Cisco's $6.1B SentinelOne Buy Creates Third CNAPP Giant Alongside Palo Alto, CrowdStrike

Cisco acquires SentinelOne to complete its CNAPP stack

Cisco announced on June 14, 2026 that it will acquire SentinelOne for $6.1 billion in cash, paying $18 per share — a 40% premium to the prior close. The deal combines SentinelOne's Singularity Cloud workload protection and Kubernetes security with Cisco's existing Hypershield architecture, creating the third major platform competitor in the CNAPP market alongside Palo Alto Networks Prisma Cloud and CrowdStrike Falcon Cloud Security.

SentinelOne reported $683.7 million in revenue for fiscal year 2025, up 35% year over year, serving over 11,500 customers including Fortune 10 enterprises. Cisco's security business generated $4.4 billion in FY2025 revenue, giving SentinelOne access to a substantially larger distribution channel. The combination pushes Cisco into direct competition with Palo Alto and CrowdStrike for enterprises consolidating cloud security posture management, workload protection, and identity entitlement management under a single vendor.

Platform consolidation increases leverage — and lock-in risk

For enterprises already standardized on Cisco networking and security infrastructure, the acquisition creates bundling leverage. Cisco will package Hypershield and SentinelOne cloud security against the cost of maintaining separate CNAPP or CSPM vendors like Wiz, Orca Security, or Check Point CloudGuard. Buyers in Cisco accounts should expect price pressure on standalone CSPM renewals as Cisco sales teams position the combined stack as a TCO play.

The risk is integration execution. Deals of this size typically require 12 to 24 months to merge product roadmaps, data planes, and support organizations. Enterprises depending on SentinelOne's current Singularity Cloud components for configuration assessment, vulnerability management, or Kubernetes security should ask Cisco for a published integration timeline, backwards compatibility commitments, and support windows for existing features. Without explicit roadmap guarantees, buyers face the possibility of forced migrations or deprecated functionality mid-contract.

For Cisco-leaning enterprises, the deal strengthens the argument for consolidating CSPM, cloud workload protection, and endpoint detection into one vendor to reduce tool sprawl and staff training overhead. The trade-off is increased vendor lock-in and reduced negotiating leverage if Cisco becomes the sole provider across network, endpoint, and cloud security.

RFP changes and competitive pressure

The acquisition tightens the high-end enterprise CNAPP field to three primary platform vendors: Cisco, Palo Alto Networks, and CrowdStrike. Enterprises running competitive RFPs should add explicit questions on CSPM and cloud workload integration — unified policy models, shared risk scoring, and a single data plane for posture findings across hybrid and multicloud environments. Ask Cisco to quantify TCO versus maintaining a separate CSPM stack, including license costs and the operational headcount required to manage multiple consoles and alert queues.

Standalone CSPM and CNAPP vendors face increased pressure. Wiz, Orca Security, and Check Point CloudGuard must now compete against three vendors offering endpoint, network, and cloud security in one commercial relationship. For buyers, this creates pricing leverage in renewals with specialist vendors, particularly in accounts where Cisco, Palo Alto, or CrowdStrike already hold endpoint or network security contracts.

Misconfiguration remains the dominant cloud risk

Recent analysis from TierPoint in early June 2026 reinforces that misconfigured cloud resources, compromised credentials, insecure APIs, and limited multicloud visibility remain the most common cloud security risks in 2026. Despite increasing AI-driven attack volume and sophistication, simple misconfiguration-driven incidents still dominate breach statistics. The analysis highlights integrated CNAPP approaches — combining CSPM, cloud workload protection, identity entitlement management, and data security posture management — as the primary vendor strategy for 2026.

For buyers, this data justifies reallocating budget from point CSPM tools focused solely on compliance posture toward platform CNAPP products that address misconfiguration, identity, workload, and data risks in one license. Many enterprises are restructuring cloud security budgets so that 30 to 50% of tool spend is tied to a CNAPP platform rather than separate CSPM, workload protection, and identity management products.

What to watch

Cisco will need to demonstrate integration progress within 12 months to retain SentinelOne customers and convince Cisco-aligned enterprises to consolidate cloud security spend. Buyers should track roadmap announcements, particularly around Hypershield and Singularity Cloud convergence, unified policy enforcement, and multicloud visibility.

For enterprises evaluating CNAPP vendors, the competitive field is now clearer: Cisco, Palo Alto Networks, and CrowdStrike offer endpoint-to-cloud platforms, while Wiz, Orca Security, and Check Point focus on cloud-native CNAPP without endpoint dependencies. The choice hinges on whether consolidating all security under one vendor outweighs the flexibility and specialization of a multi-vendor architecture. Pricing leverage in renewals with standalone CSPM vendors will increase as platform vendors push bundled deals, but migration risk during integration periods remains real.