directories supplied the relations, with only the URL recorded; the CNCF and LF AI and Data landscapes supplied category membership and open-source status. 486 of the 825 vendors carry a Wikidata item and 339 have nulls rather than guesses; every relation URL was fetched and kept only if the server returned a page, and 589 dead addresses were dropped. The map carries no pricing, revenue, or ratings, which would need a licensed source; the site's copy is pinned to a library commit, version 1.0.0, generated September 21, 2026.
Source
What the map and the money show
The figures come from the pinned map and the library's signals summary with its JSON. The window is September 1, 2024 to September 22, 2026; capital is Form D amounts as filed, US filers only, plus rounds announced by vendors with no filing; a vendor in two categories is split equally between them.
The map is crowded and hub-shaped at once: the median category holds 16 vendors and twenty of the 67 hold 20 or more, while the ten most connected vendors touch 71.7 percent of the graph and 495 of the 825 have two relations or fewer.
The money went somewhere else. The signals count 80.7 billion dollars across 64 of the 825 vendors and 38 of the 67 categories, and three names are 79.3 percent of it: xAI, 27.9 billion across four Form D filings; Databricks, 19.6 billion across seven; Anthropic, 16.5 billion from two announced rounds. Data and AI took 54.7 billion, 67.8 percent. Identity and devices, home to four of the ten hubs, took 495.8 million, 0.6 percent, and Security operations 453.2 million.
Describe this figure
A horizontal bar chart of nine categories from the landscape map, with each category's vendor count and its counted capital in US dollar millions. Model providers and inference drew 32,908.0 million across 24 vendors; AI assistants 10,582.4 million across 20; AI coding tools 4,512.8 million across 24. Everything else is close to nothing on the same scale: observability and incident response, the most crowded category with 31 vendors, drew 347.0 million; identity provider, 16 vendors and home to the map's most connected vendor, Entra ID with 360 relations, drew 112.5 million; agent frameworks and MCP 62.5 million across 22; fund administration and investor reporting 11.5 million across 19. SIEM, logging, and detection, 19 vendors, and cap table and equity management, 6 vendors, had nothing counted.
| Category | Vendors | USD m | Filings | Largest vendor | Hacker News stories, first to second half |
|---|---|---|---|---|---|
| Model providers and inference | 24 | 32,908.0 | 19 | xAI, 42.5% | 4,773 to 7,010 |
| AI assistants | 20 | 10,582.4 | 12 | Anthropic, 78.0% | 3,478 to 9,140 |
| AI coding tools | 24 | 4,512.8 | 10 | Cursor, 73.2% | 1,987 to 8,142 |
| Observability and incident response | 31 | 347.0 | 3 | Grafana Labs, 72.0% | 414 to 650 |
| Identity provider | 16 | 112.5 | 1 | Rippling, 100% | 80 to 101 |
| Agent frameworks and MCP | 22 | 62.5 | 1 | LangChain, 100% | 531 to 787 |
| Fund administration and investor reporting | 19 | 11.5 | 2 | Sydecar, 95.5% | 5 to 10 |
| SIEM, logging, and detection | 19 | 0.0 | 0 | none counted | 65 to 70 |
| Cap table and equity management | 6 | 0.0 | 0 | none counted | 1 to 4 |
USD millions as filed or announced; the halves are 2024-Q4 to 2025-Q2 and 2025-Q4 to 2026-Q2. Stories rose in 61 of the 67 categories, and four of the six that fell are ones a security program stands on: MFA and passkeys, Endpoint protection, Security awareness, and Privileged access and identity governance. Adoption has the same shape in three categories, stars peaked and fell while downloads climbed, which I read as attention turning into use.
The exhibitor floors were meant to be a fourth signal, since who pays for a booth is a spend decision of its own. The library's fetcher identified itself and read each site's robots.txt first. RSAC answered 403 to every request, including robots.txt; Black Hat's sponsor pages answered 403 with a security-service block page; DEF CON's vendor and village lists for DEF CON 33 and 34 were readable, 139 entries, and hold none of the 825 vendors, because that floor is hardware and merchandise sellers, publishers, nonprofits, and community villages. Each attempt and refusal is recorded in the summary's Conference presence section. That floor is not in open data, and I say so where a thesis would have leaned on it.
