Atlas of Cybersecurity

The business of cybersecurity in maps and charts: 64 plates in 8 chapters, by Atul Tiwary, Managing Partner, El Dorado Capital. First edition, updated October 21, 2026.

Each plate is a chart or map with its sources and chart notes. Figures are carried at their published values; public comps are rebuilt from SEC filings; corrections are dated rather than overwritten. Every plate carries a link to suggest a correction or propose a vendor or data point.

The Atlas is one of four formats of El Dorado Capital's research practice, with the Cyber Security Wiki, Insights and the Weekly Market Update. How they fit together.

Chapter 1: History & Geography

1.1 The First Worm — The 1988 Morris worm and the network it crossed
1.2 Antivirus to Platform — Product generations by decade, 1987 to today
1.3 Unit 8200 Alumni — Israeli military units and the companies their veterans founded
1.4 Fort Meade's Neighbors — Vendors located around the NSA in Maryland
1.5 The Firewall Family Tree — Founder lineages from Check Point onward
1.6 The Public Cohort — Security IPOs since 2007 and what became of each
1.7 Names That Vanished — Brands absorbed by their acquirers
1.8 A World of Vendors — Headquarters of security vendors by country

Chapter 2: Segments & Markets

2.1 Markets at a Glance — Security spend by category
2.2 The Vendor Map — Number of vendors in each segment
2.3 Identity Takes the Center — Identity vendors and the deals among them
2.4 Firewall to SASE — Network security's move to the cloud
2.5 The Endpoint Contest — Share shifts from antivirus to EDR and XDR
2.6 The Email Gate — Email security vendors and who owns them
2.7 Product and Service — Software revenue against MSSP and MDR revenue
2.8 The Public Comps — Revenue multiples of listed security companies

Chapter 3: Investors & Deals

3.1 The Largest Deals — Acquisitions announced at $3B or more
3.2 The Sponsor Portfolio — Private equity buyouts of security vendors, by firm
3.3 Venture by Vintage — Funding by stage and year
3.4 Serial Acquirers — Deal count by buyer
3.5 The Unicorn Herd — Private companies valued above $1B
3.6 Exit Routes — IPO, strategic sale and sponsor sale, by year
3.7 Hold Periods — Entry and exit dates of sponsor-owned vendors
3.8 Israel's Exits — Acquisitions of Israeli-founded companies

Chapter 4: Channel & Technology

4.1 Route to Market — Vendor to distributor to reseller to customer
4.2 The Distributors — Security distribution by region
4.3 The Marketplace Shift — Security sold through cloud marketplaces
4.4 Managed Security — MSSP and MDR providers by region
4.5 The Platform Bet — Product lines per vendor
4.6 AI in the SOC — Where AI products sit in security operations
4.7 Securing the Agents — Vendors protecting AI models and agents
4.8 Open Source Roots — Commercial vendors built on open source projects

Chapter 5: Hubs & Clusters

5.1 Tel Aviv — Companies, investors and acquirers' R&D centers
5.2 The Bay Area — Headquarters from San Francisco to San Jose
5.3 The Washington Corridor — Vendors and federal customers in DC, Maryland and Virginia
5.4 London — UK vendors and their investors
5.5 Bengaluru — Engineering centers of global security vendors
5.6 Boston and Route 128 — Vendors and the universities behind them
5.7 Founder Migration — Where founders studied, served and started companies
5.8 Engineering Abroad — R&D sites located away from headquarters

Chapter 6: Breaches & Crises

6.1 NotPetya — Spread of the 2017 attack by country and company
6.2 SolarWinds — The supply chain compromise disclosed in December 2020
6.3 The CrowdStrike Outage — July 19, 2024, by industry
6.4 Colonial Pipeline — The May 2021 shutdown and US fuel supply
6.5 MOVEit — Organizations affected by one file transfer flaw in 2023
6.6 Equifax — The 2017 breach and what followed
6.7 Change Healthcare — The 2024 attack and US healthcare payments
6.8 After the Breach — Share prices of breached companies

Chapter 7: Regulation & Governance

7.1 Disclosure in 4 Days — Incident filings under the SEC disclosure rule
7.2 GDPR Fines — Penalties by country and company
7.3 NIS2 Across Europe — Adoption status by member state
7.4 CMMC and the Defense Base — Certification requirements for US defense suppliers
7.5 50 State Laws — US breach notification laws by state
7.6 The Cyber Insurers — Premiums and carriers
7.7 The CISO in Court — Enforcement actions naming security executives
7.8 The Spyware Controls — Export controls and sanctions on commercial spyware

Chapter 8: Adversaries & Society

8.1 Named Groups — State-linked threat groups by country
8.2 The Ransomware Economy — Groups, affiliates and payments
8.3 Following the Ransom — Cryptocurrency flows after payment
8.4 The Workforce Gap — Unfilled security roles by region
8.5 Bug Bounties — Payouts by program and researcher country
8.6 The Fraud Compounds — Scam operations in Southeast Asia
8.7 Critical Infrastructure — Attacks on water, power and hospitals
8.8 The AI Attacker — AI use in documented attacks