Well, nothing like a little Claude-led hacking of the Mexican government, a little World War III, more tariffs, and a fictional Substack article that tanked (the already down bad) public markets on new AI displacement fears! ¯\_(ツ)_/¯

The good news, at least, is that the public cyber companies have rebounded about halfway from their precipitous fall in the prior week. If you missed last week’s issue, I covered my take on all of that in the opener.

Read through this as part of monitoring the situation.

💡 _{Share the newsletter in one click}

😎 Vibe Check

Click the options below to vote on whether you are a practitioner, founder, or investor. Feel free to leave a comment, and I'll feature the best takes in next week’s write-up!

Last issue’s vibe check:
Plot twist: What's actually good about vendor consolidation?
🟨🟨🟨🟨🟨⬜️ Fewer vendors to manage
🟨🟨⬜️⬜️⬜️⬜️ One throat to choke when things break
🟩🟩🟩🟩🟩🟩 Tools that actually integrate
🟨🟨🟨⬜️⬜️⬜️ Fewer security questionnaires to fill out

Integration is the name of the game, but just having fewer vendors to manage is also a huge selling point. That is, of course, if they actually integrate products well and aren’t leaving you with massive coverage gaps. I suspect this has a lot more to do with the painful third-party risk management and vendor procurement process at most companies than anything else. 🤔 

Who is building the agentic AI vendor procurement and onboarding platform of the future?? (Only partially said in jest 👀)

Some of the top comments from last week’s vibe check:

💬 “Microsoft does this shockingly well.“

💬 “Managing fewer vendors is not a win if you have gaps in coverage. Broadcom is the counter example for the “one throat to choke” argument. You have no idea how the consolidated company will act. It takes years, if not decades, for vendors to fully integrate beyond some superficial logo updates.”

💰 Market Summary

Private Markets

• 11 deals from 10 companies across 2 countries raised $221.3M across 8 unique product categories

• Average deal size was $27.7M (median: $18.6M)

• 100% of funding went to product companies

• 5 companies from 3 countries were acquired across 5 unique product categories

• 60% of M&A activity went to service companies

Public Markets

• 1 public cyber company [$ZS ( ▲ 1.96% ) ] had an earnings report last week

As of markets close on February 27, 2026.

📸 YoY Snapshot

While overall deal volume has tapered off over the last few weeks, the deals landing are still really exciting.

M&A activity continues to stay ahead of the momentum from the same time last year, and I suspect 2026 will bring even more acquisitions than 2025.

🔭 Zooming Out 🆕 

Stories hidden in the numbers

• CTEM's Moment: Three companies in the threat and vulnerability management space raised simultaneously this week, making it officially the latest buzzword that is now dead. When multiple startups in the same category raise at the same time, it signals deep investor conviction and also signals future consolidation pressure.

• Offensive Security Is Having a Year: 16 deals in the past 12 months is 8.0x the prior year's pace. This product category barely existed two years ago (not offensive security services, but products). The rise of AI may have, for the first time in recent memory, driven an offense-first product arc as the threat landscape demands it more now than ever.

🧩 Funding By Product Category

• $75.0M for Third-Party Risk Management (TPRM) across 1 deal

• $61.0M for Data Protection across 2 deals

• $50.0M for Continuous Threat Exposure Management (CTEM) across 2 deals

• $16.1M for AI Governance across 2 deals

• $12.0M for Security and Compliance Automation across 1 deal

• $7.2M for Continuous Controls Monitoring (CCM) across 1 deal

• An undisclosed amount for Security Operations across 1 deal

• An undisclosed amount for Threat and Risk Prioritization across 1 deal

🏢 Funding By Company

Product Companies:

• UpGuard, a United States-based third-party risk management platform, raised a $75.0M Series C from Springcoast Capital Partners. (more)

• Gambit Security, a United States-based data protection, data recovery, and cyber resiliency platform, raised $56.0M Series A from CyberStarts, Kleiner Perkins, Spark Capital and $5.0M Seed. (more)

• Astelia, a United States-based continuous threat exposure management platform, raised a $25.0M Series A from Index Ventures. (more)

• ThreatAware, a United Kingdom-based continuous threat exposure management platform, raised a $25.0M Series A from One Peak. (more)

• Trustwise AI, a United States-based AI governance, compliance, and safety platform, raised a $12.1M Venture Round. SEC Filing

• Secfix, a United States-based continuous security and compliance company, raised a $12.0M Series A from Alstin Capital. (more)

• Spektrum, a United States-based continuous controls monitoring platform, raised a $7.2M Convertible Note. SEC Filing

• Evoke Security, a United States-based agentic AI discovery, governance, and threat modeling platform, raised a $4.0M Pre-Seed from Crosspoint Capital Partners. (more)

• Prophet Security, a United States-based AI-assisted security operations platform, raised an undisclosed Venture Round from Amex Ventures and Citi Ventures. (more)

• Zafran Security, a United States-based threat and risk prioritization platform that uses your existing tool stack to show risks and mitigations, raised an undisclosed Venture Round from Amex Ventures. (more)

Service Companies:

• None

🌎 Funding By Country

• $196.3M for the United States across 10 deals

• $25.0M for the United Kingdom across 1 deal

🤝 Mergers & Acquisitions

Product Companies:

• 1touch.io, a United States-based Data Aware Security, was acquired by Pure Storage for an undisclosed amount. 1touch.io had previously raised $14.0M in funding. (more)

• Sevco Security, a United States-based attack surface management (ASM), was acquired by Arctic Wolf for an undisclosed amount. Sevco Security had previously raised $53.7M in funding. (more)

Service Companies:

• AdvizeX, a United States-based managed services provider (MSP), was acquired by Myriad360 for an undisclosed amount. AdvizeX has not previously disclosed any funding events. (more)

• Astralas, an Australia-based professional services firm focused on security architecture and engineering, was acquired by Bastion Security Group for an undisclosed amount. Astralas has not previously disclosed any funding events. (more)

• DataLogiX, an Ireland-based managed security services provider, was acquired by Ekco for an undisclosed amount. DataLogiX has not previously disclosed any funding events. (more)

📚 Great Reads

🧪 Labs

It’s super simple, really.

