Software vendors no longer sell Products... They Sell Power Surfaces
Enterprise software is no longer a product market. It's a war to become the screen the executive committee opens every morning. If you work in Tech, you need to read this article.
For years, enterprise software gave the illusion of a rational order: one category, one leader, one budget, one buyer. Today, that order is collapsing before our eyes, replaced by a series of acquisitions that deliberately blur historical boundaries. Snowflake talks observability, ServiceNow talks cybersecurity, Salesforce talks data infrastructure, Palo Alto Networks talks monitoring. And the rest of us poor mortals thought all of this was just opportunistic drift or a simple revenue chase. How naive we were. It is in fact the sign of a far deeper mutation: the shift from a product market to a market of power positions. A breakdown.
The era where every vendor “stayed in their lane” is over
Ten years ago, the landscape was legible. So clear as crystal that everyone stayed in their lane and everyone understood what the others were doing. Snowflake and Databricks did data platforms. ServiceNow managed tickets (yes, that’s reductive, but you follow me). Salesforce managed CRM. Palo Alto Networks did security. Elastic did search. Each category had its leaders, its analysts, its budgets and its buyers. Everyone claimed to sit in the top right of some Gartner Magic Quadrant that came from God knows where, sometimes. You bought the “best tool” for a precise function, then stacked the bricks and moved on.
Today, that map is terribly obsolete. We see Snowflake in discussions to acquire Observe for approximately one billion dollars, planting a foot in observability. We see Palo Alto Networks announce the acquisition of Chronosphere for 3.35 billion dollars, explicitly assuming entry into an “observability” layer that would once have been considered out of scope for a cyber player. We see ServiceNow announce the acquisition of Armis for 7.75 billion dollars, with a “security exposure + workflows” logic that far overflows its historical ITSM territory. And we see Salesforce sign and then finalize the acquisition of Informatica at around 8 billion dollars, to lock in the data management and governance that fuels its AI ambitions.
This could all be told as simple “platform consolidation.” That would be true… and insufficient. The real logic is deeper, colder, more political.
First logic: best-of-breed didn’t fail technically, it failed humanly
The best-of-breed promise rested on a fantasy: organizations capable of rationally managing growing complexity. In reality, stacking 30 to 60 critical tools doesn’t just add up licenses. It adds up integrations, blurry responsibilities, cross-functional committees, governance friction, data duplication, metric divergences, and gaps in security coverage. A disaster. At first, it’s manageable. Then the organization slows. Then it exhausts itself. And the day a serious incident hits, everyone discovers that “everyone” was responsible for nothing.
I remember a CIO I met six or seven years ago who showed me a map of all his cybersecurity tools: lights blinking everywhere, and he himself couldn’t make sense of it anymore. But it reassured him to have picked “the best” each time. At the end of the day, it was his teams who dealt with it. It’s the same everywhere.
That’s where the buying criterion shifts. You’re no longer looking for “the best product,” you’re looking for “the biggest complexity vacuum.” In other words, a player capable of offering a more unified framework, clearer accountability, more native integration, and above all a governance model that’s simpler to sell internally. That is exactly what all these software vendors now sell: less a feature, more a reduction of organizational friction. And in a period of budget constraints, friction becomes a cost as real as any invoice. In the end, everyone will end up with the same sales pitch everywhere, regardless of the vendor.
Second logic: observability becomes central because it captures operational truth
Why does observability attract everyone, to the point where a data platform finds itself eyeing an app monitoring company, and a cyber giant buys an observability platform? Because observability is not an “ops” byproduct. It’s the place where reality catches up with storytelling.
Logs, metrics, traces, incident signals, and now the behaviors of AI workloads, tell you what’s actually happening. Not what was promised. Not what’s in the PowerPoint. Not what’s “supposed” to be stable. That signal is rare: it’s real-time, transversal, hard to manipulate, and directly correlated to customer experience, availability, and risk.
Whoever controls this layer controls the executive narrative: what is critical, what is breaking, what costs money, what creates risk, what must be prioritized. Datadog became enormously powerful not just because it “collects logs,” but because it serves as the daily cockpit for teams who no longer have time to interpret twenty systems. That is exactly the cockpit that other platforms don’t want to leave in the hands of a third party. When Snowflake discusses Observe, the issue isn’t “adding a feature.” The issue is avoiding relegation to an invisible backend layer while another player becomes the control tower.
Palo Alto Networks, by buying Chronosphere, says the same thing in a different grammar: modern security is no longer just a matter of perimeters, it’s a matter of signals and real-time understanding of systems. And those signals live precisely in observability.
Third logic: the war isn’t to expand TAM, it’s to avoid commoditization
The “we’re expanding our TAM” argument is convenient. It justifies everything. Maybe even anything and everything. But the real engine is often defensive: avoid becoming a commodity in someone else’s stack.
The Elastic example is instructive because it is brutal. For years, Elastic was a foundational component. Used everywhere, technically respected, omnipresent even. And yet, platforms like Datadog built a layer on top, captured the budget, captured daily usage, and captured disproportionate economic value relative to the underlying component. The lesson the market absorbed is simple: being “the engine” no longer guarantees capturing the rent. The rent is in the cockpit, in the experience, in governance, in pricing, in the ability to become the standard. And everyone has understood that and wants to carve a path from the reactors to the cockpit.
