The Architecture Shift Strategy: How Monad Sells Infrastructure in a Consolidation Wave

The Architecture Shift Strategy: How Monad Sells Infrastructure in a Consolidation Wave

Category creation has become startup gospel. Define a new market, own the messaging, become the category king. But Christian Almenar, CEO and Founder of Monad, took a different approach—one that might be more applicable to most founders than the category creation playbook suggests.

In a recent episode of Category Visionaries, Christian explained how Monad positioned itself within an observable industry transformation rather than trying to manufacture a category from scratch. The strategy reveals something important about timing, positioning, and how to sell infrastructure during periods of market consolidation.

The Honest Answer About Categories

When asked about market categories, Christian gives an answer most founders would never admit: “I will lie if I say items exactly. I know exactly where it’s still early in the physical companies also early in the industry.”

This uncertainty isn’t a weakness—it’s strategic clarity. Instead of forcing a clean category definition that doesn’t quite fit, Christian describes what’s actually happening in observable customer behavior.

“It’s kind of like an architectural shift and a little bit of consolidation that I think is happening,” he explains. This framing sidesteps the entire category creation debate and anchors to something more tangible: changes customers are already experiencing.

The phrase “architectural shift” is carefully chosen. It’s not about new capabilities appearing—it’s about fundamental changes in how systems are built and connected. These shifts create opportunities for infrastructure plays because the old foundation no longer supports what customers need to do.

Reading the Consolidation Wave

Christian’s description of what’s driving this shift is grounded in specific customer pain: “Companies focusing more their attention and psycho kill it. Out of these five different tools that all kind of do similar things. Let us really understand which tools providing what’s the best ROI we get of these tools and then try to consolidate it and maybe focus only on a couple of them.”

This is consolidation behavior—not adding more tools, but rationalizing the stack. And consolidation waves create perfect conditions for infrastructure companies because customers need better data to make consolidation decisions.

Think about the sequence: Security teams accumulated tools over years. Each tool generated data. But they couldn’t effectively compare ROI across tools because the data lived in silos. Now they’re under pressure to consolidate, but they lack the infrastructure to make informed decisions about which tools to keep.

That’s where Monad enters. Not as another tool to add to the stack, but as the data layer that enables smarter consolidation decisions. Christian positions this explicitly: “We want to empower customers to really take the most value out of the tools they currently have.”

The timing advantage is significant. If Christian had built Monad five years earlier, customers weren’t ready to rationalize their stacks—they were still buying tools. But now, after years of accumulation, the market has shifted to consolidation mode.

The Infrastructure Play During Transformation

Christian is explicit about Monad’s identity relative to traditional security categories: “We’re not a traditional security company per se. We’re more like a data kind of infrastructure company. This just happens to be very focused in cybersecurity.”

This positioning allows Monad to avoid direct competition with the security tools customers already own. When Christian talks about the vision, it’s about enabling rather than replacing: “We don’t try to replace really any particular security tool out there. We want to empower customers to really take the most value out of the tools they currently have, be able to act on the data that those tools generate, and load it in whatever data warehouse they have.”

Infrastructure companies thrive during architectural shifts because they provide the new foundation other solutions build on. The shift Christian identified—from siloed security tools to data-driven security operations—requires infrastructure that didn’t exist in the previous architecture.

This is different from category creation. Christian isn’t trying to convince the market that a new category needs to exist. He’s observing an architectural shift already underway and positioning Monad as the infrastructure layer that shift requires.

How This Affects Investor Positioning

Christian’s explanation of investor interest centers on observable market behavior rather than speculative category definitions: “They see the signs that customers kind of like reaching a tipping point of needing to do things differently when it comes to handling all the data these tools generate.”

The investor thesis isn’t “believe this new category will emerge.” It’s “observe customers reaching a tipping point in an existing market.” The difference matters because one requires faith in a future state while the other requires pattern recognition of current behavior.