Buongiorno, this week’s issue was written live and direct from beautiful Italy! 🇮🇹 ⛷️ 

While I was attempting to ski, public markets got absolutely clapped again last week, and this time it was the major public cyber companies who took the beating. Nothing like trying to monitor the situation on a gondola! 😅 

The reason public cyber companies were “securitymogged” last week is that Anthropic launched Claude Code Security, a new set of capabilities that “scans codebases for security vulnerabilities and suggests targeted software patches for human review, allowing teams to find and fix security issues that traditional methods often miss.”

As a result, public markets freaked out, declared cyber as a “solved problem,” panic sold, and wiped out about $15 billion in market cap from the top public cyber companies.

It’s not surprising that Anthropic is going after application security; they absolutely have to. Given that so much code is now completely AI-generated, it only makes sense to start securing the code the AI models are already writing. It’s a welcome advancement, and I can’t wait to start testing it, but it also reveals what has to be true for AI companies, regardless of the market they target. Every major frontier lab will have to push deeper and deeper into the application stack to realize the value of the massive investments they’ve made.

To put it into perspective, Anthropic and OpenAI alone have raised over $140 billion to date, more than Palo Alto’s market cap. The frontier labs have to try to eat the world, and they’ve got the funding and talent to make that true in as many verticals as possible. We’re going to continue to see this play out in other markets with AI, and it’s both welcome and scary to see so much competence destruction and competence enhancement happening.

That aside, what is surprising, rather, is the market’s disconnect from the reality of cyber. The major selloff shows that public market investors have no idea what cyber is.

You know how, when you’re using AI on a topic you know really well, you can easily spot things that are either false or completely off-base? And how the opposite is true when you’re using AI on a topic you don’t know anything about? Yeah, that’s what’s happening here in the public markets.

There is no winner-take-all in the public market for the cyber industry, and especially not in the private market. What we’re seeing now is short-term fear among tourist investors in a market they don’t understand.

You’ve heard that the stock market is not the economy, and the same is true for the cybersecurity economy. Will the AppSec market change even more than it has over the last few years? Absolutely. Does that mean AppSec is dead and that all private and public companies should pack up and go? Absolutely not.

The top public cyber companies really won’t be affected by this release in the medium- and long-term, and the large number of private companies across the AppSec space are already responding to this news and adapting. I suspect the industry will be singing a different tune in another two quarters.

The saying from the great Warren Buffett, “Be greedy when others are fearful,” comes to mind now and should be helpful in these times.

Let us all get this bread, family. 🥖 🥐 😤 👊 

💡 _{Share the newsletter in one click}

😎 Vibe Check

Click the options below to vote on whether you are a practitioner, founder, or investor. Feel free to leave a comment, and I'll feature the best takes in next week’s write-up!

Last issue’s vibe check:
RSA Innovation Sandbox now requires $5M seed for all finalists. This is:
🟨⬜️⬜️⬜️⬜️⬜️ Game-changing for early-stage cyber
🟩🟩🟩🟩🟩🟩 Creates perverse incentives
🟨🟨⬜️⬜️⬜️⬜️ Good marketing, questionable ROI
⬜️⬜️⬜️⬜️⬜️⬜️ Helps level the playing field
🟨⬜️⬜️⬜️⬜️⬜️ Doesn't matter, only execution does

Well, that’s quite the resounding answer for last week’s vibe check, and the comments didn’t hold back. 😳

So much has changed in the industry since the competition started 21 years ago. Big conferences like RSA, analyst firms, and a few media outlets were really the only ways anyone in cyber could learn about innovation in the industry.

The number of companies started, and the number of investors funding them, has grown an order of magnitude since then, and you don’t have to wait once a year to learn about what’s new and up and coming on the current issues the industry cares about.

Now add on the incentive of investing, and that calculus starts to change for what the industry trusts. Practitioners today will need a lot more proof than winning a competition to become invested, which, for many, is a welcome change.

Some of the top comments from last week’s vibe check:

💬 “It’s appealing. Cash is king, and I doubt any group of founders will turn down the check. What I’ll be curious to see is if it’s “smart money” or does the investment help or hamper the ability to attract institutional investors.“

💬 "This is now less an industry event about actually rewarding the more interesting and innovative companies, and more about creating deal flow for the VC in question. Also, try to put yourself in the place of a startup disrupting a particular segment - what if Crosspoint Capital is already invested in your main competitor? Essentially this means once they pick a winner in one category, it makes it very unlikely other players in that category will apply in the future. Eventually, the event runs out of categories and becomes irrelevant. Horrible, horrible decision.”

💰 Market Summary

Private Markets

• 10 companies from 4 countries raised $121.0M across 9 unique product categories

• Average deal size was $15.1M (median: $7.3M)

• 100% of disclosed funding went to product companies

• 7 companies from 3 countries were acquired for $400.0M across 5 unique product categories

• 86% of M&A activity went to service companies

Public Markets

• 1 public cyber company [$PANW ( ▲ 0.29% ) ] had an earnings report last week

As of markets close on February 20, 2026.

📸 YoY Snapshot

A quieter week on the funding front, but there's still a lot happening with the deals being made. We are now within the lull before the RSA storm, however, so I expect this to explode again in the next few weeks.

M&A continues to rip however, with the public cyber companies again leading the way on high-profile acquisitions. While services businesses make up most of the acquisitions each week, AI Governance and PAM companies are in high demand this year.

