The lexicon.

Trusted advisor channels — vCISO firms, compliance consultancies, cyber insurance brokers, risk advisors — who guide buyer decisions but don't transact.

Attack Surface Management. Continuously discovers and inventories an organization's external-facing attack surface — domains, hosts, exposed services, shadow IT.

The chained sequence of conditions an attacker would exploit to reach a goal — vs. a list of independent vulnerabilities or misconfigurations.

A displacement pattern: "keep your stack, add us where it's blind." Sells a precise gap, not a replacement.

The existing budget line item a new vendor positions against — the money the buyer is already spending that the new spend will offset, displace, or augment.

The GTM climate a funding stage imposes — whether a raise forces a land-grab, a knife-fight, a consolidation, or an early-formation motion.

When growth, valuation, or exit pressure — not customer evidence — forces a vendor to chase larger accounts before the business can repeatably win them.

When a vendor borrows the language of a hotter adjacent category — CTEM, AI SOC, CNAPP, exposure management — to look more strategic than current delivery supports.

When the vendor direct sales team and a partner compete for the same deal — or two partners compete for the same deal.

Marketing programs designed to recruit, enable, activate, and measure indirect partners — MSPs, MSSPs, VARs, SIs, marketplaces, alliances — rather than end customers directly.

The sales motion run through partners — VARs, MSPs, MSSPs, marketplaces, SIs — rather than directly through the vendor's own quota-carrying sellers.

Cloud Infrastructure Entitlement Management. Discovers and rightsizes the cloud-permissions surface — who/what has what access in AWS/Azure/GCP.

AWS / Azure / GCP procurement venue where buyers draw down committed cloud spend against third-party software.

Cloud-Native Application Protection Platform. Consolidates cloud security across posture (CSPM), workload (CWPP), entitlements (CIEM), and runtime.

Joint marketing executed by vendor and partner together — co-branded campaigns, webinars, regional roadshows, executive workshops — typically funded by MDF.

Joint sales motion with a platform-vendor partner — joint accounts, joint pipeline reviews, joint comp.

A displacement pattern: "we collapse several tools you already pay for into one." Trades tool sprawl + budget pressure for a single vendor relationship.

Cloud Security Posture Management. Finds and flags misconfigurations and policy violations across cloud infrastructure (AWS, Azure, GCP).

Continuous Threat Exposure Management. Gartner-coined umbrella for ongoing identification, prioritization, and validation of attack-paths and exploitable exposure.

Cloud Workload Protection Platform. Runtime protection for cloud workloads — VMs, containers, serverless — with detection, response, and exploit-prevention.

Process by which a partner claims a specific opportunity with a specific customer — protects margin and prevents two partners (or partner vs direct) from competing on the same deal.

The competitive pattern by which a new vendor takes budget or surface area from an incumbent. Not the same as "competing" — displacement names which incumbent is losing what.

What a deal actually replaces — the budget line, tool, service, internal team, or tolerated mess — as opposed to the named competitor in the CRM.

Two-tier wholesale channel partner — sells to VARs and MSPs, not to end customers.

Data Loss Prevention. Inspects content and context across endpoints, networks, and cloud to block sensitive data from leaving the perimeter.

Data Security Posture Management. Discovers where sensitive data lives across cloud and SaaS, classifies it, and flags where it's exposed.

The pull exerted on a deal by platforms, partners, resellers, MSSPs, and procurement paths — the influence a named-competitor field never captures.

Endpoint Detection & Response. Records endpoint behavior, detects threats, and enables response actions on workstations and servers.

OEM arrangements where a vendor's technology ships inside another vendor's product, often without end-customer visibility into the supplier.

When one or two impressive enterprise logos are mistaken for repeatable enterprise motion — exception read as pattern.

When the axis a market grades vendors on decouples from the outcome buyers actually care about — the rubric keeps measuring what has stopped predicting value.

The set of conditions in an environment that a threat could exploit — vulnerabilities, misconfigurations, over-permissioned identities, exposed data, weak controls.

When a category's deal count falls while its dollar volume rises — capital consolidating around fewer winners, and an early motion signal.

Governance, Risk & Compliance. Manages policies, controls, risk registers, and audit evidence — the operational layer for proving the security program works.

Global Systems Integrator. Accenture, Deloitte, EY, KPMG, IBM, PwC, Capgemini, Atos, NTT — large multinational firms that implement and operate enterprise architecture and transformation programs.

Programmatic management of the people-layer of security risk — beyond awareness training, into behavior measurement, role-based exposure, and targeted intervention.

Identity & Access Management. Authenticates users, authorizes access, manages the lifecycle of identities (human and machine) across systems.

The growth a round's economics demand of a company, independent of what its market can bear. The gap between the two is where go-to-market motions break.

