Cybersecurity · Industry brief

The cybersecurity industry is consolidating around three distinct business models rather than converging on a single winner-takes-all market. Large platform vendors like CrowdStrike, Palo Alto Networks, and Fortinet are expanding beyond their original specialties—CrowdStrike grew ARR 24% year-over-year to $5.5 billion in Q2 2026 with strong adoption of its Falcon Flex platform, while Palo Alto Networks achieved 60% ARR growth in Next-Generation Security with approximately 2,280 platformization customers. Infrastructure and networking providers including Cisco, Broadcom, and Akamai are embedding cybersecurity into broader enterprise platforms, while specialist vendors such as Okta, Rubrik, and Qualys remain strategically important in focused domains—Rubrik reported 32% year-over-year subscription ARR growth to $1.57 billion, and Qualys maintained 46% non-GAAP operating margins. This diversified competitive landscape reflects how AI adoption is increasing rather than displacing cybersecurity spending, with enterprises seeking integrated platforms to reduce vendor complexity across their security environments.

Twelve Chilean companies, including three Luksic group mines and fuel retailer Copec, filed legal challenges against Chile's National Cybersecurity Agency (ANCI) resolution designating them as vital operators under the country's Framework Law on Cybersecurity. The companies, whose claims were filed in Santiago Court of Appeals within a 15-working-day objection window after the list's publication in the Official Gazette on 24 July 2026, argue the consultation process ignored their objections and that some entities should not qualify as critical infrastructure. Designation as vital operators triggers compliance obligations including incident reporting and security standards compliance, with penalties reaching 40,000 UTM (approximately US$3.1 million) for serious breaches. The court rulings are expected to set precedent for how judges interpret what constitutes critical infrastructure under the cybersecurity law and may affect hundreds of other firms in future designations. Source: La Tercera (Pulso article, 18 August 2026); vlex.cl, biobiochile.cl.

The FTC's "Operation AI Comply" enforcement initiative, launched in September 2024, has intensified rather than softened in its targeting of AI washing—companies making exaggerated or fabricated AI capability claims. Since the initial announcement, the FTC has initiated more than a dozen cases, with FTC Chairman Andrew Ferguson framing enforcement in April 2026 testimony as pro-innovation action against deceptive actors. Two significant enforcement patterns have emerged: the FTC is now scrutinizing B2B marketing claims to enterprise clients with the same substantiation standards applied to consumer claims, and it is invoking the "means and instrumentalities" doctrine to hold vendors liable for supplying deceptive marketing materials downstream. The SEC has pursued AI washing through securities fraud enforcement, with its Cyber and Emerging Technologies Unit identifying AI-related misrepresentations as a priority area; multiple class action securities fraud cases have been filed against public companies alleging AI washing. The Better Business Bureau's National Advertising Division (NAD) has also challenged unsubstantiated AI claims, flagging recurring issues including premature availability claims, deceptive performance demonstrations, and lack of objective substantiation. Trade publications and regulatory sources cited include FTC enforcement announcements, SEC testimony, and BBB NAD decisions.