🔭 Zooming Out 🆕 

Stories hidden in the numbers

• Platform Predator: Palo Alto Networks acquired Koi this week, its 4th cyber acquisition in 2 years (QRadar, ProtectAI, CyberArk, Koi and not counting Chronosphere, which is non-cyber). Each addresses a different capability gap in SIEM, ML security, identity, and endpoint security. Koi raised $48M just five months ago and probably never got to spend it.

• TVM Isn’t Dead: Threat & Vulnerability Management is the hottest category in cyber right now, with $201M across 21 deals in the last 12 weeks, up 414% year-over-year.

• Compliance Goes Global: Two security and compliance automation startups raised the same week from opposite sides of the world. With NIS2, DORA, Saudi PDPL, and more, every region is writing its own rules, and every region seems to need its own compliance platform.

🧩 Funding By Product Category

• $42.0M for Threat & Vulnerability Management (TVM) across 1 deal

• $25.0M for Threat Intelligence across 1 deal

• $25.0M for Privileged Access Management (PAM) across 1 deal

• $9.5M for Security and Compliance Automation across 2 deals

• $7.5M for Application Security Posture Management (ASPM) across 1 deal

• $7.0M for Anti-Bot across 1 deal

• $5.0M for Hardware Security across 1 deal

• An undisclosed amount for Software Supply Chain Security across 1 deal

• An undisclosed amount for Managed Detection and Response (MDR) across 1 deal

🏢 Funding By Company

Product Companies:

• Cogent Security, a United States-based AI-agent-enabled threat and vulnerability management platform, raised a $42.0M Series A from Bain Capital Ventures. (more)

• Venice, a United States-based privileged access management and just-in-time identity security platform, raised a $25.0M Series A from IVP. (more)

• VulnCheck, a United States-based threat intelligence platform for exploits, vulnerabilities, and initial access brokers, raised a $25.0M Series B from Sorenson Capital. (more)

• BlueFlag Security, a United States-based software security and governance platform, raised a $7.5M Venture Round. SEC Filing

• Copla, a Lithuania-based security and compliance automation platform, raised a $7.1M Series A from Iron Wolf Capital. (more)

• Darwinium, a United States-based bot-detection and abuse prevention platform, raised a $7.0M Venture Round. SEC Filing

• Caspia Technologies, a United States-based hardware security and supply chain security platform, raised a $5.0M Venture Round. SEC Filing

• Solidrange, a Saudi Arabia-based security and compliance automation platform, raised a $2.4M Seed from Sharaka Capital. (more)

• Zenyard, a United States-based automated malware reverse engineering and software security platform, raised an undisclosed Pre-Seed from Mindset Ventures. (more)

Service Companies:

• DeltaSpike, a Singapore-based managed detection and response provider for Southeast Asia, raised an undisclosed Venture Round from VentureTECH. (more)

🌎 Funding By Country

• $111.5M for the United States across 7 deals

• $7.1M for Lithuania across 1 deal

• $2.4M for Saudi Arabia across 1 deal

• An undisclosed amount for Singapore across 1 deal

🤝 Mergers & Acquisitions

Product Companies:

• Koi, an Israel-based endpoint protection platform focusing on unmanaged and self-installed software like packages, containers, extensions, and local AI models, was acquired by Palo Alto Networks for an undisclosed amount. Koi had previously raised $48.0M in funding. (more)

Service Companies:

• Defy Security, a United States-based managed services firm focused on penetration testing, operational technology security, and security program management, was acquired by Booz Allen Hamilton for $400.0M. Defy Security had previously raised $8.0M in funding. (more)

• Abile Group, a United States-based professional services firm focused on systems engineering, networking, and cyber services, was acquired by Valiant Solutions for an undisclosed amount. Abile Group has not previously disclosed any funding events. (more)

• IronCircle, a United States-based cybersecurity training, education, and certification company, was acquired by QuickStart Inc. for an undisclosed amount. IronCircle has not previously disclosed any funding events. (more)

• Stripe OLT, a United Kingdom-based Microsoft-based managed security services provider (MSSP) for the UK, was acquired by Little Fish for an undisclosed amount. Stripe OLT has not previously disclosed any funding events. (more)

• Tech Superpowers, a United States-based managed security services provider (MSSP), was acquired by IT Solutions Consulting for an undisclosed amount. Tech Superpowers has not previously disclosed any funding events. (more)

• Velonex Technologies, a United States-based managed services provider (MSP), was acquired by Future Standard for an undisclosed amount. Velonex Technologies has not previously disclosed any funding events. (more)

📚 Great Reads

🧪 Labs

Hope you enjoyed the long weekend if you had Monday off!

It was another rip-roaring time in the cyber industry last week. Between the happenings in the cyber industry and all the AI/SaaSpocalypse/OpenClaw excitement, it’s really hard to be out here monitoring the situation (I probably need to build several agents to do this 🤔 ).

A huge amount of volume from last week, so might as well jump to the website version so you don’t miss anything. 🫡 

💡 _{Share the newsletter in one click}

😎 Vibe Check

Click the options below to vote on whether you are a practitioner, founder, or investor. Feel free to leave a comment, and I'll feature the best takes in next week’s write-up!

Last issue’s vibe check:
What AI security assumption from 2023 aged the worst?
🟩🟩🟩🟩🟩🟩 AI will replace most security analysts
🟨🟨⬜️⬜️⬜️⬜️ LLMs are too unreliable for real security work
🟨⬜️⬜️⬜️⬜️⬜️ Creating compliance frameworks will work
🟨🟨🟨🟨⬜️⬜️ We have time to figure this out

I expected the top option to win and the bottom option to get a lot of traction, but I’m pleasantly surprised to see that the second option of LLMs not being reliable for security work did not get more votes. This shows the industry has come quite a long way since we were first mass-introduced to the LLM and chatbot concepts.

