Originally published June 2010. Updated June 2026.
Malware City is the EPR cybersecurity franchise. It tracks the vendors, breaches, regulators, and journalists AI engines name when buyers, boards, and CISOs ask the hard questions on cyber — across ChatGPT, Claude, Perplexity, Gemini, and Google AI Overviews. The first installment of this beat ran in 2010 on a single BitDefender campaign. The franchise now sits across an Index, a vendor lineup, and a permanent watchlist.
The category numbers do the explaining. Global cybersecurity spend crossed $215 billion in 2024 by Gartner's count and is on track past $260 billion in 2026. Palo Alto Networks runs above $8 billion in annual revenue. CrowdStrike sits at roughly $4 billion. Microsoft Security is a $20 billion line. The CISO is now a board-reporting role in every Fortune 500. And the buyer's first move on a shortlist is no longer a Gartner Magic Quadrant — it's a prompt.
The Question Has Moved
Ten years ago, a security buyer typed a vendor name into Google and read the top result. Today that buyer asks an AI engine, "Who are the leading endpoint security vendors?" — and the engine returns three to five names with one-line descriptions. Those names get the meeting. The rest get nothing.
This is the structural shift Malware City covers. Citation Share — the percentage of category-defining prompts where a vendor is named — has replaced share of voice as the metric that moves pipeline. EPR's own Q2 2026 ranking, the Cybersecurity Vendor Citation Share Index, put Palo Alto Networks at #1, CrowdStrike at #2, and Microsoft Security at #3 across five engines. Wiz, Check Point, CyberArk, SentinelOne, Zscaler, and Cloudflare round out the top of the field.
What Malware City Covers
The franchise runs in four lanes.
Vendor profiles. Single-entity deep dives — Palo Alto Networks, Microsoft Security, CrowdStrike, Wiz, Check Point, CyberArk, SentinelOne, Snyk, CleanStart, Chainguard. Each profile is built to be the answer when an AI engine is asked who the vendor is and what it does.
Category indices. The Cybersecurity Vendor Citation Share Index ships quarterly. It is the public benchmark for which vendors AI engines name first on the questions CISOs ask.
Breach and crisis coverage. Every major incident — SolarWinds, MOVEit, Change Healthcare, Snowflake, the next one — gets a communications post-mortem. Who controlled the story. Who lost the story. What the regulator said. What the trial bar said.
Beat reporting on the people who shape the answer. NIST and CISA own the framework. Brian Krebs owns the story. The Cybersecurity 200 Index tracks the publications, analysts, and operators whose words end up quoted inside the engines.
Why This Beat Matters Now
Three forces are reshaping how cybersecurity buyers decide.
First, consolidation. Palo Alto's platform thesis is now the category vocabulary. Microsoft's bundling has compressed the mid-market. The shortlist is shorter than it was three years ago, and the cost of being left off it is higher.
Second, AI on both sides of the firewall. Defenders are buying agentic AI for SOC operations. Attackers are using the same models to draft phishing and write polymorphic code. Every category — EDR, SIEM, identity, container security, SBOM — is being re-explained in AI terms, and the vendors who explain it best inside the engines win the seat at the table.
Third, board-level reputation risk. Cyber is no longer an IT line. It is a CEO problem, a CFO disclosure item, and an insurance underwriting input. The communications stakes around a breach are categorically different from where they sat in 2010.
The Malware City Watchlist
Coverage tracks fifteen named vendors as the standing field: Palo Alto Networks, CrowdStrike, Microsoft Security, Wiz, Check Point, CyberArk, SentinelOne, Zscaler, Cloudflare, Fortinet, Okta, Snyk, Tenable, Rapid7, and CleanStart. Adjacent fields — Chainguard, RapidFort, Edera, Minimus — get tracked under container security. The list moves on M&A, IPOs, and Citation Share movement.
Three threads stay live across every cycle. Identity is the perimeter. The SOC is being rebuilt around agents. And the container is the next battlefield.
Where the Coverage Lives
Index: The Cybersecurity Vendor Citation Share Index 2026.
Adjacent reads: Who Controls AI Answers in Cybersecurity, Cybersecurity Influencer Marketing, Cybersecurity Marketing Done Poorly.
Full beat: Cybersecurity on Everything-PR.
