Why Monad Chose to Be Infrastructure Instead of Another Security Tool

Why Monad Chose to Be Infrastructure Instead of Another Security Tool

The cybersecurity market has thousands of point solutions. Each one promises to be better, faster, or more comprehensive than the competition. Christian Almenar, CEO and Founder of Monad, looked at this crowded landscape and made a counterintuitive choice: he wouldn’t compete with any of them.

In a recent episode of Category Visionaries, Christian explained the strategic thinking behind positioning Monad as infrastructure rather than another security tool. The decision fundamentally changed how the company sells, who they compete with, and what objections they face in enterprise deals.

The Problem Everyone Else Was Solving

After selling his previous company Intrinsic to VMware, Christian spent time inside a large enterprise building a cybersecurity business unit. What he observed wasn’t a lack of security tools—it was the opposite problem entirely.

“What we kept running into is that customers really what they really struggle is like they have too many security products,” Christian explains. “They can’t really handle all the data these tools generate, yet they can’t really act on the data they generate easily the same way they act on when they get a lot of sales data or product data.”

Security teams were drowning. Not from lack of visibility or protection, but from an abundance of tools that didn’t talk to each other and generated data they couldn’t effectively use. The natural response for most founders would be to build a better consolidation tool—one product to replace many.

Christian went a different direction.

The Infrastructure Insight

The breakthrough came from observing how other parts of the business handled data. Christian noticed a striking contrast: “As a tech industry, we’ve done amazing work at understanding who’s on the other side of the screen in order to show them ads, really targeted ads, we really understand who’s on the other side and able to sell them a lot of really awesome things.”

Marketing teams could run sophisticated attribution models. Sales teams had comprehensive analytics on every deal. Product teams understood user behavior at granular levels. All of this was possible because those teams had access to modern data infrastructure—warehouses, analytics tools, machine learning capabilities.

Security teams had none of this. “It was almost striking that cybersecurity being so critical and so important for the world that it’s not Alipar with other industries,” Christian says. The question became: “How can we uplift the industry to at least be Alipar with what people do for sales data or marketing data?”

This framing changed everything. Instead of building another security tool, Monad would build the data infrastructure layer that security teams were missing.

The Positioning Decision

The strategic choice Christian made has profound implications for how Monad sells. “We don’t try to replace really any particular security tool out there,” he explains. “We want to empower customers to really take the most value out of the tools they currently have, be able to act on the data that those tools generate, and load it in whatever data warehouse they have, and then allow them to do more data driven workflows with them.”

This positioning eliminates the single biggest objection in enterprise security sales: “You’re asking me to rip out tools I’ve already invested in.”

When you position as infrastructure, you’re not competing with existing vendors. You’re making those vendors more valuable. The economic case shifts from substitution to addition. Instead of justifying switching costs, you’re justifying incremental value on top of sunk costs.

The sales conversation transforms entirely. Rather than convincing security teams that your point solution is better than their current one, you’re helping them “consolidate it, and ultimately be more effective in solving, understanding the risk and solving the threats they may have through just allowing them to do more data driven work.”

What This Means for Product Strategy

Positioning as infrastructure rather than a tool has cascading effects on product decisions. Christian is explicit about this: “We’re not a traditional security company per se. We’re more like a data kind of infrastructure company. This just happens to be very focused in cybersecurity.”

This identity shapes everything from technical architecture to user experience. While traditional security products optimize for detecting threats or preventing breaches, Monad optimizes for data operations—ingestion, transformation, loading, analysis.

The company’s goal becomes different too. Instead of trying to be the best at a specific security function, they’re trying to “help them consolidate all this plethora of tools they use and help them take the most valuable data these tools generate and be able to do very advanced analytics and very advanced data techniques that they already do for other use cases.”

This approach requires deep integration capabilities rather than deep point solution features. It requires thinking about data pipelines rather than detection algorithms. It’s fundamentally different work than building another security tool.

The Competitive Dynamics

When you position as infrastructure, your competitive set changes. Christian addresses this directly when asked about SIMs (Security Information and Event Management systems): “SIM is like such a tricky one. I mean, I think the notion of the SIM is being kind of decoupled a little bit.”

Rather than trying to replace SIMs, Monad positions as “a layer a little bit below the SIM. We can enable more advanced SIM kind of features, but at the same time, we more kind of stay at the data infrastructure layer.”

This is strategic ambiguity done right. Monad can work with SIMs, potentially replace certain SIM functions, or enable new approaches to the problems SIMs solve. By staying at the infrastructure layer, they maintain maximum flexibility about which specific use cases to enable.

The competitive advantage isn’t better features—it’s better positioning. Infrastructure companies don’t win by having the best algorithm. They win by being the layer that connects everything else.

The Market Timing Angle

Christian’s infrastructure bet relies on a specific market observation about consolidation: “Companies focusing more their attention and psycho kill it. Out of these five different tools that all kind of do similar things. Let us really understand which tools providing what’s the best ROI we get of these tools and then try to consolidate it and maybe focus only on a couple of them.”

This trend—tool consolidation and ROI scrutiny—creates the perfect environment for infrastructure plays. When customers are trying to rationalize their stack, they need better data about what’s actually working. That’s exactly what infrastructure enables.

Christian frames this as “an architectural shift and a little bit of consolidation.” Infrastructure companies thrive during architectural shifts because they provide the new foundation other tools build on.

The timing advantage is significant. If Christian had built Monad five years earlier, customers might not have been ready to think about security data infrastructure. They were still buying point solutions. But now, after years of tool sprawl, the market is ready for a different approach.

The Investor Thesis

When explaining why investors backed Monad, Christian points to the proven pattern in adjacent markets: “We started really incubating this company with Sequoia. In the beginning, we saw the success of the warehousing movement, south lakes of the world.”

The data warehousing revolution in other domains provided social proof that this approach works. Snowflake didn’t build better analytics tools—they built infrastructure that made all analytics tools better. That’s a more defensible, more valuable position than any individual tool could be.

Investors could see “the signs that customers kind of like reaching a tipping point of needing to do things differently when it comes to handling all the data these tools generate.” The infrastructure thesis wasn’t speculative—it was pattern matching to proven outcomes in adjacent markets.

The Principle Behind the Tactic

For founders in crowded markets, the lesson isn’t “position as infrastructure instead of a tool.” That tactic won’t work for every company or category.

The deeper principle is about finding a position that eliminates rather than overcomes objections. Christian didn’t figure out how to convince security teams to rip out existing tools. He positioned Monad so that objection became irrelevant.

When the biggest barrier to adoption is replacement cost, don’t build a better replacement—build something that makes the existing investment more valuable. When customers are drowning in tools, don’t add another one—build the layer that helps them extract more value from what they have.

This kind of positioning requires seeing the market from a different angle. It requires asking not “what tool are customers missing?” but “what capability do customers lack?” The answer to the second question often leads to infrastructure plays.

Christian saw that security teams weren’t missing better detection or prevention tools. They were missing the data infrastructure that would let them use their existing tools effectively. Building that infrastructure created a completely different competitive dynamic than building another point solution ever could.