On the AI replacing security analysts front, I think we can clearly see that was never a real future state. The more you uncover in security, with or without AI, but especially with, the more work you realize there is to do. Is the work changing slightly? Yes, it’s getting deeper now, and practitioners need even more scaffolding, support, data, and access to get their AI workflows into the places we have always needed them.

There is still much work to be done, and that’s a positive sign for all of us.

Some of the top comments from last week’s vibe check:

💬 “A close one for me, this. But real-world LLM-based offsec tooling is getting better. Still a lot of noise out there, but the progress is real.“

💬 “Humans are too unreliable for real security work, especially given that our adversaries are AI-enabled. Trying to fight today's malicious hackers without AI is like fighting a battle in 2026 armed only with knives and clubs.”

💰 Market Summary

Private Markets

• 28 companies from 5 countries raised $289.0M across 22 unique product categories

• Average deal size was $11.6M (median: $5.0M)

• 98% of funding went to product companies

• 8 companies from 3 countries were acquired across 6 unique product categories

• 88% of M&A activity went to product companies

• 1 company announced a layoff

Public Markets

• 4 public cyber companies [$RPD ( 0.0% ) , $DDOG ( ▲ 2.79% ) , $NET ( ▲ 0.96% ) , and $CHKP ( ▼ 0.07% ) , ] had an earnings report in the first few weeks of 2026, in another blood bath of a week in public markets, thanks to more AI fears

• CyberArk $CYBR ( ▼ 0.09% ) has officially left the building! After closing on the acquisition from Palo Alto, the stock exited at $408.85 and has seen a ~1,300% increase in value since its initial listing in 2014. Now that’s quite the return 🫡

As of markets close on February 13, 2026.

📸 YoY Snapshot

A high-volume week that pushes the YTD total for 2026 over $2 billion in funding raised for the cybersecurity industry.

M&A continues to run wild, with activity up by more than 12% year to date.

🔭 Zooming Out 🆕 

Stories hidden in the numbers

• Instant Innovation: Crosspoint Capital Partners, which acquired the RSA Conference back in 2022, deployed $50M across all 10 Innovation Sandbox finalists this week. The competition now guarantees (and requires) $5M in seed funding for all finalists, making RSA one of the most active cyber seed investors in a single week.

• Serial Acquirer: Last week, it was Check Point’s turn to be the serial acquirer. In a rare move, Check Point acquired three cyber companies to the tune of $150 million. It’s giving major private equity vibes.

• Morphing Time: AppSec pulled in $61 million in funding and an acquisition, as the broader category continues to absorb adjacent capabilities from developer-centric observability and reachability tools.

🧩 Funding By Product Category

• $61.0M for Application Security across 3 deals

• $30.9M for Third-Party Risk Management (TPRM) across 3 deals

• $30.0M for SaaS Security Posture Management (SSPM) across 1 deal

• $25.0M for Privileged Access Management (PAM) across 1 deal

• $24.0M for Application Security Testing (AST) across 2 deals

• $24.0M for Confidential Computing across 1 deal

• $20.0M for Security and Compliance Automation across 1 deal

• $20.0M for Threat & Vulnerability Management (TVM) across 1 deal

• $10.0M for AI Governance across 2 deals

• $7.0M for Professional Services across 1 deal

• $5.0M for Fraud and Financial Crime Protection across 1 deal

• $5.0M for Security Log Data Management (SLDM) across 1 deal

• $5.0M for Identity Verification across 1 deal

• $5.0M for Human Risk Management across 1 deal

• $5.0M for Non-Human Identity (NHI) Security across 1 deal

• $4.8M for Physical Security across 1 deal

• $3.2M for Continuous Threat Exposure Management (CTEM) across 1 deal

• $3.0M for Digital Forensics and Incident Response (DFIR) across 1 deal

• $1.1M for Threat Detection and Response (TDR) across 1 deal

• An undisclosed amount for Cyber Risk Quantification across 1 deal

• An undisclosed amount for Data Protection across 1 deal

• An undisclosed amount for Email Security across 1 deal

🏢 Funding By Company

Product Companies:

• GitGuardian, a United States-based automated secrets and non-human identity detection platform, raised a $50.0M Series C from Insight Partners and Quadrille Capital. (more)

• Reco, a United States-based SaaS security posture management platform, raised a $30.0M Series B from Zeev Ventures. (more)

• Segura, a Brazil-based privileged access management (PAM) platform, raised a $25.0M Venture Round from Riverwood Capital. (more)

• Opaque Systems, a United States-based confidential computing platform for data analytics workloads, raised a $24.0M Series B from Walden Catalyst. (more)

• Complyance, a United States-based security and compliance automation platform, raised a $20.0M Series A from Google Ventures. (more)

• Nucleus Security, a United States-based automated threat and vulnerability remediation platform, raised a $20.0M Series C from Delta-v Capital. (more)

• Backslash Security, an Israel-based Application Security Platform, raised a $19.0M Series A from KOMPAS VC. (more)

• Lema AI, an Israel-based continuous third-party risk management platform, raised a $17.5M Series A from Team8. (more)

• Clearly AI, a United States-based automated third-party security questionnaire response platform, raised a $8.4M Seed from Basis Set Ventures. (more)

• ZAST.AI, a United States-based agentic AI-driven application security platform, raised a $6.0M Seed from Hillhouse Capital. (more)

• Charm Security, a United States-based customer fraud prevention platform focused on preventing scams and social engineering attacks, raised a $5.0M Seed from RSA Conference. (more)

• Clearly AI, a United States-based automated third-party security questionnaire response platform, raised a $5.0M Seed from RSA Conference. (more)

