# DNS Security Vendor Landscape ## What normal looks like commercially in this space Useful mainly as a baseline. If a company positions itself on DNS security, these are the comparables it is implicitly being priced against. | Vendor | Position | Where the money comes from | | --- | --- | --- | | **Infoblox** | the DDI incumbent: DNS, DHCP and IP address management as enterprise infrastructure, with security layered on | large enterprise appliances and licences; sticky because it is the system of record for addressing | | **EfficientIP** | European DDI challenger, strong on DNS-layer threat detection and sovereignty positioning | same buyer as Infoblox, wins on price and on not being American | | **Cisco Umbrella** | cloud resolver as a security product, descended from OpenDNS | per-seat SaaS, sold to mid-market and distributed workforces | | **Corelight** | network detection built on Zeek; DNS is one signal among many | enterprise sensors and SaaS analytics, sold to mature SOC teams | | **Cloudflare** | 1.1.1.1 and Gateway; resolver at global scale bundled with everything else | bundled into a broad security platform, effectively free at the DNS layer | > [!important] The structural read > Two distinct businesses wear the same label. **DDI** is infrastructure management sold to network operations, defended by being the address system of record. **DNS security** is a detection product sold to security operations, defended by data and models. They have different buyers, different cycles and different margins, and a company doing both is running two go-to-market motions. > [!warning] The pricing floor > Cloudflare gives resolver-level filtering away at the bottom of the market. Any new entrant selling DNS security to smaller customers is competing with free, and has to justify the premium on sovereignty, local operation, integration depth or support rather than on the detection itself. ## Why it matters The interesting positions left are the ones the incumbents structurally cannot take: in-country resolver operation under local law, which a US or French vendor cannot credibly claim, and resolver-side collection in markets where wire-based monitoring is already broken by [[DoH and DoT]]. ## Related - [[DNS as a Security Signal]] - [[The Resolver as Sovereignty Chokepoint]] - [[DoH and DoT]] - [[Cyber Security Market]] - [[Managed Security Service Providers]] - [[Why businesses pay for cybersecurity]]