Cybersecurity Mesh Market

Palo Alto Networks closed its purchase of CyberArk on 11 February 2026, paying USD 45.00 in cash plus 2.2005 of its own shares for each CyberArk share, according to the company announcement, and the deal folded privileged identity straight into a network and cloud security platform. That single move describes the cybersecurity mesh market well. Cybersecurity mesh is a security architecture in which identity, policy and analytics are shared across separate controls, so a firewall, an access broker and an identity vault act as one system; the market covers the software, cloud subscriptions and services that build that shared layer. Douglas Insights sizes the Cybersecurity Mesh market at USD 2.24 billion in 2025, from 38,400 enterprise mesh deployments at an average annual contract of USD 58,300, and expects USD 6.77 billion by 2035, a revenue CAGR of 11.70% for 2026 to 2035. The study is filed under our enterprise software coverage, and every figure follows the Douglas Insights research methodology.

Which vendors and companies win cybersecurity mesh contracts as platforms consolidate?

Palo Alto Networks leads cybersecurity mesh revenue with a Douglas Insights estimated 11.8% share in 2025, ahead of Fortinet at 9.6% and Zscaler at 7.9%. The top three therefore hold 29.3% of mesh value, a fragmented field where identity, network and analytics specialists still compete for the same policy layer.

The CyberArk purchase matters because a mesh is only as strong as its identity fabric. The Palo Alto Networks release states that machine identities outnumber human identities by more than 80 to 1 and that nearly 90% of organisations have suffered an identity-centric breach. Those two figures explain why a firewall vendor paid for a vault. Douglas Insights estimates the combined group adds about 1.4 points of mesh share by 2027 through cross-selling.

Fortinet is the second pillar. Its second quarter 2026 results, released on 29 July 2026, showed total revenue of USD 2.05 billion, up 26% year over year, with product revenue of USD 773 million, up 52%, and billings of USD 2.37 billion, up 33%. Fortinet sells one operating system across firewall, SD-WAN and access, so its mesh pitch is fewer consoles.

Zscaler, at 7.9%, wins where a buyer starts from cloud access rather than hardware. Cisco holds 6.4% on the strength of its installed switching base. Microsoft, at 5.7%, rides the identity directory that most enterprises already license. Check Point takes 4.2% with one policy console, and IBM 3.1% through analytics and managed services. The seven named vendors together hold 48.7%; the remaining 51.3% is spread across identity, analytics and regional specialists.

How is a cybersecurity mesh architecture defined, and what sits inside the identity fabric?

Cybersecurity mesh comprises five revenue layers worth USD 2.24 billion together in 2025: identity, access enforcement, analytics, posture management and services. The scope counts only spend that shares policy or telemetry across at least two controls, so a standalone firewall sale is excluded from the 38,400 deployments we count.

The architecture follows the zero trust idea set out by NIST in Special Publication 800-207, published in August 2020, which removes implicit trust based on network location. The NIST zero trust architecture publication treats authentication and authorisation as checks made before each session. A mesh applies that check through a shared identity fabric. The study tracks deployment as cloud-delivered, on-premises and hybrid, enterprise size as large enterprises and small and medium enterprises, and end use across banking and financial services, government, healthcare, IT and telecom, and energy and utilities.

Which component layer of the cybersecurity mesh makes the money in 2025?

Identity fabric and access management makes the most money, with 31.4% of the cybersecurity mesh market, or USD 703.0 million in 2025. Every other layer depends on knowing who or what is asking for access, so identity is bought first and renewed most reliably across the 38,400 deployments.

Identity fabric and access management, at USD 703.0 million, leads because machine accounts multiply faster than staff and each one needs a credential. Zero trust network access and SSE enforcement, meaning security service edge, holds 27.8% or USD 622.4 million, as it replaces virtual private network gateways. Security analytics and intelligence takes 18.6%, worth USD 416.4 million, and is the fastest-growing layer at 14.3% a year because AI-driven detection needs telemetry pooled from every control. Consolidated policy and posture management is small at 9.7%, or USD 217.2 million, since buyers often get it bundled. Professional and managed services carry 12.5%, or USD 279.7 million, and grow slowest at 8.97% as platforms automate integration work.

Is cloud-delivered cybersecurity mesh replacing on-premises firewall estates?

Cloud-delivered contracts make up 58.3% of 2025 value in our count, hybrid 27.4% and on-premises 14.3%. Large enterprises account for 64.2% of spend and small and medium enterprises 35.8%, yet the smaller firms add deployments faster. By end use, banking and financial services take 24.6%, government 17.9%, IT and telecom 16.8%, healthcare 11.3% and energy and utilities 8.7%.