Synthesis
Observability and detection buy the time between an event and an account of it
What buyers are spending on is the most crowded category on the map and its neighbor, SIEM, logging, and detection, with 19 vendors and nothing counted. The capital is small and late, 347.0 million across three records with Grafana Labs's 250.0 million Form D in March 2026 the largest; adoption is the loud signal, downloads of the category's four npm packages up from 902.1 million to 2,104.9 million between halves with OpenTelemetry the most mentioned name; and the acquisitions run one way, Palo Alto Networks completing Chronosphere in January 2026 and Zscaler completing Red Canary in August 2025. The conference floor would have been the check on this thesis, and it is the one I could not read.
Why buyers believe they are buying something: after an incident, the question that costs the most is not what to do but what happened. The OpenAI Hugging Face report is a case of it, a credential exposed and the cost measured in the time it took to know where it had been used, and agents make it worse, because non-human identities generate activity no person watches. A firm buying logging and detection believes it is buying down the interval between an event and a confident account of it.
What the spend is expected to produce is that account, on demand, with the logs from the identity provider, the endpoints, and the cloud in one place and kept longer than the investigation. A buyer knows it worked when a drill or a real incident ends with a written timeline in hours rather than days, and knows it did not when the timeline has a gap where a system the firm pays for should have been.
Where it goes next is my assumption: the money will keep arriving through the platforms that already hold the data, security vendors buying observability companies and the clouds and identity providers extending their own logging, not through new standalone monitors, and the open telemetry standard is what keeps the exit open while that happens. What would prove me wrong: a Form D in the category larger than the whole two-year total, a run of new standalone entrants, or the acquisitions stopping.
Synthesis
Model providers and coding tools buy throughput
What buyers are spending on is where 59.5 percent of all counted capital landed: model providers, 32.9 billion with 8 of 24 vendors funded and xAI 42.5 percent; AI assistants, 10.6 billion with Anthropic 78.0 percent; AI coding tools, 4.5 billion with Cursor 73.2 percent. Stories about coding tools quadrupled between halves, npm downloads of the category's packages went from 9.5 million to 692.9 million, and its stars fell 36 percent: people using the tools instead of bookmarking them.
Why buyers believe they are buying something: the constraint they feel is the throughput of skilled people, in code, drafts, analysis, and the reading of documents, and they believe a model behind a tool raises the output per person. The concentration means the vendor a small firm ends up with is almost certainly one of three or four names.
What the spend is expected to produce is cycle time: a defined class of work finished sooner without the review burden rising as fast. A buyer knows it worked when a metric named before the purchase moves, pull requests per engineer, time to a first draft, tickets closed without escalation, and knows it is buying attention rather than throughput when no such metric can be named.
Where it goes next is my assumption: the model layer commoditizes at the API, with price per token falling and the providers' capital chasing scale, while the tool layer is where dependence forms, because that is where the firm's context, prompts, and history live. So I would buy the tool for its exit and treat the model as a utility. What would prove me wrong: one provider holding a capability gap for several quarters, visible as coding tools dropping multi-model support, or download growth in the tools stalling while capital keeps arriving.
Synthesis
Agent frameworks became plumbing
What buyers are spending on is almost nothing, and that is the finding. Agent frameworks and MCP has 22 vendors, 21 of them open source, one counted round in two years, LangChain's, and the largest star gain on the map followed by the steepest fall: 259,049 stars in the first half against 49,041 in the second, an 81 percent drop, while npm downloads of the same projects rose 13.6 times, from 97.3 million to 1.32 billion. The Model Context Protocol is the most mentioned name in the category.
Why buyers believe they are buying something: they are not buying frameworks and no longer evaluating them. They are buying agents inside products they already own, and the framework ships inside those products. Downloads up and stars down is what plumbing looks like.
What the spend is expected to produce, for a small firm, is a workflow that runs without a person in it, and the sign it worked is that the automation platform or the vendor's product does it, not that someone in the firm maintains a framework.
Where it goes next is my assumption: the framework layer settles into a protocol plus whatever each vendor ships, and what a small firm should own is its agents' identities, permissions, and logs, the controls my non-human identities piece is about, not the framework. What would prove me wrong: a framework vendor drawing a large round, or firms running their agents on frameworks they maintain themselves.
Synthesis
Identity is the hub nobody is funding
What buyers are spending on is a renewal. The identity provider category has 16 vendors and three of them carry the map, Entra ID with 360 relations, Rippling 203, Okta 156, the next with 18; Entra ID is the target of 359 of its relations and Okta of 154, which is what a control point looks like. The counted capital is 112.5 million on one record, a quarter of Rippling's 450.0 million round; MFA and passkeys counted nothing and its stories fell from 22 to 13. What the event list shows instead is owners changing: Palo Alto Networks completing CyberArk in February 2026, Jamf agreeing to be taken private by Francisco Partners in October 2025.
