Off-Calendar Checks and Security Channel Trends April Update

Research evidence excerpt

Off-Calendar Checks and Security Channel Trends April Update

May 19, 2026

and is not comparable to Defender at this point.

○CrowdStrike remains best-of-breed in endpoint, and if

SentinelOne wins a deal, it is on price in the mid-market.

●Telemetry is becoming a bigger deal as it relates to AI, with customers

caring more about endpoint and network data than they used to.

○This could become the catalyst to displace Splunk over time.

●LLMs running on endpoints and the growing need for telemetry and

context are driving legacy conversions, helping CrowdStrike pick up

"low hanging fruit" wins.

○Though smaller customers are more budget-conscious and not

moving as aggressively, with conversion rates a bit lower in

that segment.

●Also, partners are seeing a small uptick in SIEM and Identity attach.

Zscaler Commentary:

●Partners like the AI story, with Zscaler's core products executing at the

network layer and Red Canary bringing the analytics.

○The combination of Red Canary and zero trust is a compelling

AI narrative, and a simpler approach than Palo Alto.

○Partners noted the Red Canary pipeline is building for the 2H.

●The ability to bring network and security telemetry together is

resonating, and Red Canary is gaining traction with MSPs as a lower-

cost solution to deliver than peers.

Okta Commentary:

●Partners are growing faster with Okta than last year, and the company's

marketing campaign around AI has re-elevated them into a vendor

enterprises want to engage with.

○Okta is going head-to-head with Palo Alto on the identity layer

in AI security, but partners note the TAM is large enough for

both.

○On the product side, it is too early to say whether AI

capabilities are driving incremental revenue.

●April activity was slightly better, and the company is doing well in the