How the desk reads markets.
The desk grades cybersecurity GTM the way nobody else grades it — on the motion, not the product. The GTM Exposure Index reads seven observable signals, every one of them visible from the outside.
Gartner and Forrester grade product. Crunchbase and Dealroom report capital. The desk does something different: it grades how a vendor goes to market — how the motion compounds (or doesn't), how the category is being authored (or borrowed), how exposed the position is when consolidation pressure rises. That's what produces the belts in the Kumite.
The seven dimensions
Every fighter in the Kumite is graded across seven dimensions. The first six are diagnostic: they read the present. The seventh is leading: it reads what AI engines are recommending today, which is what buyers will type into Google in two quarters.
Is the wedge sharp, defensible, and scoped? Or is the vendor pitching a platform without a wedge?
Where does the pipeline come from? Sales-led, marketing-led, channel-fed, PLG — and does the engine compound or stall at scale?
Does the vendor write the category — in analyst notes, in buyer language, in their own homepage — or borrow it from the incumbents?
Will the motion still work in two years? Different from category authorship: a vendor can author a category and still run a motion that breaks under scale or competition.
Do partners actually carry this vendor — MSP, MSSP, VAR, SI, marketplace, OEM — or is the partner program logos in a deck?
If the category consolidates, does the vendor survive? Get acquired well? Get sunset? The position relative to the consolidation pressure ramp is the read.
Do Perplexity, ChatGPT, Grok, and Gemini cite this vendor when asked about the category? AI citation is the leading demand signal — what buyers will discover next quarter, not what they Googled last quarter.
How grades become belts
Each dimension scores 0–100 against the published rubric below. The composite resolves to a belt — white, blue, purple, brown, black — matching the karate progression that gave the Kumite its name. Belts are earned, not bought. A featherweight can hold a black belt; a heavyweight can hold a white one. Capital buys scale; it does not buy a belt.
Every belt comes with a Verdict: a one-paragraph editorial read explaining why the score landed where it did and what would move it. The Verdict is where the methodology becomes a position.
The rubric — what each score means
Each dimension is scored 0–100 against fixed anchors. Between bands, the lower one holds unless a specific signal earns the lift — under-claiming protects the read. The anchors:
Positioning
85+ — owns a sharp, defensible wedge that matches what ships; lands in one read. 45–64 — generic or category-inflated; the claim outruns the product. Under 25 — acronym fog, or a feature wearing a category's clothes.
Demand engine
85+ — a compounding engine drawing on a real budget line it didn't have to invent. 45–64 — a working but single-source motion that stalls at scale. Under 25 — no demonstrable pull; demand the vendor invented.
Category authorship
85+ — writes the category in analyst notes, buyer language, and its own page. 45–64 — competes inside a category someone else authored. Under 25 — borrows the incumbents' language wholesale.
Motion durability
85+ — the motion still works in two years; retention and switching cost a platform can't simply absorb. 45–64 — viable but absorbable; a plausible tuck-in. Under 25 — a thin motion the platforms bundle away next cycle.
Channel fit
85+ — partners actually carry it: marketplace gravity, real MSP/MSSP/alliance co-sell. 45–64 — a nascent program; some listings, mostly direct. Under 25 — partner logos in a deck; no carry.
Consolidation resilience
85+ — survives the category consolidating: well-capitalized, hard to bundle out, or acquires from strength. 45–64 — survives, but as a likely acquisition. Under 25 — sunset or absorbed; on the wrong side of the pressure ramp.
AI Citation (leading)
85+ — dominant cross-engine citation share; cited first across the tested engines. 45–64 — present but inconsistent; single-engine leads discounted. Under 25 — effectively uncited in category queries. Read from the citation pull and stored with its run date — never hand-overwritten.
The seven combine into a composite, exp (0–100, equal-weight by default, weighting recorded when adjusted), which resolves to the grade and belt. The composite is shown — it is the read, not a vanity score; the dimensions and the Verdict are why it landed there.
Divisions, weight classes, leagues
Fighters are placed on two axes — the weight class they fight at (capital tier · revenue band · headcount) and the division they fight in (security category · bake-off level).
Weight classes map to stage and capital type: pre-seed through public, bootstrapped through PE-backed. A black belt at heavyweight isn't comparable to a black belt at featherweight — the rubric weights different things at each tier.
Divisions are drawn at the buyer-bake-off level: where vendors actually compete head-to-head. MDR is a division. EDR/XDR is a division. CNAPP is a division. Eligibility requires a primary-business match and a materiality floor — only the top of each division gets ranked and carded.
What "outside-in only" means
Every signal that feeds a grade is observable from outside the company: funding records, headcount + hiring, traffic, brand search, AI citation, public positioning, analyst coverage, partner directories, category authorship, M&A activity. No vendor fills out a form. No private number ever touches a grade.
This is the firewall that makes the desk credible. The belt is not for sale. No vendor pays for placement. Sponsors of the desk do not get preferential reads — sponsorship rules are published separately, and the editorial wall is enforced by the same person who signs the verdicts.
Gartner grades the product. We grade the motion. Both are useful; they answer different questions. Ours answers the one a board asks the CEO when the quarter misses: is the company selling well, or just selling hard?
Sources cited
Every metric that informs a grade comes from a named source. The desk uses CybersecTools and Return on Security for category + funding data, MyTelescope for demand and AI citation telemetry, and public filings (10-Ks, S-1s, press releases) for capital structure and acquisitions. Specific signals are cited inline in each Kumite dossier. The grades themselves are ours — methodology applied to those signals, marked illustrative.
Refresh cadence
The Banzuke refreshes per Kumite season (currently Season 01, in beta). Inside a season, individual fighter dossiers update as new signals land: a funding round, a category-defining product launch, an acquisition, a quarterly citation re-run. The full Index re-runs at season boundary. Mid-season belt promotions and demotions are possible when a signal is decisive — rare but documented.