Cybersecurity · Industry brief

The point-tool era is over.

Continuing the consolidation wave from earlier this week, standalone security point tools are losing venture backing and buyer interest as strategic acquirers prioritize integration-ready assets over single-purpose platforms. Cribl's recent acquisition of Radiant Security's AI SOC assets exemplifies the shift—data and observability vendors are now bundling SOC automation into larger platform plays rather than standing alone. This mirrors the IoT/OT market fragmentation documented last month, where acquisition "refugees" fled to focused vendors citing roadmap degradation post-close.

Expect acqui-hire velocity to accelerate as capital dries up for standalone competitors.

Sub-regulatory guidance is no longer an enforcement hook.

The DOJ's September 18 Justice Manual revision limits False Claims Act liability to binding statutes or regulations, excluding sub-regulatory guidance (FAQs, policy statements) as direct grounds for prosecution—though guidance still counts as evidence of knowledge [Quelle: Mayer Brown]. The same revisions grant DOJ sweeping dismissal authority over qui tam whistleblower actions and mandatory case reassessment during litigation, effectively killing "parasitic" suits that duplicate existing probes. This reorients enforcement risk away from compliance-guidance ambiguity and toward binding contractual obligations.

Defense contractors should audit binding frameworks now—guidance-only certifications no longer shield from liability.