Ross Haleliuk offers a provocative reframing of the cybersecurity landscape, arguing that the industry's fragmentation isn't a failure of execution but an inevitable byproduct of shifting infrastructure foundations. Rather than chasing the latest threat vector, Haleliuk suggests we look at the "layer zero"—the underlying platforms like cloud providers, operating systems, and identity managers—that dictate the rules of engagement for every other security tool. This perspective is vital for busy leaders trying to cut through the noise of 5,000+ vendors, as it explains why certain categories explode overnight while others stagnate.
The Architecture of Opportunity
Haleliuk's central thesis is that security is not a standalone product but a function of where you sit in the technology stack. He writes, "The entities best positioned to deliver real security are the ones building the core technologies." This is a sharp observation that challenges the traditional vendor mindset. Instead of trying to bolt security onto a platform, the most effective solutions are often those baked directly into the foundation by the platform owners themselves.
The author defines this foundational tier with precision: "Layer zero refers to the foundational layer of infrastructure and technology that other tools depend on. It's where control points often emerge - identity platforms, cloud service providers, and operating systems." By identifying these specific actors—AWS, Microsoft, Okta, and others—as the true gatekeepers, Haleliuk shifts the focus from the symptoms of insecurity to the structural causes. This framing is effective because it moves the conversation away from "better tools" to "better architecture."
"For those who own layer zero, adding security is often just an architectural decision (a toggle, an API extension, a bundle, etc.), while for everyone else, namely the vendors operating on top of these platforms, delivering security becomes a negotiation with the underlying layer."
This distinction explains the power dynamic in the market. Vendors that do not own the layer zero are constantly negotiating for access, whereas the platform owners can simply toggle a feature. Critics might argue that this view underestimates the agility of third-party vendors who often innovate faster than massive conglomerates. However, Haleliuk's point about the "negotiation" dynamic holds up when we consider how often security startups are acquired or shut down when the platform owner decides to enter the space.
The Cycle of New Markets
One of the most compelling aspects of Haleliuk's analysis is the historical pattern he identifies. He notes that "Every time a new foundational layer emerges, we see the same pattern when a large number of cybersecurity companies get created to take advantage of that shift." This isn't random; it's a predictable response to new attack surfaces created by infrastructure shifts. Just as the rise of personal computers created the endpoint layer and virtualized compute created the cloud layer, Haleliuk suggests that AI is currently forming the next layer zero.
He connects this to the sheer volume of the industry, stating, "If you zoom out far enough, the 5,000+ cybersecurity vendors today aren't a sign of market inefficiency; they're a solid proof that we've had dozens of layer-zero shifts over 40 years, and each created its own cottage industry of 'missing controls.'" This is a powerful recontextualization. It suggests that the market isn't broken; it's simply reacting to decades of rapid technological evolution. This mirrors the dynamics seen in the platform economy, where every new delivery mechanism (like the browser) eventually spawns its own security ecosystem.
"When the foundation changes, thousands of new problems appear: posture, visibility, misconfigurations, gaps between old and new workflows, fragmented APIs, and inconsistent policy models."
The author argues that the explosion of vendors is a direct result of these new problems. While this is a strong structural argument, it does gloss over the issue of vendor fatigue. For security teams, the result of this "cottage industry" is often a fragmented toolset that is difficult to manage, regardless of how logical the creation of each tool may be.
Why Foundations Can't Be Secure Enough
Haleliuk tackles a common misconception: that if platforms were built with stronger security from the start, the need for external tools would vanish. He dismisses this as unrealistic, writing, "Layer zero optimizes for reliability, scale, economics, and user experience, not for the edge cases enterprises run into." This is a crucial insight for executives who might expect their cloud or OS provider to solve all their security headaches.
The argument is that layer zero providers cannot prioritize security above all else because it conflicts with their core business model. "Doubling down on security often reduces compatibility, increases support burden, and complicates core workflows, something that makes these players sell less of their core products." This trade-off is inherent to their existence. They must serve the entire world with a single architecture, which inevitably leads to generic security controls that are too shallow for complex enterprise needs.
"The majority of security problems are really misconfiguration problems (which is probably why CSPMs and identity automation products have been exploding in growth)."
This observation explains the rise of Cloud Security Posture Management (CSPM) tools. The complexity of modern infrastructure creates a gap between what the platform offers and what the enterprise needs. Haleliuk suggests that this gap is not a bug but a feature of the system. A counterargument worth considering is that as platforms mature, they are indeed becoming more secure by default, potentially shrinking the market for posture tools. However, as Haleliuk notes, the demand for flexibility in large enterprises ensures that misconfiguration will remain a persistent challenge.
The Predictable Evolution of Defense
Perhaps the most actionable part of Haleliuk's commentary is the three-step evolution he outlines for security around any new layer zero. He writes, "Step 1: Visibility and posture... Step 2: Threat detection... Step 3: Operations and incident response." This sequence is not arbitrary; it reflects the maturity of both the technology and the attackers.
He emphasizes that "history has shown that starting with runtime instead of posture for a new layer zero is a mistake." This is a critical lesson for investors and founders. When a new infrastructure layer emerges, attackers need time to understand how to exploit it. In the meantime, the immediate need is for visibility and configuration management. Haleliuk points to Wiz as a prime example, noting how they "were able to win the market despite not having all the deep-level controls that some of their competitors did on day one."
"This cycle explains why our industry is repeating the same pattern all over again, and for every new layer zero, we get posture, then detection, and then (sometimes) response tooling."
The author argues that this pattern is so consistent that it can be used to predict market winners. Companies that attach themselves to a fast-growing layer zero and follow this evolution can inherit decades of relevance. He cites CrowdStrike as a company that "needed to go super deep to observe the endpoint," which differentiated it from competitors. This depth of integration is what creates a sustainable competitive advantage.
Bottom Line
Ross Haleliuk's "layer zero" framework provides a necessary structural lens for understanding the chaotic cybersecurity market, successfully arguing that vendor proliferation is a natural response to infrastructure shifts rather than market failure. While the argument occasionally underplays the role of human error and the potential for platforms to eventually absorb more security functions, its greatest strength lies in predicting the lifecycle of new security categories. For leaders navigating this space, the verdict is clear: the most enduring opportunities lie not in fighting the platform, but in deeply embedding within the next emerging layer zero.
> "If a company can evolve into a layer zero platform, it can become a public company. I'd expand on this thought and say that another way to go public is to deeply embed into an existing layer zero, but it's that depth that creates a competitive advantage." "