2026.09.23 | TB | Security | Concentric AI Expert

Primer • 28 Aug 2026

Companies: VRNS US

Expert Former Senior Executive in Product & Technology

Sidharth Nair (Analyst) — Third Bridge Sector Analyst

Agenda

• Over 10 years' experience in the software space
• Over one year of experience at Concentric AI (left within the last two years)

Introduction

Analyst: Please could you state I agree or I disagree to the following statement: You understand the definition of material non-public information and agree not to disclose any such information, or any other information which is confidential, during the Primer Interview today.

Expert: I agree.

Questions

Could you describe what Concentric AI does and the products and services it provides?

Expert: Concentric AI does data security posture management and data detection and response.

What is the value proposition of Concentric's offering? What problem is the company looking to solve?

Expert: They are looking to address the problem of data security, especially as a result of AI.

Analyst: Could you elaborate on the value proposition? What business outcome are customers paying for?

Expert: They help customers secure enterprise, sensitive enterprise data.

What is the full range of industries and business sizes that could use Concentric's offerings? What might be the company's customer segments?

Expert: All enterprises regardless of size and industry.

Analyst: What might be the top three industries, in your opinion?

Expert: Finance, healthcare, those are the top two. I don't know what's the third.

Analyst: How does Concentric quantify enterprise and mid-market companies? Is it based on the organisation's revenue or employee count?

Expert: I actually don't know.

Could you profile Concentric's typical target customer across industries and business sizes? How would you describe the company's ideal customer?

Expert: I would say that is a medium-sized enterprise and there's no industry target.

Analyst: What percentage of the company's revenue comes from financial services vs healthcare? Is it 41-50% or 51-60%?

Expert: I would say finance, probably 11-20% and healthcare, maybe 0-10%.

Analyst: What might be the breakdown of the remaining 61-70% revenue, in your opinion?

Expert: It will be all other sectors. There could be manufacturing, retail, services. I don't know all the other verticals, but government and technology.

Analyst: Which buyer identity does Concentric typically target within the companies? Are they the CISOs?

Expert: Chief information security officer.

Analyst: What percentage of the company's revenue would you say comes from purely enterprise-level compared to mid-market customers? Is it 41-50%, 51-60%, 61-70% or 71-80%?

Expert: Enterprise, maybe 0-10% and 81-90% from mid-market.

Analyst: Is there a customer size sweet spot that the company targets?

Expert: Yes. I'd say mid-market. I don't know how to define that, but I would say approximately 10,000 employees, 1,000-10,000 employees.

Could you share any customer names that are either on Concentric's website or in the public domain?

Expert: There are companies that they have publicly talked about. I don't remember offhand, but let me tell you a good example, just looking at their website for what they have talked about. Magellan Health is one. It's on their website. It is a healthcare and it is in that mid-market range. Another one is called Arvest. It is also mid-market and it's in finance.

What are the key regions Concentric derives its revenue from?

Expert: The US is the main geography.

What might be the revenue contribution from the US – 0-10%, 11-20% or higher, up to 91-100%?

Expert: [The US], 91-100%.

Analyst: What might be the top US regions, in your opinion, or is the revenue evenly distributed?

Expert: It's evenly distributed.

What are Concentric's core revenue-generating product segments?

Expert: The core offering is a DSPM product.

Analyst: Is DSPM [data security posture management] the only segment?

Expert: Right. That's the only one product they have.

What might be the revenue model for the core segment? Is it recurring [subscription], reoccurring, [usage-based] or transactional [one-time]?

Expert: It is a SaaS product. It is annual-renewing contracts.

Analyst: Are the average contracts always annual or might they sometimes be multi-year?

Expert: They are always annual.

Analyst: What are the payment terms based on? How does Concentric define the payment for a mid-market customer? Is the subscription a flat fixed fee or variable dependent on the scanned data?

Expert: It is variable depending on the amount of data that the company scans.

Analyst: Does the company have any indirect sales channels or channel partners along the value chain?

Expert: Yes. There are channel partners that help with customer acquisition. These are channel partners in the cybersecurity industry and they have been, I know there's at least one channel partner that has worked with Concentric, but I don't recall the name and I don't know if they have publicly [shared].

Could you provide a use case for the core segment? How do customers use the DSPM [data security posture management] solution?

Expert: The customer would be an enterprise that has large amounts of data and the data is sensitive. They want to scan the data and find out where the sensitive data is within their company and that, once they know it, then they can secure it. What Concentric AI's product does is help them find where the sensitive data is.

Analyst: What are the software's integration capabilities?

Expert: It can integrate with data stores, which is basically where the enterprise data is. Examples of that will be Microsoft 365, Salesforce and Google Drive. These are examples of integrations.

Analyst: What is the typical software deployment timeline?