Cloud-delivered mesh is not yet replacing on-premises estates outright; it wraps them. Douglas Insights expects the cloud-delivered share to reach 71.6% of mesh value by 2035, with on-premises falling to 8.9%, because regulated buyers such as banks and agencies keep some enforcement points on site for data residency. Hybrid stays near 19.5%. The practical result for buyers is that a mesh contract signed in 2026 usually covers at least one physical gateway and at least two cloud tenants.

Why are identity breaches and machine accounts pushing boards toward mesh spending?

Deployment growth of 9.4% a year powers the cybersecurity mesh forecast, with machine identities, cloud migration, zero trust rules and vendor consolidation adding the points. Douglas Insights counts 38,400 mesh deployments in 2025 and projects about 94,300 by 2035, while price adds a further 2.1% a year.

Machine identities contribute 3.6 points of the 9.4-point deployment leg. Palo Alto Networks reports more than 80 machine identities for each human one, in the same release that confirmed the 11 February 2026 closing of CyberArk, published on its press page. Service accounts, API keys and AI agents each need a policy, and a siloed tool cannot apply one consistently. Our model ties 1 in 3 new mesh deployments to an identity project.

Hybrid and multi-cloud migration adds 2.9 points. An enterprise running workloads on two or three clouds faces two or three native policy engines, so a mesh layer that writes one rule and pushes it everywhere saves staff time. Douglas Insights puts the share of new mesh deployments triggered by a second cloud provider at 41.0% in 2025.

Regulation adds 1.8 points. European operators of essential and important entities under NIS2 must document risk measures across networks and suppliers, and United States agencies follow zero trust guidance built on NIST SP 800-207. Rules do not name a mesh, but a shared audit trail is the cheapest way to prove compliance across 5 to 15 security tools.

Remote and branch work also feeds the identity driver. Each branch or home worker that once sat behind a single corporate firewall now reaches 10 to 40 software services directly, and each connection needs a fresh access decision. Douglas Insights counts an average of 2.6 enforcement points per mesh deployment in 2025, rising to 3.4 by 2035, and that rise is already inside the 3.6 machine identity points and 2.9 multi-cloud points above rather than counted twice.

Vendor consolidation adds the last 1.1 points. Fortinet product revenue rose 52% to USD 773 million in the second quarter of 2026, a sign that buyers are replacing mixed estates with single-vendor platforms. The four drivers sum to 9.4 points: 3.6 plus 2.9 plus 1.8 plus 1.1, and together they lift deployments from 38,400 to about 94,300 over the decade. Sibling coverage in the Industrial Cybersecurity and OT Protection Market shows the same consolidation reaching plant networks.

Which integration hurdles slow cybersecurity mesh rollouts inside large enterprises?

Integration effort removes about 1.3 points from cybersecurity mesh deployment growth, the largest of three restraints worth 2.7 points in total. Without them the deployment leg would run near 12.1% a year rather than 9.4%, so execution, not demand, sets the ceiling for mesh adoption.

Connecting legacy controls is slow. A typical large estate runs 5 to 15 security consoles, and each must expose policy and telemetry through an interface the mesh can read. Douglas Insights estimates integration projects run 7 to 11 months, which pushes 1.3 points of deployment growth beyond the forecast window.

Skills shortages take 0.8 points. Mesh design needs staff who understand identity, network and cloud policy at once, and smaller security teams of 3 to 6 people rarely have that mix. Managed services fill part of the gap, which is why that segment still grows at 8.97%.

Budget pauses during vendor consolidation take 0.6 points. Buyers waiting for a merger to settle, such as the CyberArk integration into Palo Alto Networks, often delay renewals by one or two quarters. Douglas Insights reckons 6.2% of 2026 mesh renewals slip into 2027 for that reason.

Where does North America lead cybersecurity mesh adoption, and which region catches up?

North America leads cybersecurity mesh spending with USD 933.5 million in 2025, or 41.7% of the global total, because zero trust programmes and large multi-cloud estates matured there first in our model. Middle East and Africa grows fastest at 14.69% a year, from a base of USD 100.7 million.

Europe holds USD 588.8 million and grows at 11.0% a year, with NIS2 enforcement adding audit-driven demand. Asia Pacific is worth USD 501.5 million and grows at 14.0%, adding the largest absolute gain outside North America as regional banks and telecom operators replace perimeter firewalls, in our model. Latin America holds USD 114.2 million, growing at 12.6%, and is the wildcard: a run of ransomware attacks on public bodies could move budgets faster than our model assumes. Middle East and Africa, at USD 100.7 million, is the fastest-growing region because our model assumes new government and bank estates there are built mesh-first, with less legacy to integrate. North America grows slowest at 10.2% yet still reaches USD 2.47 billion by 2035.

How much do enterprises pay per year for a cybersecurity mesh contract?