• Crash Override, a United States-based application security platform, raised a $5.0M Seed from RSA Conference. (more)

• Fig Security, an Israel-based data engineering management platform for security log data, raised a $5.0M Seed from RSA Conference. (more)

• Geordie AI, a United Kingdom-based governance and monitoring platform for AI agents and autonomous workflows, raised a $5.0M Seed from RSA Conference. (more)

• Glide Identity, a United States-based authentication and identity verification platform, raised a $5.0M Seed from RSA Conference. (more)

• Humanix, a Canada-based human risk management platform, raised a $5.0M Seed from RSA Conference. (more)

• Realm Labs, a United States-based AI governance and model safety platform that observes model inference and decision making to prevent harm, raised a $5.0M Seed from RSA Conference. (more)

• Token Security, an Israel-based non-human and agentic identity posture management platform, raised a $5.0M Seed from RSA Conference. (more)

• ZeroPath, a United States-based code vulnerability scanning platform, raised a $5.0M Seed from RSA Conference. (more)

• Allthenticate, a United States-based SaaS-based physical access management software, raised a $4.8M Seed. SEC Filing

• Veria Labs, a United States-based continuous threat exposure management platform, raised a $3.2M Seed from Amino Capital, Gokul Rajaram, MA7 Ventures, Matias Woloski, Paul Graham, Rock Yard Ventures, and Seaplane Ventures. (more)

• CYDELPHI, a United States-based automated digital forensics and incident response platform, raised a $3.0M Seed from Glasswing Ventures. (more)

• Hardshell, a United States-based threat detection and response platform, raised a $1.1M Pre-Seed from Black Prism Capital Partners, Blu Venture Investors, CAV Angels, Front Porch Venture Partners, Mojo Ventures, Not Yet Ventures, and VTC Ventures. (more)

• CyberServal, a United States-based data security platform, raised an undisclosed Corporate Round from Chaitin Tech. (more)

• CypherShield, a United States-based email security and threat and risk visibility platform, raised an undisclosed Pre-Seed from LvlUp Ventures.

• Quantara AI, a United States-based cyber risk quantification platform, raised an undisclosed Seed.

Service Companies:

• RemoteThreat, a United States-based professional services firm focused on offensive security, raised a $7.0M Seed. [SEC Filing]

🌎 Funding By Country

• $207.5M for the United States across 21 deals

• $46.5M for Israel across 4 deals

• $25.0M for Brazil across 1 deal

• $5.0M for the United Kingdom across 1 deal

• $5.0M for Canada across 1 deal

🤝 Mergers & Acquisitions

Product Companies:

• Acuvity, a United States-based visibility and governance platform for AI application usage in the enterprise, was acquired by Proofpoint for an undisclosed amount. Acuvity had previously raised $9.0M in funding. (more)

• Anchor, a United States-based certificate lifecycle management platform, was acquired by Keycard for an undisclosed amount. Anchor has not previously disclosed any funding events. (more)

• Arco Cyber, a United Kingdom-based unified threat and risk prioritization platform, was acquired by Sophos for an undisclosed amount. Arco Cyber has not previously disclosed any funding events. (more)

• Autonomous Plane, a United States-based threat and risk prioritization platform, was acquired by Endor Labs for an undisclosed amount. Autonomous Plane has not previously disclosed any funding events. (more)

• Cyata, an Israel-based agentic AI governance and security platform, was acquired by Check Point Software Technologies for an undisclosed amount. Cyata had previously raised $8.5M in funding. (more)

• Cyclops Security, an Israel-based cybersecurity mesh architecture platform, was acquired by Check Point Software Technologies for an undisclosed amount. Cyclops Security had previously raised $12.8M in funding. (more)

• Rotate, a United States-based managed detection and response platform, was acquired by Check Point Software Technologies for an undisclosed amount. Rotate has not previously disclosed any funding events. (more)

Service Companies:

• Veros Technologies, a United States-based professional services firm focused on secure systems engineering and operations, was acquired by Quantum Leap Research for an undisclosed amount. Veros Technologies has not previously disclosed any funding events. (more)

📚 Great Reads

🧪 Labs

I finally shipped the 2025 State of the Cybersecurity Market report last week after far too many hours of writing! If you’re ever curious what the process looks like, it’s a bit like this:

Let me know what you think!

Also, two more things:

1. If you’re building cyber products or investing in those who do, and you’re attending the RSA Conference, sign up here for a happy hour I’m co-hosting with Sands Capital.

2. If you’re a cybersecurity brand looking to get in front of 16,000+ security leaders from around the world this year, reach out and let’s talk 🤝

💡 _{Share the newsletter in one click}

😎 Vibe Check

Click the options below to vote on whether you are a practitioner, founder, or investor. Feel free to leave a comment, and I'll feature the best takes in next week’s write-up!

Last issue’s vibe check:
How are we feeling about OpenClaw and Moltbook, fam?
🟨🟨🟨🟨🟨⬜️ Exciting, and I can't stop monitoring the situation
🟩🟩🟩🟩🟩🟩 Fun to play with, but never in a company
🟨🟨⬜️⬜️⬜️⬜️ Scared and I have to brief my execs/board on it
🟨🟨🟨⬜️⬜️⬜️ Crypto scams all the way down
🟨🟨🟨⬜️⬜️⬜️ OpenClaw? Is that a hippie Red Lobster?

What a time to be alive in the security industry! I can’t think of another time in my nearly 20-year career where tech advances and security threats have come so fast. Compound that with the fact that a much larger population of people than normal are ready to dive headfirst, YOLO mode, into letting these incredibly powerful technologies run their whole everything.

