Cloud and infrastructure providers
150 companies assessed. 80 of them, 53.3%, sit in the two least protected bands, against 53.3% across all 10,525 companies assessed.
The picture
Cloud and infrastructure is splitting into two very different stories. The big platforms that host everything, AWS, Google Cloud, Cloudflare, Datadog, MongoDB, Red Hat, F5, are mostly built to last because AI workloads still need somewhere to run, and switching a whole company's infrastructure is slow and painful. Even AWS, which is losing percentage points of share to faster-growing Azure and Google Cloud, is not losing customers, just growth rate. The real casualties are the thinner layers sitting on top of infrastructure: CI/CD tools, API marketplaces, testing frameworks, feature flagging, and AI coding assistants. These get replaced fast because AI coding agents and hyperscalers now bundle the same function for free or near-free. GitHub Actions folded into GitHub kills CircleCI's pricing model. Playwright, free from Microsoft, is out-downloading Cypress. Anthropic's Claude Code and GitHub Copilot are eating the coding-agent market Cursor, Replit, Cognition, and Lovable are all fighting over, while Continue.dev, RapidAPI, Fauna, and Stoplight have already been absorbed or shut down. The one dynamic deciding who survives is whether a company sits underneath the AI boom as plumbing everyone needs, or on top of it as a feature a hyperscaler or model lab can copy and ship for free next quarter.
All 150 companies, most protected first
| Company | Standing |
|---|---|
| Advantech Taiwan-based maker of rugged industrial PCs and edge-AI hardware for factories and IoT | Hard to displace |
| Amazon Web Services Amazon's cloud arm, the world's largest cloud computing infrastructure provider | Hard to displace |
| Chronosphere Cloud-native observability platform, now a Palo Alto Networks business unit after a $3.35B buyout | Hard to displace |
| ClickHouse Open-source database company that runs fast real-time analytics on huge data volumes | Hard to displace |
| Cloudflare Runs the global network layer that speeds, secures, and filters traffic for millions of sites | Hard to displace |
| CrowdStrike CrowdStrike sells cloud-based endpoint and cloud security software via its Falcon platform | Hard to displace |
| Datadog Datadog runs cloud monitoring dashboards that tell dev and ops teams when systems break | Hard to displace |
| F5 F5 makes app delivery and security gear (BIG-IP, NGINX) that runs traffic inside 23,000+ enterprises | Hard to displace |
| Google Cloud Platform Google's cloud arm: compute, storage, TPUs, and Gemini AI tools for enterprises | Hard to displace |
| Grafana Labs Grafana Labs makes the open-source stack (Grafana, Loki, Tempo, Mimir) teams use to watch their systems | Hard to displace |
| Harness Harness sells CI/CD and delivery governance software that runs deployments across enterprise cloud stacks | Hard to displace |
| JetBrains Maker of IntelliJ IDEA, PyCharm, Rider, and other professional coding tools for developers | Hard to displace |
| MongoDB Database platform that stores app data, documents, and now AI vector embeddings in one place | Hard to displace |
| Okta Okta sells identity and access management software so companies can log users and apps in securely | Hard to displace |
| Red Hat Red Hat sells enterprise Linux, OpenShift Kubernetes, and Ansible automation, owned by IBM | Hard to displace |
| Sentry Sentry tracks application errors and performance issues for software teams. | Hard to displace |
| Snowflake Cloud data platform where companies store, query, and now run AI on their data | Hard to displace |
| Synopsys Maker of chip design software (EDA) and simulation tools, now merged with Ansys | Hard to displace |
| Temporal Technologies Maker of Temporal, an open source engine that keeps long running software workflows reliable | Hard to displace |
| Tricentis Enterprise test automation vendor for SAP, Oracle, Salesforce, and mainframes | Hard to displace |
| Twilio Twilio runs the cloud APIs that let apps send texts, calls, and video worldwide. | Hard to displace |
| Akamai Runs a global CDN and edge security platform for enterprise websites and apps | Defensible for now |
| Atlassian Maker of Jira, Confluence, and Bitbucket, the workflow backbone for software teams | Defensible for now |
