MAAT INDEX
Themes

Tool consolidation / vendor consolidation to platforms in observability & security

27 statements on the record across 3 companies, ordered by how much each has said. Every quote is verbatim from its call.

THE FIFTEEN-SECOND READ

Across observability and security, vendors converge on a shared narrative that customers want fewer, unified platforms rather than fragmented point tools, with CHKP's Shwed citing client demand for consolidated architectures [m798] and PANW's Arora citing Gartner data that 45% of organizations will use fewer than 15 security tools by 2028, up from 13% in 2023 [m1032]. DT has tracked this shift most quantitatively, with McConnell and Benson noting since 2024 that customers are outgrowing DIY and dashboard tools [m1459, m1457], that deals over $1 million ACV rose 39% year over year by November 2024 [m222, m223, m224, m236, m209, m225], and that dollar contribution from such deals grew 55% year over year by Q3 2025, extending into seven-figure wins consolidating log management into end-to-end observability by May 2026 [m1858, m1835, m560, m552, m559, m567]. PANW's Arora has pushed the platformization thesis further, framing fragmentation itself as a latency risk to real time cybersecurity and pointing to a 50% year over year rise in peer mentions of platform strategy on earnings calls [m1030, m1031, m85], while reaffirming the company doubled down on platformization over a year ago amid large deal momentum [m88]. The main divergence is in specificity and timing variability, with DT repeatedly flagging that larger strategic deals introduce quarter to quarter closing unpredictability even as consolidation deal flow keeps growing through 2025 [m257, m264, m241, m2034, m2028, m1869, m1870].

DT21PANW5CHKP1
DT21 statements

Since August 2024, McConnell has framed vendor consolidation and standardization as a key enterprise priority, with customers outgrowing DIY and dashboard tools for a unified observability platform. [m1459, m1457] By November 2024, Benson quantified this trend, noting deals over $1 million ACV rose 39% year over year, while both executives flagged that larger strategic deals add timing variability. [m222, m223, m224, m236, m209, m225] Through 2025, McConnell and Benson repeated that the market favors fewer solutions and that consolidation deal flow keeps growing, though close timing remains variable each quarter. [m257, m264, m241, m2034, m2028, m1869, m1870] In Q3 2025 McConnell reported dollar contribution from deals over $1 million grew 55% year over year, and by May 2026 pointed to seven-figure ACV wins consolidating log management into end-to-end observability. [m1858, m1835, m560, m552, m559, m567]

Show the 21 verbatim statements
#m1459 · 2024-08-02 · Rick McConnell · STATED

And third, vendor consolidation and standardization across their organizations are key priorities.

#m1457 · 2024-08-02 · Rick McConnell · STATED

Second, large enterprises continue to outgrow their DIY open-source and competitive dashboard and monitoring tools, seeking instead a much more dynamic, fully unified observability platform.

#m225 · 2024-11-02 · Jim Benson · STATED

At the same time, given the larger values of these strategic deals and the C-level approvals that they require, they introduce increased variability in terms of timing required to close.

#m236 · 2024-11-02 · Jim Benson · STATED

Even our current customers are starting to consolidate their toolsets, making decisions about DIY tools and other commercial solutions.

#m222 · 2024-11-02 · Jim Benson · STATED

More specifically, within the sales funnel, we are seeing a growing number of larger and more strategic deals related to observability architecture and vendor consolidation initiatives, and we expect this directional heading to continue.

#m223 · 2024-11-02 · Jim Benson · STATED

To give you a sense of the magnitude of this trend, the number of deals in the pipeline greater than $1 million of ACV, both new logo and installed base, has increased 39% compared to the same quarter last year.

#m224 · 2024-11-02 · Jim Benson · STATED

We view the growing number of these deals as a sign that the increasing complexity of managing fragmented tools is becoming unmanageable, and customers are looking for a partner to help them drive business value and tool consolidation.

#m209 · 2024-11-02 · Rick McConnell · STATED

While these deals are a positive sign of future growth potential, near term, these larger deals add a degree of variability as customers require more time to make these strategic decisions.

#m257 · 2025-05-02 · Rick McConnell · STATED

We believe the market is increasingly playing to our strengths in moving toward fewer solutions with a need for actionable insights, leading to rapid incident resolution and prevention.

#m264 · 2025-05-02 · Jim Benson · STATED

First, the dynamic macro environment and current market choppiness. Second, the growing trend of a larger observability architecture and vendor consolidation deals comes with an increased level of timing variability. And third, the evolution of our go-to-market strategy will take time to settle in and mature.

#m241 · 2025-05-02 · Rick McConnell · STATED

Moreover, we continue to see customers looking to consolidate siloed monitoring tools and standardize on an end-to-end observability platform. The advantages of such an approach typically include increased productivity, reduced cost, improved security, and a more consistent user experience.