Expert: Usually, it's a SaaS product, so it takes maybe one month to deploy.

Analyst: Is the implementation typically done by customers or Concentric?

Expert: Concentric themselves.

Analyst: Is the implementation fee flat and fixed on the recurring contracts or separate and variable?

Expert: There is a maintenance fee, which I think may be something like 0-10% of the value of the contract and that covers the implementation.

Analyst: How does the core platform identify inappropriate access? How does the algorithm establish a baseline of what is normal for data sharing?

Expert: It uses AI to do that. The AI is able to find out or pinpoint data that is inappropriately shared using AI algorithms and language models.

Analyst: Does the platform only offer an alert generation engine, or does it also offer autonomous remediation?

Expert: It offers both discovery and remediation.

Analyst: Is the remediation autonomous or does it require Concentric's labour?

Expert: The remediation is not autonomous, but it doesn't require work from Concentric.

Analyst: What are the data security tool's reporting capabilities? Are there any metrics or dashboards for users to track some of the data sharing scores across the platform and sources?

Expert: Yes. The customer gets a dashboard and that dashboard gives a number of metrics about data security. For example, it gives you a metric called percentage of misclassified data. That's a metric that the customer can see over time and check if that metric is trending in the right direction.

What do you estimate Concentric's NRR [net revenue retention] rate to be – less than 80%, 80-90%, 90-100% or higher?

Expert: I think 90-100%.

What do you think are some of the key drivers of Concentric's NRR?

Expert: Competition.

Analyst: What are the typical expansion vectors for Concentric? How might the company increase its revenue from existing customer accounts? Is it through multiple cross-selling of solutions or upselling the platform?

Expert: Usually, it's increasing the amount of data scanned and protected.

Analyst: What do you think are some common reasons for churn?

Expert: Competition.

Analyst: In what feature or functionality might competition typically be fierce?

Expert: In the same area, which is the DSPM.

Analyst: Which customers do you typically see churning the most? Are they from financial services, healthcare or manufacturing?

Expert: No. There was no such thing.

Could you specify the industry that best describes Concentric's core operations?

Expert: Cybersecurity.

Analyst: Might DSPM be the niche space for the company?

Expert: Sure. Yes.

What has been the DSPM space's AAGR over the past three years – less than 0%, 0-5%, 6-10%, 11-20% or more than 20%?

Expert: Probably 11-20%.

What do you think have been the 1-2 key drivers of the space's historical growth?

Expert: The growth of data itself is one. The second is the increasing awareness of data security.

What do you think the DSPM space's AAGR will be over the next three years? Do you still see it at 11-20% or do you see it growing to 20%-plus or declining to 6-10%?

Expert: I think they will stay the same, [11-20%].

What do you think will be the 1-2 key drivers of the space's future growth? Do you see any emerging trends?

Expert: I think AI is the emerging trend that will drive future growth.

Analyst: Could you elaborate on how AI could increase the space's demand?

Expert: AI is being used by every enterprise and that increases the concern about AI making mistakes or exposing data security problems, so that increases the need for DSPM.

Analyst: Do you see other emerging trends in the space? Why might the DSPM space's growth exist and grow further?

Expert: Also related to AI, I think the ability for AI to be used by malicious hackers creates a need for better DSPM.

Analyst: What do you mean by a better DSPM? What software or DSPM players do you see benefiting from the expansion of attack vectors due to AI?

Expert: All DSPM vendors will benefit because there are no such types I can think of.

What do you estimate the adoption rate to be for DSPM software solutions across the addressable market – 0-10%, 10-20%, 20-30% or higher? What is the typical penetration rate for DSPM software?

Expert: Probably 70-80%.

Analyst: Why do you think the growth rate might be 11-20%, given 70-80% of the market already uses a DSPM solution? Might it be slower?

Expert: Fair point, but I think the overall market is growing.

Analyst: How might the market grow over the next couple of years, though the adoption rates stay high?

Expert: I think a large number of customers have some type of DSPM in place, but they don't protect all their data. There's a lot of growth left within existing customers.

Analyst: Would you say AI-native DSPM solution providers' adoption rate might be fairly lower? Might AI-native DSPM be a relatively new category, though DSPM solutions are widely adopted?

Expert: No. I don't think it's a new category. All the legacy players are also transitioning successfully to using AI in some way.

To what degree do you think the industry is correlated to economic cyclicality? Is it counter-cyclical, very cyclical, somewhat cyclical, somewhat resilient or resilient, and why?

Expert: I think it's very resilient. Data and cybersecurity both are not cyclical.

Analyst: Do you consider the software to be mission-critical, given you mentioned it is resilient?

Expert: No, because cybersecurity is not mission-critical to most of the customers. Cybersecurity is not the customers' mission.