| Auth0 Auth0 builds identity and login APIs for developers, owned by Okta | Defensible for now |
| dbt Labs dbt Labs makes dbt, the standard tool teams use to transform data inside cloud warehouses | Defensible for now |
| Dynatrace Dynatrace sells AI-driven observability software that watches enterprise apps and infrastructure | Defensible for now |
| GitHub Code hosting platform with 150M+ developers, now built around the Copilot AI assistant | Defensible for now |
| GMO Internet Group Japanese internet group running payments, domains, hosting, securities, GPU cloud | Defensible for now |
| Hugging Face Open-source hub hosting 2.4M+ AI models, datasets, and tools for researchers and enterprises | Defensible for now |
| JFrog JFrog runs the storage and tracking system for enterprise software packages and builds | Defensible for now |
| Kong Inc. Kong sells API gateway infrastructure that routes traffic between apps, services, and now AI models | Defensible for now |
| Linear Linear makes fast, opinionated issue tracking and project software for software teams | Defensible for now |
| Naver Cloud Cloud and AI infrastructure arm of Naver Corp, built for Korean government and enterprise workloads | Defensible for now |
| Neo4j Neo4j makes the leading graph database, used to link and query connected data at scale | Defensible for now |
| Octopus Deploy Deployment automation platform helping enterprises release software across cloud and Kubernetes | Defensible for now |
| Perforce Software Maker of Helix Core version control for large game, film, and chip files, plus Puppet and Black Duck tools | Defensible for now |
| PostHog Open-source product analytics and feature-flag platform built for engineering teams | Defensible for now |
| Progress Software Rollup owning legacy dev tools: OpenEdge, DataDirect, Chef, Telerik, MOVEit, ShareFile | Defensible for now |
| Sakura Internet Japanese cloud host now selling government-certified sovereign GPU capacity for AI workloads | Defensible for now |
| SonarSource Swiss maker of SonarQube/SonarCloud, static code analysis for security and code quality | Defensible for now |
| Sonatype Maker of Nexus Repository, the tool that scans and manages open-source software components for security | Defensible for now |
| Splunk Splunk is Cisco's $28B security and log-analytics platform, now folded into Cisco's networking stack. | Defensible for now |
| Supabase Open-source Postgres backend that AI coding tools use to store app data | Defensible for now |
| SUSE German vendor of enterprise Linux, Kubernetes, and Rancher tools for regulated and SAP shops | Defensible for now |
| Vercel Cloud platform for deploying web apps, built around Next.js and AI tool v0 | Defensible for now |
| VMware Virtualization and private cloud software giant, now Broadcom's Infrastructure Software unit | Defensible for now |
| Wiz Wiz scans AWS, Azure, GCP, and Oracle Cloud for security risks across accounts | Defensible for now |
| WorkOS WorkOS builds enterprise-ready login APIs: SSO, SCIM, MFA for developers. | Defensible for now |
| AppDynamics Cisco's application performance monitoring tool, folded into the Splunk observability lineup | Protection under test |
| BrowserStack Cloud platform for testing websites and apps across real browsers and devices | Protection under test |
| Codacy Codacy runs automated code review and quality checks across 15,000+ organizations | Protection under test |
| Codefresh GitOps and CI/CD tool now folded into parent Octopus Deploy's platform | Protection under test |
| Confluent Streaming data platform built on Apache Kafka, now an IBM subsidiary after March 2026 buyout | Protection under test |
| DigitalOcean Cloud hosting and infrastructure platform built for developers and startups | Protection under test |
| Elastic Maker of Elasticsearch, a search, security, and observability platform. | Protection under test |
| EnterpriseDB (EDB) Enterprise Postgres database company helping firms migrate off Oracle and run Postgres at scale | Protection under test |
| GitGuardian Makes tools that scan code for leaked passwords and secrets before hackers find them | Protection under test |
| HashiCorp Maker of Terraform and Vault, infrastructure automation tools, now an IBM unit | Protection under test |
| Instabug Instabug (now Luciq) makes an SDK for mobile crash reporting, bug tracking, and app monitoring | Protection under test |