Christian also points to proven patterns from adjacent markets: “We started really incubating this company with Sequoia. In the beginning, we saw the success of the warehousing movement, south lakes of the world.”

The data warehousing revolution provides a template. Investors don’t need to believe data infrastructure for security is a novel invention—they need to believe the same transformation that happened in analytics can happen in security. That’s a much easier thesis to validate than pure category creation.

The SIM Positioning Challenge

One of the trickiest aspects of positioning infrastructure during market transformation is handling overlap with existing categories. Christian addresses this directly when discussing SIMs (Security Information and Event Management): “SIM is like such a tricky one. I mean, I think the notion of the SIM is being kind of decoupled a little bit.”

Rather than claiming to replace SIMs or create a new category distinct from SIMs, Christian positions Monad at a different layer: “We kind of see a little bit like a layer a little bit below the SIM. We can enable more advanced SIM kind of features, but at the same time, we more kind of stay at the data infrastructure layer.”

This ambiguity is strategic. During architectural shifts, category boundaries blur. New capabilities become possible. Old categories get redefined. By positioning as infrastructure rather than as a SIM competitor or replacement, Monad maintains flexibility about which specific use cases to enable.

The company can work with SIMs, potentially replace certain SIM functions, or enable entirely new approaches to the problems SIMs solve. That optionality is only possible because they’re not locked into competing within an existing category.

The Customer Behavior Anchor

What makes Christian’s approach work is constant anchoring to observable customer behavior rather than abstract category definitions. When he describes the transformation, it’s in terms of what customers are actually doing.

“What we kept running into is that customers really what they really struggle is like they have too many security products. They can’t really handle all the data these tools generate, yet they can’t really act on the data they generate easily the same way they act on when they get a lot of sales data or product data.”

This description doesn’t require believing in a new category. It requires acknowledging a problem customers already recognize. The architectural shift and consolidation wave aren’t marketing narratives—they’re descriptions of changes customers are already experiencing.

This grounding in customer behavior makes the positioning immediately credible. Security teams know they have too many tools. They know they’re struggling with data. They know other parts of their organization do better data-driven work. Christian isn’t asking them to imagine a future state—he’s describing their current reality.

The Data Warehouse Layer Strategy

Christian’s vision for where Monad fits in the stack reveals the infrastructure play: customers should “be able to act on the data that those tools generate, and load it in whatever data warehouse they have, and then allow them to do more data driven workflows with them.”

Notice the phrase “whatever data warehouse they have.” Monad isn’t trying to be the data warehouse. They’re enabling security data to flow into existing data infrastructure. This positions them as connective tissue during an architectural shift—the layer that allows security to leverage infrastructure the rest of the business already uses.

This strategy only works during a transformation. In the old architecture, security tools were standalone products with their own databases and limited integration. In the new architecture, security data flows into centralized warehouses alongside sales, marketing, and product data.

Monad enables that new architecture without requiring customers to rip out existing tools or completely reinvent their stack. They’re infrastructure for the transition itself.

The Underlying Principle for Founders

What Christian demonstrates is an alternative to forced category creation. Instead of manufacturing a new category and spending years educating the market, find an architectural shift already underway and position your infrastructure to enable it.

This approach requires different skills than category creation. You need to recognize transformation patterns before they’re obvious. You need to describe market changes in terms customers already understand. You need to position your solution as enabling the shift rather than inventing something entirely new.

The advantages are significant. You’re selling with the current rather than against it. Customer education becomes easier because you’re describing changes they’re experiencing rather than changes you’re predicting. Investor thesis becomes pattern-matching rather than pure speculation.

Christian’s goal isn’t to create a category called “security data platforms” and own that definition. It’s to “uplift the industry to at least be Alipar with what people do for sales data or marketing data.” That framing positions Monad within a transformation already happening rather than trying to start one from scratch.

For founders evaluating positioning strategies, the lesson is about reading market conditions accurately. Sometimes the best move isn’t creating a new category—it’s identifying the infrastructure layer required by an architectural shift already underway.