Enterprises pay an average of USD 58,300 a year for a cybersecurity mesh contract in 2025, across all sizes and layers. That average rises 2.1% a year to about USD 71,800 by 2035, as buyers add analytics modules and more identities per deployment.

Realised price bands are wide. Small and medium enterprises pay USD 9,000 to USD 24,000 a year for a cloud-delivered bundle of access and identity. Mid-sized firms pay USD 30,000 to USD 90,000. Large enterprises pay USD 150,000 to USD 1.2 million, with identity seats often priced per human and per machine account. Douglas Insights calculates that bundling cuts list prices by 18% to 27% when a buyer takes three or more layers from one vendor, which is why the price leg stays near 2.1% despite new features.

Services pricing differs. Integration projects bill at USD 1,400 to USD 2,100 per consultant day, and managed mesh operations run USD 4 to USD 11 per protected identity per month. Payment security buyers will recognise the per-transaction model in the 3D Secure Authentication Market, which shows how identity checks get priced at scale.

Which zero trust rules and NIS2 obligations shape mesh purchasing?

Two rule sets shape most cybersecurity mesh purchasing: the NIS2 Directive in Europe and zero trust guidance built on NIST SP 800-207 in the United States. Together they touch about 68.0% of 2025 mesh value, because both demand provable, consistent access control across many tools.

Directive (EU) 2022/2555, known as NIS2, was adopted on 14 December 2022 and entered into force on 16 January 2023, according to the Official Journal record. Mesh vendors sell the shared audit log as evidence of the risk measures the directive asks for, and Douglas Insights estimates 26.3% of 2025 mesh value sits in Europe where it applies.

In the United States, NIST SP 800-207 defines zero trust architecture and remains the reference text for agency programmes. A mesh does not replace these rules; it gives auditors one record instead of 5 to 15. Vehicle makers face similar evidence demands, covered in the Connected Vehicle Cybersecurity Market.

What if machine identities multiply faster: how far can the mesh forecast stretch by 2035?

The cybersecurity mesh forecast spans USD 4.92 billion to USD 9.07 billion in 2035, around a base of USD 6.77 billion. The spread rests mainly on deployment growth, since identity volumes and integration speed move far more than price per contract.

The base case uses 9.4% deployment growth and a 2.1% price leg, giving USD 6.77 billion and a revenue CAGR of 11.70%. The slower case cuts deployments to 6.7% and price to 1.4%, for USD 4.92 billion, if integration stalls and consolidation drags on. The faster case lifts deployments to 12.1% and price to 2.6%, for USD 9.07 billion, if AI agents push machine identities well beyond the 80 to 1 ratio cited when Palo Alto Networks closed CyberArk on 11 February 2026, a figure from its own release.

One extra point of deployment growth adds about USD 645 million to the 2035 value. Published forecasts from other analysts run from 6.6% to 18.3% a year; our 11.70% sits in the lower half, because we count only spend that shares policy across controls.

Douglas Exclusive: the mesh contract renewal calendar

The mesh contract renewal calendar is a Douglas Insights model, built from 9 inputs: 4 dated events read for this study and 5 modelled quarterly renewal shares. It assumes three-year mesh contracts and spreads 2025 contract value across the quarters when buyers can switch vendors.

The finding: 43.2% of 2025 mesh contract value, about USD 967.1 million, comes up for renewal in the five quarters from Q4 2026 to Q4 2027. Year-end quarters carry the most, with Q4 2027 at USD 230.6 million. That window is when consolidating vendors such as Palo Alto Networks and Fortinet can take share from single-layer specialists.

How the model rebuilds USD 2.24 billion from 38,400 cybersecurity mesh deployments?

The cybersecurity mesh model multiplies 38,400 deployments by USD 58,300 per contract to reach USD 2.24 billion in 2025, across five regions. It draws on 8 sourced inputs: 4 primary documents and 4 published growth estimates.

Arithmetic: 38,400 times USD 58,300 equals USD 2.24 billion. Growth of 9.4% in deployments and 2.1% in price gives (1.094 times 1.021) minus 1, or 11.70% a year, and USD 6.77 billion in 2035. Five regional rows sum to the global total in 2025 and 2035 within USD 0.1 million. Cross-check one: the top seven vendors in our table hold 48.7%, consistent with a fragmented field. Cross-check two: our 2025 total sits 3.0% above the midpoint of two published 2024 baselines, USD 1.30 billion and USD 2.59 billion, rolled forward one year at 11.70%.

Sources

1. Palo Alto Networks Palo Alto Networks completes acquisition of CyberArk (2026)
2. Fortinet Fortinet second quarter 2026 financial results (2026)
3. NIST SP 800-207 Zero Trust Architecture (2020)
4. EUR-Lex Directive (EU) 2022/2555 (NIS2) (2022)