| LaunchDarkly Feature flag and release management platform for enterprise software rollouts | Protection under test |
| mabl AI-powered low-code platform that builds and maintains software tests for enterprise QA teams | Protection under test |
| MariaDB plc Open-source relational database maker now owned by private equity firm K1 | Protection under test |
| Micro Focus Legacy enterprise testing, security, and mainframe software, now a brand inside OpenText | Protection under test |
| Moesif API analytics and monetization platform, now a WSO2-owned subsidiary | Protection under test |
| MuleSoft Salesforce's API integration platform that connects enterprise apps and data | Protection under test |
| Optimizely Optimizely sells a bundled CMS, commerce, personalization, and A/B testing platform to large enterprises | Protection under test |
| Percona Open-source database support and services company for MySQL, PostgreSQL, and MongoDB | Protection under test |
| Qualys Qualys sells cloud-based vulnerability scanning and compliance reporting to over 10,000 enterprises | Protection under test |
| SolarWinds SolarWinds sells IT and application monitoring software to 300,000 mostly on-prem business customers | Protection under test |
| Treblle Treblle sells API observability and governance software with SDKs across 40+ languages | Protection under test |
| Algolia Algolia sells search and product-discovery APIs that power site search for thousands of online stores | Losing its protection |
| Amplitude Amplitude tracks how users behave inside apps and websites for product teams | Losing its protection |
| Apollo GraphQL Apollo GraphQL builds the Apollo Federation platform that connects APIs into a single graph for enterprise apps | Losing its protection |
| Applitools Applitools sells visual AI testing software that catches unintended UI changes in web and mobile apps | Losing its protection |
| Appwrite Open-source backend platform giving developers a self-hosted alternative to Firebase | Losing its protection |
| Aqua Security Israeli maker of container and cloud runtime security tools like Trivy, used by banks and Fortune 100 firms | Losing its protection |
| Bitrise Bitrise runs a mobile-only CI/CD platform, building and testing iOS and Android apps in the cloud. | Losing its protection |
| Buildkite Buildkite runs CI/CD pipelines that let engineering teams test and ship code on their own servers | Losing its protection |
| Chargebee Subscription billing API platform for mid-market SaaS companies to run recurring revenue | Losing its protection |
| Checkmarx Application security testing vendor scanning code for vulnerabilities before it ships | Losing its protection |
| CircleCI CircleCI runs cloud continuous integration and delivery pipelines for software teams | Losing its protection |
| Clerk Clerk sells drop-in login and user management APIs for app developers | Losing its protection |
| CloudBees CloudBees runs enterprise CI/CD software built on Jenkins for regulated companies | Losing its protection |
| Cloudinary Developer API for storing, transforming, and delivering images and video at scale | Losing its protection |
| Cockroach Labs Cockroach Labs makes CockroachDB, a distributed SQL database for multi-region, multi-cloud apps | Losing its protection |
| CodeRabbit AI tool that automatically reviews code and flags bugs before merge | Losing its protection |
| CodeSandbox Cloud code editor and sandbox maker, now folding into Together AI's infrastructure | Losing its protection |
| Cognition AI Cognition AI makes the Devin coding agent and owns Windsurf's IDE, selling AI software engineers to firms and governments | Losing its protection |
| Contentful Headless CMS platform letting developers manage content across websites and apps via APIs | Losing its protection |
| Contrast Security Makes runtime app security tools (IAST/RASP/ADR) that watch code while it executes | Losing its protection |
| Couchbase Couchbase makes a NoSQL database for apps that need offline mobile sync and fast lookups. | Losing its protection |
| Cursor (Anysphere) Cursor makes an AI-powered code editor used by 50,000+ enterprise teams to write and edit software | Losing its protection |
| Cypress.io Cypress.io makes a JavaScript framework and cloud platform for testing web apps end to end | Losing its protection |
| DevRev AI-native platform merging dev, product, and customer support work in one system | Losing its protection |