Analyst: Would you say the software is more a non-discretionary budget item?

Expert: Yes. To some extent, non-discretionary. They have to spend on cybersecurity.

Based on public information, what impactful tech innovations should we anticipate in the space over the next 3-5 years?

Expert: I think autonomous remediation using AI. That's one. The ability of language models to find DSPM vulnerabilities is another.

Analyst: Could you elaborate on the LLM [large language model] classification? How does an LLM directly tie into or scan DSPM pipelines?

Expert: I was talking about language models can find data that is misclassified much more effectively and efficiently than traditional methods, so that would be the innovation.

Are there any downside risks that you believe could materially impact market growth over the next three years? What might cause a risk for the DSPM solutions' demand?

Expert: Not really. No.

Analyst: Why do you think so? Are there no regulatory risks or tech disruptions in the space?

Expert: Yes. I think so. The downside risks to DSPM growth are low because data is necessary for almost all businesses to function. Where there's data, there's going to be DSPM. I don't see regulation or even technology changing the fact that data and data interchange is still needed.

How fragmented do you consider the DSPM industry to be? Is the majority of market share captured by 2-5 strong players? Is it a monopoly? Is it fragmented or highly fragmented?

Expert: I think the majority of the market is captured by about five players.

Who are Concentric's top three, most direct competitors that are similar in size and operations?

Expert: One is Cyera. Another one is Varonis. The third one is called BigID.

What are Concentric, Cyera, Varonis Systems and BigID's market shares, in percentage ranges? Alternatively, could you rank them?

Expert: I think Cyera is probably number one. Varonis, number two. BigID, number three. Concentric is number four.

What were Concentric, Cyera and BigID's revenues for the last financial year – USD 0-50m, USD 50m-100m, USD 100m-200m or more? Varonis is public.

Expert: I would say Concentric is USD 0-50m. Cyera is USD 100m-200m in annual revenue. BigID is also in USD 100m-200m.

What were Concentric, Cyera and BigID's revenue growth rates for the last financial year, in your opinion – less than 0%, 0%, 0-5%, 6-10%, 11-20% or more than 20%?

Expert: [Concentric], I think greater than 20%. [Cyera], also greater than 20%. [BigID], they will be 11-20%.

What has been each player's growth driver over the last couple of years? Has Concentric's growth been organic, acquisition-led or mixed?

Expert: I believe they are all organic growth.

In your opinion, what is the average EBITDA margin for the players – less than 0%, 0-10% or higher, up to more than 60%? How profitable do you consider the players to be?

Expert: I don't know what the EBITDA would look like. I presume they are all profitable. My guess would be 21-30% for all of them.

Might each player's EBITDA be above, below or in line with the 21-30% industry average?

Expert: Probably on industry. I think they are all in the same bucket.

How do you think the players differentiate themselves, starting with Concentric?

Expert: Concentric, I would say, focuses on being AI, an early AI adopter.

Analyst: How has Concentric adopted AI differently from the other players?

Expert: It's not different. It's just they were early.

Analyst: Is there anything else that makes the company unique in the space?

Expert: Differentiating, no. There's nothing else that differentiates them.

Analyst: What makes Cyera number one?

Expert: They are focused on large enterprises.

Analyst: Which large enterprises does Cyera typically focus on? Is it the financial services or healthcare side?

Expert: There is no industry focus that I'm aware of. They go across the board for large enterprises.

Analyst: How is Cyera's DSPM core solution compared to Concentric's based on pure capability?

Expert: They have a broader product portfolio and they add on identity and security in addition to DSPM.

Analyst: What might be Varonis's differentiating factor?

Expert: Varonis is older and more entrenched. Their strength is that they are already present in many enterprises.

Analyst: Do you mean Varonis has stronger integrations?

Expert: Yes. Stronger integration with Microsoft.

Analyst: Why might a customer pick Varonis over Cyera to purchase a DSPM solution?

Expert: I think the stronger integration with Microsoft is the number one reason for selecting Varonis.

Analyst: Does Varonis have a broad portfolio of products?

Expert: Not really. No.

Analyst: What might be BigID's differentiating factor?

Expert: Their differentiation, as far as I remember, is coming from regulatory compliance in addition to DSPM. That's their differentiation.

Analyst: Might BigID's customer base be relatively different to the other players', given the company is more in the regulated industries?

Expert: Yes. That's right. I'm not 100% sure, but it seems logical that healthcare and finance prefer BigID because of the strength in regulatory compliance.

Analyst: How is BigID's DSPM solution capability compared to the other players', especially Concentric?

Expert: It's probably equivalent to Concentric.

Analyst: Which player do you consider to be the fastest-improving in pure posture management solutions?

Expert: Probably Cyera because they are the fastest-growing and well-funded.