That is exactly what Salesforce wanted to secure with Informatica: data is not just fuel, it’s a matter of quality, cataloging, lineage, governance - therefore a matter of trust. And AI inside Salesforce has no chance at scale if the data foundation is unstable or fragmented. So it was missing a serious enterprise-grade data tool like Informatica to do the job. Same logic on the ServiceNow side: the enterprise no longer wants one system for tickets and another system that “sees” cyber exposure. It wants a pipeline where you see, prioritize, orchestrate, and execute. Armis brings precisely a real-time visibility into an attack surface that overflows the traditional information system, and ServiceNow brings the workflow engine.
In other words, this is not joyful expansion. It is rational fear: if I remain “a brick,” someone else will build the interface, and I will become negotiable. If I’ve learned one thing over the years watching M&A, it’s that at the end of the day, many companies act out of fear of being sidelined, of missing a wave, of being caught by more aggressive players. Kill before being killed.
Fourth logic: AI doesn’t create the movement, it makes it mandatory
AI is often presented as the cause. In reality, it acts as a brutal accelerator. Companies already struggle to operate distributed systems. They already struggle to govern data. They additionally struggle to secure an expanding attack surface. AI adds a layer of requirement: more data, more pipelines, more monitoring, more controls, more auditability, more “strange” incidents - models drifting, costs exploding, non-deterministic behaviors.
In short, you see where this is going. In this context, a fragmented stack becomes nothing more than a risk multiplier. Platforms therefore promise something very attractive to a decision-maker: less stitching, more integration, more control, clearer accountability. That’s why ServiceNow talks about unifying the ability to “see, decide, and act” on the attack surface, and why the transaction is explicitly justified by AI and rising risk. And this is not marketing poetry: it’s a response to a systemic constraint. And they are right to move in this direction.
What these acquisitions are really saying: a recentralization of software power
Strip away the press releases, and one dynamic remains: vendors want to become control planes. Not in the sense of “broader product,” but in the sense of “center of gravity for decision-making.”
Across every major domain, the same power architecture is emerging.
First, a real-time truth layer (observability, asset visibility, telemetry, events). Then, a governance and trust layer (quality, lineage, compliance, policies). Then, an orchestration layer (workflows, remediation, automation). And finally, an internal distribution layer - being the tool opened every day by the right teams, with an expandable budget.
The winner? The one who links these layers without friction and establishes itself as the single point of entry. The one-stop shop to manage everything without wasting energy running in all directions. That’s why these movements give the impression that “everything converges toward everything.” This is not executive whim. It’s a battle to capture the center. Nothing more, nothing less.
The consequence for buyers: fewer vendors, but more dependency
Consolidation reduces integration pain, but it increases dependency on a handful of platforms. Companies will likely gain in execution speed on certain projects. That’s nearly certain. They will also lose part of their ability to freely arbitrate between components, because platforms will play bundling, conditional discounts, integrated roadmaps, and sometimes subtle lock-ins. Where a few players (the hyperscalers) were champions at this, now hypergrowth vendors are building their own version of the same story. Isn’t that just the logical order of things in the end?
The paradox (and put that way it’s almost funny) is that everyone will keep talking about “openness” and “ecosystem” and “agnosticity,” while building increasingly walled gardens. This is not necessarily immoral. It’s simply the normal functioning of a market where value shifts toward central positions.
The consequence for vendors: product excellence is no longer enough, you need a position
In this new world, being the best in a micro-category remains useful, but becomes fragile if you don’t control part of the cockpit. You can be integrated, resold, or bypassed. You can also become a commodity whose price gets compressed. And therefore your growth ends up limited.
The strategic question is no longer “are we technically number one?” Being the Gartner MQ leader in a domain is very good. But it’s just the baseline - congratulations, thank you, and have a good day sir. The real question to ask now is: “are we indispensable in the chain of decision and execution?” That goes even further than the “must-have product” when you really think about it. That’s why the deals cited seem logical despite their “out-of-category” nature. They don’t respond to a category logic. They respond to a gravity logic.
In short… it’s not chaos, it’s a new power map
The previous decade was the golden age of categories. The decade now opening is the golden age of platforms that control signal, governance, and orchestration. Observability becomes a conquest terrain because it captures operational truth. Data management becomes central because it conditions trust in AI. Cybersecurity overflows everywhere because the attack surface is now everywhere. And vendors converge because they all want the same thing: not to be a replaceable brick.
Those who continue to think “product” while ignoring “position” will get eaten - slowly, cleanly, and sometimes with a press release that talks about “synergies.”
The most revealing signal may actually come from the data platforms themselves. Databricks launched Genie, then Genie Code in early 2026 - a conversational AI layer that lets any business user query data, build pipelines, and deploy dashboards without touching a single line of code. Snowflake responded with Intelligence, then Project SnowWork on March 2026 - a platform that lets executives run complex workflows from a simple prompt. Two companies historically invisible to the C-suite, now racing to become its daily interface. The backend wants to become the cockpit. The engine wants to become the steering wheel. And if that doesn't illustrate the power logic described in this article, nothing will.
And to close, the words of Adrien Damez-Fontaine, Digital & Tech Talent Agent at Lincoln Singapore: “What we see very clearly in the market is that companies are losing interest in ‘pure’ technical experts. They are looking for profiles capable of understanding business stakes, working with business teams, and adapting to technologies that evolve constantly.”
It all makes sense now !
The market is clearly shifting from standalone tools to platforms that own the operational layer and decision flow