| Docker Docker makes the tools developers use to build, package, and run containers. | Losing its protection |
| Fastly Fastly runs an edge cloud network for CDN, security, and serverless compute | Losing its protection |
| Fivetran Fivetran automates moving and transforming data between databases, apps, and warehouses. | Losing its protection |
| FullStory Session replay analytics that shows how people use websites and apps | Losing its protection |
| GitLab GitLab runs a DevSecOps platform covering code, security, and delivery in one product. | Losing its protection |
| Gitpod Gitpod (now Ona) runs sandboxed cloud environments where AI coding agents execute tasks | Losing its protection |
| Graphite Stacked-PR code review and merge queue tool now owned by Cursor | Losing its protection |
| Gremlin Gremlin sells chaos engineering software that deliberately breaks systems to test reliability | Losing its protection |
| Hasura Hasura sells an instant GraphQL API layer that sits on top of your database | Losing its protection |
| Honeycomb.io Observability platform for high-cardinality tracing, built for engineers debugging complex systems | Losing its protection |
| Katalon Katalon makes an automated software testing platform used by 30,000+ QA and DevOps teams | Losing its protection |
| LambdaTest Cloud platform for cross-browser and device testing, now rebranded around AI test agents | Losing its protection |
| LogRocket Session replay and frontend monitoring tool for debugging user experience issues | Losing its protection |
| Lovable Lovable is a chat based AI tool that builds full working apps from a text prompt | Losing its protection |
| Mend.io Mend.io scans open-source code and dependencies for security flaws and license risk. | Losing its protection |
| Mintlify AI-powered platform for hosting and generating developer documentation | Losing its protection |
| Mixpanel Product analytics platform tracking user behavior for app and web teams | Losing its protection |
| Netlify Netlify hosts and deploys websites and apps, from Git push to live URL, with edge and CI/CD built in | Losing its protection |
| New Relic New Relic sells a unified observability platform for monitoring apps, infrastructure, and AI agents | Losing its protection |
| ngrok Tunneling and API gateway tool that lets developers expose local apps to the internet | Losing its protection |
| Orca Security Agentless cloud security platform that scans AWS, Azure, and GCP for risks without installing agents | Losing its protection |
| PagerDuty Incident response and on-call management software for IT and DevOps teams | Losing its protection |
| PlanetScale Serverless MySQL and Postgres database platform built on Vitess for developers | Losing its protection |
| Postman Postman is a platform where developers build, test, and share APIs. | Losing its protection |
| Prisma Prisma makes an open-source ORM for Node.js/TypeScript and now sells managed Postgres hosting on top of it. | Losing its protection |
| Pulumi Cloud infrastructure-as-code platform letting engineers script deployments in real programming languages | Losing its protection |
| Qodo Qodo builds AI code review and testing tools that check and verify AI-generated code | Losing its protection |
| Redis Redis makes the in-memory database software embedded in most companies' tech stacks | Losing its protection |
| Redocly Redocly makes tools that turn API specs into docs, governance checks, and CI workflows | Losing its protection |
| Redpanda Kafka-compatible streaming data platform for real-time data pipelines and agentic AI workflows | Losing its protection |
| Render Render hosts and deploys web apps and services in the cloud for developers | Losing its protection |
| Replit Browser-based AI coding platform that builds, hosts, and deploys apps for non-developers | Losing its protection |
| Retool Low-code platform where companies build internal tools tied to their own data | Losing its protection |
| Rollbar Rollbar tracks and triages software errors in real time for engineering teams | Losing its protection |
| Route Mobile Route Mobile routes SMS, WhatsApp, and RCS messages for enterprises across India and beyond | Losing its protection |
| RudderStack Open-source, warehouse-native customer data pipeline for developers | Losing its protection |
