Data Gravity Ecosystem
Security data lake, analytics infrastructure, log retention, query economics. The platform owns where the data lives; what comes out of it (detection, compliance, analytics) attaches above.
"Bring security to where our data already is." Data-platform-attached security vendors trade some autonomy for the buyer's sunk-cost commitment to the data layer.
The data platform takes the storage and compute revenue; your product runs on top with smaller infrastructure margins but very high integration value. Joint customers see lower TCO than separate-product equivalents — that's the alliance pitch.
Marketplace listing + native connector + joint reference architecture + co-sell into the data platform's enterprise installed base. Snowflake and Databricks both have formal partner programs with measurable pipeline.
If the data platform builds its own security analytics layer (and they all are), your category becomes a feature. Differentiate on security expertise (rule quality, detection engineering, response automation) the data platform won't want to build.
Treating the data platform as just storage. The platform vendor's analytics roadmap is the most relevant competitive threat; track it monthly, not annually.