Why buyers believe they are buying something: the identity provider is the one place a person or an agent is admitted or refused, and every other product integrates with it because the buyer decided years ago. The spend buys the continuation of a control everyone else already assumes.
What the spend is expected to produce is that every application signs in through one place, every non-human identity is inventoried, and access can be revoked in one action. A buyer knows it worked when the sign-on catalog covers the procurement list and a revocation drill takes minutes, and knows it did not when the two lists disagree.
Where it goes next is my assumption: identity stays a mature, low-capital layer whose owners change by acquisition rather than by new entry, so the risk to a small firm is not that the hub disappears but what its owner does with the position at the second renewal. The hedge is portability, a directory that speaks the open protocols and an exit tested once. What would prove me wrong: a new identity provider drawing significant capital, or the hubs' degrees falling as products stop integrating.
Synthesis
The investment-specific categories run on owners, not markets
What buyers are spending on, in the three categories closest to an investment firm's own work, drew 12.0 million dollars between them in two years: Fund administration and investor reporting, 19 vendors and 11.5 million on two records; Portfolio monitoring, 17 vendors and half a million; Cap table and equity management, 6 vendors, nothing counted, no open-source option, no Wikidata item. Stories about all three together total 31. One category over, an asset manager bought one of the map's market-data vendors in March 2025. Absence is not evidence here: these vendors are private, often outside the United States, and file where I cannot read.
Why buyers believe they are buying something: the report to investors and auditors has to go out on schedule with numbers that tie, and the software is the obligation's machinery. This is a compliance and reporting bet, not a productivity one.
What the spend is expected to produce is a close that finishes on time and an export that is usable somewhere else. A buyer knows it worked when the report ships and the numbers reconcile, and knows the dependence is real when the export has never been tested.
Where it goes next is my assumption: with no market capital to read, the durability of these vendors is a question about their owners, and consolidation by acquisition is more likely than new entrants. A small firm should assume any one of them could change hands within a contract term, keep a second supplier's name on file, and test the export once a year. What would prove me wrong: counted capital arriving in the category, or an open-source alternative appearing.
Proposal
Write the thesis before the renewal
The map earns its keep when a firm's own vendor list is laid over it and each category the firm depends on gets a thesis it can be wrong about. The companion worksheet, Stack map review, is the record.
- List every vendor the firm pays for or depends on, free tiers and self-run open-source projects included. The procurement export starts the list; the identity provider's application catalog checks it, because it knows about the tools nobody told finance about.
- Place each vendor in one of the 67 categories. A vendor that fits none is a finding: a gap in the map, or a purchase outside the stack the firm says it runs.
- For each category the firm depends on, write one line each: the thesis, what the category is buying down; the outcome, with the measure that would show it; and the signal that would change the firm's mind. The five above are mine; a firm's own will differ where its work does.
- For each, note from the signals summary whether the firm's vendor is drawing the money or being drawn from. The first is a question about its next price, the second about its owner and roadmap at renewal.
- Where the firm's vendor is a hub, record what would break if its terms, owner, or API changed and who would deal with it, and test the three connections the firm depends on most rather than trusting the directory count. Where the category is thin, record the export you tested, the date, and the second supplier you would call.
- Date the review and set the next trigger: a filing that moves the largest share in a category the firm depends on, an acquisition in a thin category, a new hub connection, or the renewal of the largest hub.
The result is a one-page picture of what the firm believes about each market it buys from, what it expects the money to produce, and what would change its mind.
Open question
Whose floor shows the market?
The signal I most wanted is the one I could not get. Who pays for a booth at RSAC or Black Hat is the plainest public statement of what the security industry is selling this year, and both sites refused an identified fetcher, while the DEF CON floor that was readable sells hardware and books. Form D has its own lag, a filing follows the sale and the data sets follow the quarter, and 761 of the 825 vendors have no funding record at all. Each thesis rests on capital, attention, and adoption because those were open. A floor list would confirm or embarrass the first of them, and I will add it the day a directory is published in a form its owner allows a script to read.
Where the map lives
The data is CC0 in the public library, and the site draws it at /landscape: categories first, sized by vendor count and joined by the summed relations between them, with vendors shown only when a category is opened, because the stack is legible at the level of the category, which is where a purchase is decided. The signals sit beside it as one summary with its JSON and its attributions.