Identity Threat Detection & Response. Detects identity-based attacks — credential theft, MFA fatigue, lateral movement using legitimate credentials.

The motion a growth round forces when the field is already closing — capital funds displacement and survival against entrenched rivals rather than greenfield capture.

The capture motion a growth round forces when the category field is still open — spend ahead of revenue to take share before it is contested.

A displacement pattern: "buy the result, not the tool." Sells the service wrapper around the technology.

Custom pricing or terms negotiated between the vendor and the buyer, transacted through a cloud marketplace.

Marketing Development Funds. Vendor-provided budget that partners can spend on jointly-approved marketing activity — events, campaigns, content, demand generation.

Managed Detection & Response. A vendor runs detection-and-response operations on the customer's environment as a service.

The cyber market's shared technique taxonomy — and its de facto comparison grid: the yardstick vendors map coverage to, analysts grade against, and buyers compare on.

Managed Service Provider. Operates IT for small and mid-market customers; sells security as part of an IT bundle.

Managed Security Service Provider. Operates security tooling on behalf of customers — runs the SOC, the EDR console, the SIEM, the response playbook.

Original Equipment Manufacturer arrangement — your product becomes a capability embedded inside another vendor product.

A displacement pattern: "we make your existing controls operational together." Sells the connective tissue, not the controls.

Privileged Access Management. Vaults, rotates, and gates access to privileged credentials and sessions — the keys to the kingdom.

Formal credentials a vendor issues to partner staff who complete training and pass assessments — sales certified, technical certified, deployment certified, operating certified.

The assets, training, and certification a vendor provides so partners can sell, deploy, and operate the product — decks, battlecards, demos, integration guides, certification paths.

Ideal Channel Profile — the partner-recruitment equivalent of buyer ICP. Specifies which partner types, sizes, certifications, customer bases, and category adjacencies the program targets.

Marketing run jointly with channel partners — co-branded content, joint campaigns, partner-led webinars, distributor roadshows — to surface the vendor's product through the partner's customers.

The vendor-operated web property where partners access deal registration, training, sales assets, MDF requests, lead routing, certification tracking, and program reporting.

Structured levels in a partner program — Authorized / Silver / Gold / Platinum or similar — that gate margin, MDF, deal protection, and co-sell access based on investment and performance.

ARR or bookings transacted through a partner's paper — VAR, distributor, marketplace — even when the vendor sourced and ran the deal.

Pipeline where a partner participated in the deal at some point — referral, technical validation, implementation pre-sales, or transaction.

Pipeline where the partner identified the opportunity and brought it to the vendor — not pipeline the vendor created and then ran through a partner.

Importing enterprise buyer assumptions — CISO, VP Security — into segments where that buyer is scarce or absent and security is owned by IT, an MSP, or a fractional advisor.

The structural movement of cybersecurity from best-of-breed point products toward integrated platforms — Palo Alto, Crowdstrike, Microsoft, Wiz, Cisco.

When a vendor's external competitive story migrates toward the market it wants to win, away from the customers it actually serves and the outcomes it reliably delivers.

Trusted third party who recommends the vendor to a buyer — IR firms, cyber insurers, advisory shops, vCISO networks.

Regional Systems Integrator. National or regional implementation firms — Optiv, GuidePoint, Trace3, Presidio, WWT, SHI — that sit between GSIs and pure resellers.

The documented policies that govern when partners and direct sellers can pursue the same account, how disputes resolve, who gets credit, and how compensation handles overlap.

Implementation, deployment, tuning, or operational services sold alongside a software product, measured as services revenue per software dollar (typical healthy range 0.3x–1.5x).

Security Information & Event Management. Aggregates security logs from across the environment for correlation, alerting, and investigation.

Security Orchestration, Automation & Response. Workflow automation for incident response — connects tools into runbooks that triage and act.

The discipline of separating partner-sourced pipeline (partner created the opportunity) from partner-influenced pipeline (partner helped progress an existing deal) — two distinct metrics.

Large services firm that designs, integrates, and implements complex enterprise security programs.

When the shared classification a market organizes around has no category for a behavior that has become decisive — and the market's comparison grid inherits the blind spot.

Structured partnership with a platform vendor whose ecosystem your product attaches to — Microsoft, AWS, Google, CrowdStrike, Palo Alto, ServiceNow, Snowflake, Okta, CyberArk, Zscaler, and similar.

Third-Party Risk Management. Assesses, monitors, and manages security risk introduced by vendors, suppliers, and other external parties.

Value-Added Reseller. Resells vendor product, usually with implementation, integration, or training attached.

The narrow, specific entry point a vendor uses to land — the precise problem they solve before they expand to adjacent problems.

Extended Detection & Response. Correlates signals across endpoint, network, identity, cloud, and email into a unified detection layer.