| Sauce Labs Sauce Labs runs automated web and mobile app testing used by banks, retailers, and big enterprises. | Losing its protection |
| Semgrep Semgrep makes code scanning software that finds security bugs across many languages and platforms | Losing its protection |
| SingleStore Distributed SQL database built for real-time transactional and analytical apps | Losing its protection |
| SmartBear Maker of SoapUI, Swagger, and TestComplete for API and software testing | Losing its protection |
| Snyk Snyk scans code and dependencies for security flaws before software ships | Losing its protection |
| StackBlitz StackBlitz makes Bolt.new, an AI tool that builds apps from text prompts in the browser | Losing its protection |
| Statsig Feature flagging and experimentation platform, now run by Amplitude after OpenAI bought and split off its founding team | Losing its protection |
| Sumo Logic Sumo Logic runs cloud log management and observability tools for security and IT teams | Losing its protection |
| Sysdig Sysdig sells runtime security and monitoring for containers and cloud workloads | Losing its protection |
| Timescale Tiger Data (formerly Timescale) builds a time-series database extension for PostgreSQL | Losing its protection |
| Unity Technologies Unity makes the game engine and mobile ad tech that developers use to build and monetize games | Losing its protection |
| Veracode Veracode scans application code for security flaws, sold mostly to regulated enterprises | Losing its protection |
| Whatfix Whatfix builds in-app tooltips and walkthroughs that guide employees through enterprise software | Losing its protection |
| Xata Serverless Postgres platform for developers, offering branching and BYOC deployment | Losing its protection |
| Yugabyte Yugabyte builds a distributed, Postgres-compatible database for large-scale, always-on apps | Losing its protection |
| Zed Industries Zed makes a fast, open-source, GPU-rendered code editor built for AI-assisted coding | Losing its protection |
| Continue.dev Open-source framework for building custom AI coding assistants, now defunct | Little protection left |
| Fauna Defunct serverless database company that shut down its service on May 30, 2025 | Little protection left |
| RapidAPI Former API marketplace, now a fading legacy asset inside Nokia's telecom API business | Little protection left |
| Stoplight API design and documentation tool now owned by SmartBear, being folded into other products | Little protection left |
Questions people ask
- Will AWS lose its lead to Google Cloud or Azure in the AI era?
- AWS still holds the largest share of the cloud market, but Azure (+40% year over year) and Google Cloud (+63% year over year) are growing faster and AWS's share has slipped from 29% to 28%. It is losing growth rate, not customers.
- Is GitHub Copilot losing ground to Cursor and Claude Code?
- Yes, Copilot's share among professional developers fell from 67% to 51% year over year as Cursor (around $2B ARR) and Anthropic's Claude Code (scaled to roughly $47B run-rate territory by some measures) pull developers to AI-native tools.
- What happened to Fauna the database company?
- Fauna shut down its service entirely on May 30, 2025. Its former customers moved to AWS DynamoDB, Google Firestore, and Azure Cosmos DB.
- Is Docker still relevant against Kubernetes and Podman?
- Docker is under real pressure as Red Hat's Podman wins enterprise migrations and AWS, Azure, and GCP build native container tooling that skips Docker, though it has not disappeared.
- Which cloud infrastructure companies are considered safest right now?
- AWS, Google Cloud, Cloudflare, Datadog, MongoDB, Red Hat, and F5 all show low pressure and high moat scores, with no named competitor shown taking their customers.
- Why are AI coding tools like Cursor and Replit under pressure themselves?
- They face pressure from the same model labs whose AI they depend on. Anthropic's Claude Code is pulling developers directly from Cursor, Replit, and Cognition AI, since those labs now ship competing coding agents built on their own models.
What to watch
- Quarterly cloud market share reports showing AWS, Azure, and Google Cloud growth rates
- ARR and user numbers reported by Cursor, Anthropic's Claude Code, and GitHub Copilot
- AWS ElastiCache and Google Memorystore documentation on Valkey defaults versus Redis usage stats
Head to head in this sector
Sectors with a similar picture