It’s also amazing to see all the various companies put out so much threat intelligence and open-source software to protect things like OpenClaw, because it’s already running in corporate environments, whether we like it or not. If you’re putting out open-source tools like these, let me know so I can share them!

Some of the top comments from last week’s vibe check:

💬 “Boil it and serve it with hushpuppies, but don't let it near the domain controllers!”

💰 Market Summary

Private Markets

• 9 companies from 5 countries raised $194.9M across 7 unique product categories

• Average deal size was $27.8M (median: $31.0M)

• 84% of funding went to product companies

• 8 companies from 4 countries were acquired for $826.8M across 7 unique product categories

• 62% of M&A activity went to product companies

Public Markets

• 4 public cyber companies [$VRNS ( ▲ 2.14% ) , $TENB ( ▼ 0.19% ) , $QLYS ( ▼ 0.01% ) , $FTNT ( ▼ 0.92% ) ] had an earnings report in the first few weeks of 2026, in another blood bath of a week, thanks to AI advancement fears

As of market close on February 2nd, 2026.

📸 YoY Snapshot

A slower, but still strong week for the first week of February has the industry inching ever closer to $2 billion in funding for 2026.

Not to be outdone, M&A activity is still moving in a fast and furious manner. The 37 deals YTD are up 12% from the same time period in 2025.

🔭 Zooming Out 🆕 

Stories hidden in the numbers

• Series A Dominance: Three of nine deals were Series A rounds, commanding $105M, or 54% of all capital deployed. At an average of $35M, these rounds were 2.6x the 13-week median deal size of $13.5M. Post-seed companies are graduating at premium valuations, suggesting a narrowing window to get into winners before they either get acquired or price out.

• Serial Acquirer: Varonis is building through acquisition, like so many other large public cyber companies. This week's deal marks their 3rd cyber pickup in the past year.

• Platform Consolidation Wave: Varonis added AI governance (AllTrue.ai, $150M). Zscaler absorbed browser isolation (SquareX). Semperis acquired IAM backup (MightyID). Each deal fills an adjacent capability gap. This is the "one vendor" thesis playing out in real time.

🧩 Funding By Product Category

• $70.0M for Fraud and Financial Crime Protection across 1 deal

• $42.0M for Software Supply Chain Security across 1 deal

• $32.0M for Data Security Posture Management (DSPM) across 1 deal

• $31.0M for Managed Security Services Provider (MSSP) across 2 deals

• $12.0M for Autonomous Product Security Engineering (APSE) across 1 deal

• $4.9M for Confidential Computing across 1 deal

• $3.0M for Data Protection across 2 deals

🏢 Funding By Company

Product Companies:

• TRM Labs, a United States-based anti-fraud platform for cryptocurrencies and Web3, raised a $70.0M Series C from Blockchain Capital. (more)

• RAPIDFORT, a United States-based software supply chain security platform for container workloads, raised a $42.0M Series A from Blue Cloud Ventures and Forgepoint Capital. (more)

• Orion Security, an Israel-based data security posture management (DSPM) platform, raised a $32.0M Series A from Norwest. (more)

• Nullify, an Australia-based autonomous product security engineering (APSE) platform, raised a $12.0M Seed from SYN Ventures. (more)

• enclaive, a Germany-based multi-cloud confidential computing platform, raised a $4.9M Seed from Amadeus APEX Technology Fund, Join Capital. (more)

• Myota, a United States-based data backup and protection platform using encryption and data sharding, raised a $3.0M Venture Round. SEC Filing

• DuoKey, a Switzerland-based cloud management and data encryption-as-a-service platform, raised an undisclosed Non-Equity Assistance from Innovaud and the International Institute for Management Development.

Service Companies:

• RADICL Defense, a United States-based managed security services provider (MSSP) for small to medium businesses (SMB), raised a $31.0M Series A from Paladin Capital Group. (more)

• CyberFOX, a United States-based managed security services provider, raised an undisclosed Venture Round from Level Equity Management. (more)

🌎 Funding By Country

• $146.0M for the United States across 5 deals

• $32.0M for Israel across 1 deal

• $12.0M for Australia across 1 deal

• $4.9M for Germany across 1 deal

• An undisclosed amount for Switzerland across 1 deal

🤝 Mergers & Acquisitions

Product Companies:

• Qoria, an Australia-based digital safety and Internet security platform for schools, was acquired by Aura for $675.0M. Qoria has not previously disclosed any funding events. (more)

• AllTrue.ai, a Canada-based AI governance and risk management platform, was acquired by Varonis Systems for $150.0M. AllTrue.ai has not previously disclosed any funding events. (more)

• Atriarch, a United States-based decentralized identity-based encrypted communications platform, was acquired by CyberCatch for $1.8M. Atriarch has not previously disclosed any funding events. (more)

• MightyID, a United States-based backup and recovery platform for IAM systems and identity migrations, was acquired by Semperis for an undisclosed amount. MightyID has not previously disclosed any funding events. (more)

• SquareX, a Singapore-based remote browser isolation platform, was acquired by Zscaler for an undisclosed amount. SquareX had previously raised $26.0M in funding. (more)

Service Companies:

• Magna5, a United States-based managed services provider (MSP), was acquired by AEA Investors for an undisclosed amount. Magna5 has not previously disclosed any funding events. (more)

• Maple Woods Enterprises, a United States-based professional services firm focused on cybersecurity assessments and threat monitoring, was acquired by Logicalis US for an undisclosed amount. Maple Woods Enterprises has not previously disclosed any funding events. (more)

• Verinext, a United States-based professional services firm focused on networking and data security, was acquired by Arctiq for an undisclosed amount. Verinext has not previously disclosed any funding events. (more)

📚 Great Reads

🧪 Labs

Pre-idea, pre-team (it’s just Claude telling me what to do), pre-product, pre-revenue, raising $100M pre-seed at a 0% discount, $100B valuation, serious offers only, LGTM 🚀 

I lol’ed at the number of people who didn’t realize this was satire

Welcome to the fourth annual State of the Cybersecurity Market report from Return on Security. If you’ve read the previous reports (thank you!), you know what to expect. For the new folks, I wanted to share what you’re about to get into.

