Security (EDR, SIEM, SOAR)
Platform market (siem/soar content hubs and edr marketplaces). The Kin Score Market layer reads each provider in its market: who it integrates with, how deep those integrations go, and where the market publishes its own structure. Methodology.
Where this market publishes its structure
- Microsoft Sentinel Content Hub (Azure/Azure-Sentinel SolutionMetadata.json, support tier) machine-readable
- Palo Alto Cortex XSOAR marketplace (demisto/content pack_metadata.json, support + certification) machine-readable
- CrowdStrike Marketplace (server-rendered listings, Built by) machine-readable
- Splunkbase incl. Splunk SOAR apps (reused from the observability sweep) machine-readable
- Elastic Package Registry security integrations (reused from the observability sweep) machine-readable
- SentinelOne Singularity Marketplace not machine-readable: client-rendered
- Google SecOps / Chronicle parsers not machine-readable: no public partner catalog repo
Own = declares at least one integration itself; covered = visible only because an aggregator, standards body, regulator or partner contract names it; distribution-only = listed only on cloud marketplaces it sells through, a channel reported beside, never counted as its own declared integrations; undeclared = nothing we can read, so no number; declares_compatibility = providers with a `compatible` shape vote, report only (kin, 2026-10-13): never counted as own, never in depth or position.
Taxonomy how this market maps onto apis.io
Derived 2026-10-23 from the 25 providers in this market we could resolve in the catalog. The percentage is the share of those providers carrying each one; it describes the market, not the tag or industry. Tag groups have no page of their own yet, so they are listed unlinked.
| Tags | Security 60%, Cloud Security 52%, Cybersecurity 44%, Threat Intelligence 32%, SIEM 32%, Vulnerability Management 24%, Threat Detection 24%, Endpoint Security 24%, XDR 20% |
|---|---|
| Tag groups | Security 96%, XDR 20% |
| Industries | Cybersecurity & Identity 100%, Developer Tools & DevOps 32% |
| Areas | Security 60%, Authentication 12% |
| Capabilities | Cybersecurity Management 60% |
share of resolved cohort carrying it; tags >=0.20 & >=3 members (max 12, junk dropped), tag_groups >=0.20 (cooccurrence, non-cross-cutting; max 8), industries >=0.20 (max 6), areas >=0.10 (max 6; areas are keyword-matched and sparse), capabilities L1 >=0.20 (max 8); derive-market-taxonomy.py
Leaders by position (provisional)
Provisional: grouped by position, depth compared within a position only. Distribution (cloud marketplaces) and iPaaS bridges are counted beside position, never inside it. Unknown-builder listings are left out of position shares and counted here.
gravity 4 · other companies invest to build on it
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|---|---|---|---|---|---|---|
| Okta | 71.0 | 8420 | 1746 / 6674 | 6639 | 4 | 36 | partner-built 21%, unknown 78% |
| Splunk | 62.0 | 1893 | 1316 / 577 | 396 | 1 | 10 | partner-built 70%, provider-built 8%, ipaas-bridge 1%, unknown 21% |
| CrowdStrike | 58.8 | 401 | 236 / 165 | 1 | 3 | 1 | partner-built 68%, provider-built 28%, standard 2%, builds-on-platform 2%, distribution 1% |
| Microsoft Sentinel | 51.8 | 501 | 241 / 260 | 17 | 0 | 0 | partner-built 53%, provider-built 44%, unknown 3% |
builds-on 6 · publishes apps on other platforms' stores
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|---|---|---|---|---|---|---|
| Zscaler | 60.8 | 24 | 0 / 24 | 0 | 3 | 1 | ipaas-bridge 4%, contract 12%, standard 28%, builds-on-platform 44%, distribution 12% |
