The front line of cyber war is your laptop and your network connection

The reason is simple: almost every attack ends up on a "device" or runs through a "line." A hacker who wants to steal data has to reach a server; one demanding ransom (ransomware) has to run code on the victim's machine; one exfiltrating data has to run it through the network. So these two layers are the "last checkpoint" — catch it here and the attack is over; miss it here and the damage is done.

And both sides are big, fast-growing markets. The endpoint side is worth roughly $27–28B in 2025 and is headed for about $38B by 2030, with EDR as the engine — growing nearly 25% a year (from ~$5B to ~$15B by 2030). The network side, now moving to the cloud (SASE), is even hotter — Gartner estimates it'll jump from ~$15B in 2025 to ~$28.5B in 2028, growing ~26% a year.

But the number that tells the story best is the shift in tooling inside the endpoint market itself. The old stuff (signature-based antivirus) is growing slowly or shrinking; the new stuff (AI-driven EDR/XDR) is growing ~25% a year — meaning money is moving fast from "dumb antivirus" to "AI that watches behavior." That's the heart of this whole chapter.

The endpoint side has its own turning point — about 79% of modern attacks use "living off the land," relying on tools already built into the operating system and leaving no malware file for old antivirus to scan. That's what flipped EDR/XDR — which watches "behavior" instead of "file appearance" — from a nice-to-have into a must-have.

The easiest way to understand this node is to look at "two revolutions" happening at once — one on the device, one on the line.

Revolution 1: from antivirus to EDR/XDR

Old antivirus worked like a "wanted poster with mugshots" — it held the signatures of viruses it already knew, and blocked any file matching a face on the list. The problem: new malware that was never on the list was completely invisible to it.

EDR (Endpoint Detection & Response) flipped the whole idea. Instead of looking at "appearance," it watches "behavior" — a tiny agent on the device watches every action: which program is suddenly encrypting all the files at once? Is some strange process trying to steal passwords from memory? When it spots a suspicious pattern, it doesn't just alert — it steps in and stops it immediately (kills the process, isolates the machine from the network). That's the "Response" part. XDR then widens the view beyond the device, seeing signals from email, cloud, and network at once, and stitching them into one picture.

Revolution 2: from firewall in the building to SASE in the cloud

Network security used to be like a "castle and moat" — everyone worked in the building, all data ran through one firewall box at a single door, and anyone inside the wall was treated as "trusted." But the world changed — people work from home, from cafés, from their phones, and apps all moved to the cloud — so the "castle" no longer had a wall to defend. Forcing a remote employee to "run back into the building" to pass the firewall before going out to the cloud is both slow and pointless.

SASE (Secure Access Service Edge) solves it by moving the checkpoint up to the cloud, spread close to every user worldwide. Wherever you are, your connection always passes through the nearest checkpoint first. It pairs with the zero-trust idea — "trust no one automatically, check every time" — whether you're inside the wall or outside it.

This node is the "hands that step in and stop things" within the Cybersecurity & Digital Trust megatrend. But it can't work alone — it has to coordinate with its siblings in the same family:

• Pairs with Identity & Access: for zero-trust to work, you first have to "know" who's who — Identity says "you are X, with these rights," then Network Security enforces those rights at the entrance
• Feeds Security Operations (SOC): EDR/XDR are the "sensors" sending raw signals from every machine into the central SOC, which investigates and connects the big picture — endpoint is the eyes, ears, and hands; the SOC is the brain
• Overlaps with Cloud & Workload Security: when the "device" becomes a virtual server or container in the cloud, the line between endpoint and cloud security blurs — so modern XDR moves into this space too
• Rides the same network as Edge & CDN: SASE delivers security from the "edge" of the internet — the same edge network used to deliver web and video fast is used to set up security checkpoints close to users (which is why Cloudflare and Akamai can play both games)

And it reaches outside the cyber category too — AI is a weapon for the defense (AI watching behavior) and for the offense (hackers using AI to build malware). Meanwhile all of security still rests on encryption, which is set to be challenged by Quantum Computing down the road.

2025 was the year the picture of "who owns what" came into sharp focus. The endpoint leader is CrowdStrike — its "Falcon" agent pushed ARR (annual recurring revenue) to ~$5.3B (up ~24%) in its latest fiscal year, and the company has set a clear target of reaching $10B in ARR.