What you’ll find is that these annual reports follow a narrative structure, using data to explain key developments in the cybersecurity industry and the broader economy over the past year and to highlight their significance. All of this comes from data and will leave you with the “so what” and clarity on the year that was.

What you will not find in these reports is just as important as what you do. These reports do not include 100+ page slide decks, logo collections, or promotional content disguised as thought leadership. The way we work has changed significantly in the past year, and this report reflects that. This report, like all the others before it, is text-first and is built for you and the AI tools you now use to do your job. 

I've been doing it this way for four years, and the rest of the world just caught up.

New here? The weekly Return on Security newsletter is where this analysis lives year-round. Four years of consistent tracking, every week, watching patterns develop in real time.

Let's get into it.

Table of Contents

• Key Findings

• The Year That Was

• Funding

• Acquisitions

• On AI & Security

• Geographic Breakdown

• Public Markets and The RoS Cyber Index

• How did our 2025 predictions hold up?

• Closing and what we predict for 2026

• About This Report

Key Findings

• Funding: Cybersecurity companies raised $25.1 billion across 743 deals in 2025, up 59% from 2024

• M&A: $76.4 billion across 320 deals, led by Google's $32 billion acquisition of Wiz, the largest in industry history

• Mega-rounds: 48 deals over $100M captured 65% of all funding

• AI Security reality: Just 2.6% of funding, not even a top-10 category despite the hype

• Geographic concentration: The US + Israel absorbed 91% of global cybersecurity funding

• Public markets: Only 5 of 14 pure-play cyber stocks finished 2025 positive; the Return on Security Cyber Index returned -6.5%

• The Great Bundling: Cyber companies buying IT, IT buying cyber, manufacturing entering security through acquisition

The Year That Was

When 2025 started, did you think the cybersecurity industry would have such a stellar year? I was optimistic, of course, but 2025 far exceeded my expectations.

In a year of global uncertainty, no less. A year where regulatory and geopolitical issues increasingly impacted how technology companies operated, where capital flowed, and where companies were started and built.

Every year when I do these annual reports, I come back to a central question that I try to answer. That question?

2025 proved that we are, in fact, so back in the cybersecurity industry. But it wasn’t because everything went well, and because the year didn’t have its challenges.

The Economy and Markets in 2025

Before diving into the cybersecurity-specific data, it's worth understanding the economic backdrop that shaped 2025.

2025 marked the start of The Uncertainty Era.

US tariffs and trade wars created global uncertainty, central banks cut rates worldwide (except Japan), currency valuations went wild, AI optimism and fears loomed larger than ever, Big Tech couldn’t spend enough money on data centers and energy, global conflicts continued to rage on, Europe rearmed itself, and precious metals stockpiling were among the most significant market drivers of 2025. Not to mention that many stock markets, somehow, had their best performance in years.

Here were some of the biggest highlights that had direct and indirect impacts on the cybersecurity industry:

Central Banks Finally Eased

After years of tightening, the major central banks pivoted in 2025. The US Federal Reserve cut rates three times, bringing the target range down to 3.50%-3.75% by December. The European Central Bank (ECB) delivered eight cuts in total (starting in June 2024), bringing the rate to 2.00% by mid-2025. The Bank of England made four cuts, ending the year at 3.75%. The notable exception was the Bank of Japan +, which raised rates to 0.5%, still the lowest among major economies, but a meaningful shift from below zero. 

Lower rates unlock capital, and investors who had sat on the sidelines in 2023-2024 started deploying and financing M&As again in 2025.

Big Tech Went All-In on AI Infrastructure

The hyperscalers spent over $380 billion on capital expenditures in 2025, most of it on AI infrastructure. Meta nearly doubled its capex to $72 billion. Amazon hit $125 billion. Google and Microsoft each approached $90-95 billion. These numbers are projected to exceed $500 billion in 2026. 

It’s these large players driving technology that ultimately determine where security budgets come from downstream. When hyperscalers spend, they and their customers need to secure what they're building, and the AI infrastructure boom has created an equally sized boom in new attack surfaces and new markets for security vendors.

The large shifts also had downstream effects on the labor market.

The Cyber Workforce

While broader financial headlines looked strong, the labor market told a more complicated story and reshaped headcount decisions across the industry.

Cyber Company Layoffs

The layoff landscape in cybersecurity cooled significantly from the 2022-2023 peak.

Return on Security tracked 21 layoff events at cybersecurity companies in 2025, down from over 50 in 2023 but up from 16 in 2024. The most significant single event was CrowdStrike's May announcement of 500 layoffs (5% of staff), and this was notable because the company's stock was up 35% for the year at the time.

Several layoffs were M&A-driven rather than market-driven:

• Sophos cut 6% after acquiring Secureworks

• Axonius cut 10% while digesting multiple acquisitions

• Armis laid off 50% of OTORIO's staff after its $120 million acquisition 

This story was one that many companies saw across all industries in 2025, where cost optimization was the name of the game, not mismanagement or distress.

There was, however, one AI disruption story: Deepwatch cited "accelerating investments in AI and automation" as the reason for cutting 25% of its workforce in November.

Just like in 2024, 2025 brought more worries and more demand for AI and AI Agents to supplement, replace, and displace knowledge work as we know it. While there is not always a direct correlation that we can see, AI is changing the tone of every conversation.

Cyber Company Shutdowns

Something new we started tracking in 2025 at Return on Security: cybersecurity company closures. 