Analyst: What would you say Cyera owes the growth to? Is it purely additional funding or product feature capability?

Expert: While they are growing, I think they have better enterprise sales.

Analyst: Which player would you say is a low-cost provider when compared to the other three?

Expert: I think Varonis might be the lowest cost. Actually, I take that back. Probably both Varonis and BigID. I don't know which one is lower, but I suspect both of them are probably lower because they are slightly behind on the technology. I'm guessing it must be low cost, but I don't know.

What do you think are customers' top three purchasing criteria? How do you think they rank by importance?

Expert: I think time to deployment is one. The overall total cost of ownership is second. Third will be the quality of the product itself.

Analyst: Which players have the fastest time to deployment value, in your opinion?

Expert: I think Concentric and Cyera, both.

Analyst: What typical implementation bottlenecks do you see in the space?

Expert: Connecting with new data stores.

How important would you consider price to be for consumers in the space? Is it commoditised, somewhat commoditised or not commoditised, and why?

Expert: Somewhat commoditised because there are several players, so there is choice. There's also differentiation, so it's not fully commoditised.

Analyst: How might players differentiate themselves? Is it purely based on quality or time to value?

Expert: Quality, time to value and total cost of ownership. All three, they try to differentiate.

What is the industry average annual churn rate for DSPM software solutions – 0-5%, 6-10%, 11-15%, 16-20%, 21-25%, 26-30% or above 30%?

Expert: I don't know, but if I had to guess, maybe 6-10%.

How do you consider Concentric's churn rate to be compared to the industry average? Might it be in line with, better or worse than the industry?

Expert: On par.

What do you think has been the key driver of Concentric's historical growth? How has the company been able to capture market share historically?

Expert: I think product quality. Historically, Concentric was an early adopter of AI and being an early adopter, the quality of the product was better than the competition, so that was a key driver of historical growth.

How fast do you think Concentric could grow annually over the next three years? Do you see it growing as fast as the industry at 11-20% or do you see it growing faster or slower?

Expert: I think it will grow on par with the industry, [11-20%].

What could be some of the most interesting ways to grow Concentric? How would you look to improve its organic growth profile if you were to run the company?

Expert: I would double down on AI security because that's the fastest, biggest area of concern for customers.

Analyst: Is there anything specific in AI security? Is it the runtime or AI agent security?

Expert: AI agent security.

Analyst: Would you build some capability in-house or through third-party partnerships?

Expert: Probably third-party partnerships because there are a lot of start-ups that are moving very quickly and they are small and they are good acquisition targets.

Analyst: What would you do for the company's organic growth apart from doubling down on AI?

Expert: I mean, I would like to go into bigger customers because right now Concentric focuses on the mid-market.

Analyst: Would you cross the 10,000-employee threshold or stay within the same for big customers?

Expert: Crossing that threshold.

Analyst: Are there any industries you would target that might have big customer bases?

Expert: No. I think the strength is going across the board.

What would you do to improve Concentric's margin and operational efficiency?

Expert: I think the biggest cost is probably, let's see, one of the costs is cloud cost. The other cost is maintenance cost in terms of engineering time. Obviously, with AI, you can cut down on engineering time, but I would say it can give you some operational efficiency. In a growing company, a better strategy would be to not save money on engineering time, but expand the product capabilities using the engineers.

Analyst: What product capabilities would you enhance using engineers that might directly tie to margin improvements?

Expert: I think autonomous or automated remediation capabilities, that would be valuable.

Based on publicly announced acquisitions, how would you describe Concentric's M&A strategy? Has the company carried out any M&A in the past?

Expert: Yes. They have announced acquiring a couple of smaller start-ups.

Analyst: How would you describe the acquisitions? Have they been opportunistic or strategic?

Expert: I think they were opportunistic.

In your opinion, could it make sense for Concentric to acquire, merge with or be acquired by any players in or outside the DSPM space?

Expert: Yes. I'm sure there are other cybersecurity vendors who can add on DSPM as a capability. For those companies, buying rather than building in-house could be an attractive option.

Analyst: Why do you think acquiring small companies that have AI capabilities makes more sense for Concentric than getting acquired?

Expert: I don't think it's one vs the other. Both of them could make sense. Concentric acquiring smaller start-ups to build new features as well as getting acquired by a bigger player, both of them can make sense.

Analyst: Do any players come to mind that might fit the description?

Expert: All the bigger players are trying to build their own DSPM capabilities. Zscaler is one that comes to mind, but I don't know how well their internal DSPM capabilities are progressing. I don't really know which of the bigger players would be most interested in acquiring Concentric.

Is there anything the market does not properly understand about Concentric? Are there any common misconceptions about the company?

Expert: No. I don't think so.