On the network/platform side the big one is Palo Alto Networks — FY2025 revenue was $9.22B, and what it stresses is "NGS ARR" (recurring revenue from next-gen products), which grew to $5.58B (+32%) — reflecting a "platformization" strategy that pushes customers to buy the whole stack from one vendor. Meanwhile Zscaler, the zero-trust/SSE pioneer, crossed $3B in ARR for the first time in FY2025 and is still growing more than 25% a year.

The most exciting thing financially is CrowdStrike's still-strong ARR growth and Palo Alto pushing NGS ARR past $5.5B — both reflecting the same trend: customers are consolidating their tools with one vendor instead of buying piecemeal.

ภาพประกอบ (platform.png)

But the biggest story for this node in years isn't about revenue — it's the July 19, 2024 event, when CrowdStrike shipped a buggy update in a single file and roughly 8.5 million Windows machines worldwide hit the Blue Screen of Death all at once — airlines, hospitals, banks, and emergency lines went down on a wide scale. Insurers pegged the damage to Fortune 500 companies alone at about $5.4B. And the painful part — it wasn't a hack, it was the "defense" collapsing on its own (we dig into this event in EDR/XDR).

There are also giants "playing both sides," like Microsoft (Defender comes bundled with Windows/365, making it a major rival to everyone) and Cisco (which bought Splunk to bolster the SOC side) — a sign this arena isn't just a fight among pure cyber companies; the platform giants have jumped in to grab a share too.

The biggest direction for this node is one word: "consolidation." For years, organizations bought dozens of brands of security tools — one vendor for endpoint, another for firewall, another for email — until managing it became a headache and gaps opened at the seams. Gartner estimates that by 2025 about 70% of organizations will cut the number of security vendors they manage to no more than three. That's why Palo Alto, CrowdStrike, and Fortinet are all racing to build "platforms" that sell the whole stack — whoever bundles the most tools that work together most smoothly captures the customer's entire security budget.

The second direction is AI moving into the SOC room. The volume of alerts from endpoint/network is too much for people to keep up with, so "AI SOC agents" step in to triage, do first-pass investigation, and auto-contain threats — in Gartner's 2025 survey, about 42% of cyber leaders are already testing or using AI agents to detect and respond to threats, and another ~46% plan to within the next year. EDR/XDR's job is shifting from "send signals for people to look at" to "let AI decide for itself, to a degree."

The third direction is fusing endpoint and network into one. As XDR sees both device and line in a single picture, and SASE delivers security from the cloud, the line between "protect the device" and "protect the line" keeps fading — until it becomes one continuous security fabric that follows the user's "identity" everywhere, no matter which device they use or where they connect from.

This node is in a golden age. But the risks are built deep into its very nature.

The first risk is the concentration and fragility of an agent that's everywhere. CrowdStrike's July 19, 2024 lesson is the clearest warning — when one piece of software sits on millions of machines worldwide with the deepest-level rights in the system, a single bad file in an update can take the world down. It's a "single point that, if it breaks, breaks everything" — in a way even an attack would struggle to pull off. The more the market consolidates toward a few leaders, the higher this concentration risk climbs.

ภาพประกอบ (outage.png)

The second risk is an "AI war" where both sides have the same weapon. The defense uses AI to watch behavior, but the offense uses AI too — to build malware that adapts to evade detection, write smoother phishing emails, and find vulnerabilities faster. It's a race with no finish line — whoever stops improving loses instantly, and the defender's cost is almost always higher than the attacker's.

The third risk is being "bundled" out of existence. Microsoft ties Defender to Windows and Microsoft 365 for free (or near-free), creating enormous pressure on players who sell security as a standalone product. Anyone without a broad enough platform or a sharp enough edge risks being squeezed out of the market by a giant's "freebie."

In short: this node is the "front line" that actually stops attacks at the two points every threat must cross — the device and the line. Over five years it's been remade from dumb antivirus into behavior-watching AI, and from a firewall box in the building into security delivered from the cloud everywhere. The battle has now moved from "who has the better feature" to "who can merge everything into one platform best" — and the July 19, 2024 lesson reminds us that the more we lean on a single guardian, the harder the world shakes the day it stumbles.