| Netskope | 55.3 | 21 | 0 / 21 | 0 | 3 | 0 | contract 9%, standard 27%, builds-on-platform 50%, distribution 14% |
| Rapid7 | 54.6 | 30 | 0 / 30 | 0 | 2 | 0 | contract 5%, standard 37%, builds-on-platform 47%, distribution 11% |
| Recorded Future | 51.2 | 7 | 0 / 7 | 0 | 1 | 0 | contract 14%, standard 29%, builds-on-platform 43%, distribution 14% |
| Darktrace | 48.4 | 10 | 0 / 10 | 0 | 4 | 0 | contract 8%, standard 17%, builds-on-platform 42%, distribution 33% |
| Cisco XDR | 17.2 thin | 1 | 0 / 1 | 0 | 0 | 0 | builds-on-platform 100% |
standard 7 · listed by a voluntary standard's own directory
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|---|---|---|---|---|---|---|
| Fortinet | 61.4 | 21 | 0 / 21 | 0 | 3 | 0 | contract 9%, standard 50%, builds-on-platform 27%, distribution 14% |
| Trellix | 57.9 | 8 | 0 / 8 | 0 | 0 | 0 | contract 25%, standard 50%, builds-on-platform 25% |
| SentinelOne | 56.4 | 12 | 0 / 12 | 0 | 2 | 0 | contract 17%, standard 42%, builds-on-platform 25%, distribution 17% |
| Proofpoint | 55.8 | 14 | 0 / 14 | 0 | 1 | 1 | ipaas-bridge 7%, contract 14%, standard 43%, builds-on-platform 29%, distribution 7% |
| Tenable | 54.0 | 13 | 0 / 13 | 0 | 1 | 0 | standard 62%, builds-on-platform 31%, distribution 8% |
| Sophos | 52.7 | 12 | 0 / 12 | 0 | 2 | 0 | standard 50%, builds-on-platform 33%, distribution 17% |
| Exabeam | 51.7 | 3 | 0 / 3 | 0 | 0 | 0 | standard 67%, builds-on-platform 33% |
core 2 · builds the connectors its customers need
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|---|---|---|---|---|---|---|
| Palo Alto Networks | 71.7 | 1162 | 232 / 930 | 206 | 0 | 0 | partner-built 22%, provider-built 60%, standard 1%, builds-on-platform 1%, unknown 16% |
| Elastic | 57.0 | 453 | 0 / 453 | 45 | 1 | 2 | partner-built 6%, provider-built 83%, standard 1%, builds-on-platform 1%, unknown 9% |
mixed 5 · no single mode dominates
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|---|---|---|---|---|---|---|
| CyberArk | 57.8 | 17 | 0 / 17 | 0 | 0 | 0 | contract 12%, standard 41%, builds-on-platform 47% |
| Wiz | 55.5 | 22 | 0 / 22 | 0 | 3 | 0 | contract 9%, standard 41%, builds-on-platform 36%, distribution 14% |
| Snyk | 55.2 | 26 | 0 / 26 | 0 | 4 | 1 | ipaas-bridge 4%, contract 7%, standard 37%, builds-on-platform 37%, distribution 15% |
| Qualys | 53.6 | 11 | 0 / 11 | 0 | 3 | 0 | contract 17%, standard 33%, builds-on-platform 25%, distribution 25% |
| Securonix | 50.5 | 9 | 0 / 9 | 0 | 1 | 0 | contract 11%, standard 33%, builds-on-platform 44%, distribution 11% |
undeclared 1 · declares nothing we can read: no number
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|---|---|---|---|---|---|---|
| Microsoft Defender | undeclared | - | - | - | - | - |
Workflows
No in-market workflows yet; bridges: 6 (2 not yet mapped to a capability). In-market workflows only: a step on the market provider's side maps to this market's business capabilities (BC-620), and the partner is not a generic export/notify app (slack, microsoft-teams, pagerduty, servicenow, jira count as in-market here). Other workflows are counted as bridges (including any whose steps do not resolve to a capability yet). Methodology.
Generated 2026-10-24 from API Evangelist's own files; nothing on this page is a model's judgement. Provisional and unweighted; not part of the Kin Score composite or agent readiness. Read the Market layer methodology. Disagree with an edge? Every edge cites its evidence and can be corrected through the normal correction path.