#m2034 · 2025-08-02 · Jim Benson · STATED

Second, we continue to benefit from the growing trend of large observability architecture and vendor consolidation deals. As we have said in the past, these deals equally come with an increased level of timing variability.

#m2028 · 2025-08-02 · Rick McConnell · STATED

We believe the market is playing to our strengths by moving toward fewer solutions with a growing need for actionable insights and visibility.

#m1869 · 2025-11-02 · Jim Benson · STATED

Second, the trend of larger and more strategic deals related to observability platform architecture and tool consolidation initiatives continues to grow. The sales funnel is weighted heavily to these types of deals.

#m1835 · 2025-11-02 · Rick McConnell · STATED

Aggressive cloud expansion has, however, contributed to tool sprawl within organizations resulting both in operational inefficiency and high costs. It's not uncommon for companies to have more than a dozen internal and external observability tools and aim to consolidate them into a more effective, unified, and lower cost approach.

#m1870 · 2025-11-02 · Jim Benson · STATED

While we believe this trend is a net positive for Dynatrace given our highly differentiated AI-powered platform and positions us well to capitalize on these opportunities, it also introduces increased variability in terms of both close timing and deal certainty.

#m1858 · 2025-11-02 · Rick McConnell · STATED

We are benefiting from increased customer interest in end-to-end observability and tool consolidation. In Q3, the dollar contribution of deals greater than $1 million grew 55% year-over-year.

#m560 · 2026-05-02 · Rick McConnell · STATED

By integrating that into an end-to-end observability framework, we find that customers are getting better outcomes at lower overall costs. That's why they're coming to Dynatrace—they want an integrated platform.

#m552 · 2026-05-02 · Rick McConnell · STATED

many of our seven-figure ACV wins in the quarter were with customers looking to modernize their log management solutions, consolidating logs from multiple vendors as part of a broader end-to-end observability strategy.

#m559 · 2026-05-02 · Rick McConnell · STATED

The short form is all the log vendors, the traditional log vendors that you might imagine. The strong waves of change, I think, in the market are towards integrated solutions and then observability. This is rendering that isolated log solutions just aren't delivering on customer needs.

#m567 · 2026-05-02 · James Martin Benson · STATED

The play that is really resonating and we're getting good traction with is end-to-end observability. In end-to-end observability, it almost always includes the discussion about logs.

PANW5 statements

Arora cited Gartner forecasting that by 2028, 45% of organizations will use fewer than 15 cybersecurity tools, up from 13% in 2023, framing the consolidation opportunity. [m1032] Arora said Palo Alto Networks has long advocated consolidating point products into platforms, and noted peer mentions of platform on earnings calls rose 50% year over year. [m1030, m1031] Arora later argued the industry must shift from fragmented security to consolidation, framing fragmentation and friction as latency risks to real time cybersecurity. [m85] Arora reaffirmed that the company doubled down on its platformization strategy over a year ago, citing large deal momentum and broad industry endorsement. [m88]

Show the 5 verbatim statements
#m1032 · 2025-02-13 · Nikesh Arora · STATED · by by 2028

Gartner sees 75% of security leaders actively pursuing a vendor consolidation strategy, although less than 15% of large enterprise customers have implemented at least one security platform solution. Gartner expects that by 2028, 45% of organizations will use fewer than 15 cybersecurity tools in their product portfolio, up from 13% of organizations in 2023.

#m1031 · 2025-02-13 · Nikesh Arora · STATED

More recently, our industry peers have been evangelizing the virtues of platformization, and industry experts have begun to weigh in. I had our teams go back and compare the growth in the mentions of the word platform on cybersecurity earnings calls this year versus last year, and we found an overall 50% increase amongst our peers.

#m1030 · 2025-02-13 · Nikesh Arora · STATED

We've been talking about the benefits of simplifying security architectures and consolidating point products into platforms for a while now.

#m85 · 2025-08-18 · Nikesh Arora · STATED

This is precisely why industry must change the paradigm, shifting away from today's fragmented security landscape and towards consolidation. The cause of fragmentation is friction. Friction causes latency. Latency is the enemy of real-time cybersecurity.

#m88 · 2025-08-18 · Nikesh Arora · STATED

Over a year ago, we doubled down on our platformization strategy. We're pleased with the large deal momentum we've had since and the endorsement of our strategy broadly across the industry.

CHKP1 statement

Check Point's CEO Gil Shwed said the company is well positioned as clients increasingly seek consolidated solutions and unified architectures. [m798]

Show the 1 verbatim statement
#m798 · 2024-07-24 · Gil Shwed · STATED

We are more prepared than ever for this shift, as clients increasingly seek consolidated solutions to enhance efficiency and security in their operations. The demand for more unified architectures is on the rise.

OPEN is an unresolved commitment on the clock; STATED is on the record without a checkable bar and is never counted or scored. Method: methodology.