What is listed on Security Stack

What qualifies§

A product is listed when it competes in a specific security market. The catalog is organized into Domains, broad areas of security, and Categories, the specific markets inside them. A listing carries the Category it competes in, and sometimes a few adjacent ones when the product genuinely competes in neighboring markets.

Classification is biased to precision: a product is tagged for what its documentation demonstrates, not for every box on its architecture slide. Within each Category, capabilities are named consistently across products, so listings in the same market stay directly comparable.

What is excluded on purpose§

The broad suites, the household names that span endpoint, network, identity, and cloud under one contract, are not listed. That is a deliberate choice, for three reasons.

• You do not need help discovering them. The suites are on every shortlist by default. The discovery problem buyers actually have is the specialist layer, and that is the problem this catalog exists to solve.
• They are bought differently. Suite decisions ride on existing contracts, bundling, and ecosystem commitments, factors a capability catalog cannot see and should not pretend to score.
• A checklist would flatter them. Listings here compare documented capabilities within a market. A suite module can check a Category's boxes at the surface, and a feature-by-feature comparison against a specialist rewards the checkbox while hiding the depth gap. Rather than publish rankings we could not keep honest, we leave the suites out.

Where the line sits§

The line is focus, not size, and not the word “platform” in a product name. A product built around a specific security problem is listed, even when it spans a handful of adjacent Categories or markets itself as a platform. A product whose ambition is to be most of your security program is a suite, and wouldn't be covered in Security Stack.