In total, six cybersecurity companies shut down in 2025:

• NanoLock Security, an Israel-based operational technology (OT) security company that raised $18M, cited war-related financial strain.

• Skybox Security, a United States-based network security company that raised $335M raised, sold all its assets to Tufin and then abruptly shut down.

• Myrror Security, an Israel-based software supply chain security company that raised $6M, cited market saturation and hiring missteps.

• CyberAlerts, a Spain-based threat intelligence database for emerging vulnerabilities, shut down after 6 months due to a lack of profitability.

• The Scottish MSSP, Adarma, entered administration, citing intense competition, rising costs, and cashflow issues following the loss of a major customer.

• Cortanix, an Israel-based observability and security analytics platform that raised $21M, shut down after one year of operations.

These are the ones we know about and from a public source. The observations here are less “industry in distress" and more natural market corrections.

Likely, many other permutations of closing the proverbial doors in 2025 did not make the news but were effectively the same. Are endless product pivots that burn runway without real, consistent customer traction that much different than shutting things down? For investors and equity holders, there can be some fates worse than death.

Meanwhile, the financial side of the industry told a very different story. Capital flowed back into the industry in a major way at both the earliest and the latest stages. But that prosperity wasn’t always universal or evenly distributed.

Let’s analyze the recent developments in public markets, private funding, and M&A activity, as well as the geographic shifts that determined the winners and losers.

How Much Funding Did Cybersecurity Companies Raise in 2025?

TL;DR: Cybersecurity companies raised $25.1 billion across 743 deals in 2025, a 59% increase from 2024. Capital returned to the market, but concentrated heavily: 48 mega-rounds ($100M+) captured 65% of all funding. Average deal size jumped 37% to $40.9M.

The financial side of the cybersecurity industry tells us a lot about market health. In 2025, the story was clear: capital came back, and it came back in a big way.

Highlights:

• 743 funding events totaling $25.1 billion. 2025 was up 59% in dollars and 10% in deal volume from 2024

• 48 mega-rounds ($100M+) accounted for 65% of all funding, but were concentrated in just 6% of deals

• Average deal size jumped 37% from $29.9M to $40.9M globally

• Transparency improved: 83% of deals disclosed amounts, up from 78% in 2023-2024

When did the funding come in?

June and December were the standout months, accounting for 35% of the year's funding. August was the summer lull for the cybersecurity industry (too many people at Burning Man?), and the only month in 2025 below $1 billion.

How did 2025 compare to previous years?

Looking at a year-over-year view, the story unfolds a bit more.

This four-year view shows the industry's full cycle. 2022 marked ZIRP’s peak and subsequent crash, 2023 was the year of course correction and austerity measures (i.e., startups needing to “make revenue”), 2024 was all about stabilization and an industry healing, and 2025 was a return to form. Deal volume never recovered to 2022 levels, but dollars and average deal size did.

Where did the funding concentrate?

When capital returned to cybersecurity in 2025, it returned with conviction, but that conviction went to a relatively small number of companies. 

Mega-rounds ($100M+):

• 48 deals captured $16.4 billion (65% of all funding)

• The remaining 695 deals split $8.7 billion (35%)

• Mega-round volume up 78% YoY ($9.2B to $16.4B)

The average deal size jumped 37% globally, from $29.8 million to $40.9 million.

Did transparency improve?

Not all funding events come with disclosed amounts. Tracking disclosure rates tells us something about market confidence.

Transparency jumped 4.5% after holding flat through the correction years. Companies disclose amounts when they're proud of the raise and want the attention that comes with it.

Here’s the thing we learned over the last few years: distribution is the best moat a startup can create in 2025 and beyond. The companies that learned to own their distribution during the lean years are the ones making the biggest splashes now. A $50M Series B announcement hits differently when you've already built the audience to hear it.

The old playbook of raising money and then buying attention doesn’t work anymore. The new playbook is to build distribution first through the channels people actually seek out and trust. The funding announcement just amplifies what you already have. 

Either way, the disclosure is just the starting gun. The difference is whether you're lighting a fire or feeding one.

How did funding break down by stage?

Series B funding doubled, signaling a renewed appetite for scaling proven early-stage winners. Series C grew the slowest, reflecting the "graduation problem" where companies struggle to reach the metrics needed for late-stage checks or early-stage acquisitions.

The "Other" category includes post-IPO debt, convertible notes, grants, and rounds that don't map neatly to traditional stages. We track all capital movement into cybersecurity companies, not just the rounds that fit VC reporting conventions.

What does a "normal" round look like by stage?

The quartile distribution shows what it takes to stand out at each stage, and what’s “normal.” At Seed, the median round was $5.7M—but the top 1% raised $51M, nearly 9x the median. The spread widens dramatically at later stages:

These distributions matter for benchmarking. If you're raising a $25M Series A, you're at the top quartile, but not the “top-top.” A $100M Series B puts you in the top 5%. Understanding where you sit in the distribution helps founders and investors calibrate expectations.

What were the largest cybersecurity funding rounds in 2025?

In 2025, cybersecurity companies raised 48 transactions of $100 million or more, up from 40 in 2024 and 28 in 2023. Of these, 20 companies raised $200 million or more, and 9 raised over $500 million.

The top 10 cybersecurity funding rounds from 2025 combined for a total of $10.0 billion in funding:

1. Check Point Software Technologies, a United States-based suite of network and email security tools, raised a $1.75B in Post-IPO Debt. (more)

2. Akamai Technologies, a United States-based secure networking and website security platform, raised a $1.5B in Post-IPO Debt. (more)

3. Zscaler, a United States-based suite of secure networking tools, raised a $1.5B in Post-IPO Debt. (more)

4. KnowBe4, a United States-based security awareness and simulated phishing training platform, raised $1.46B in Debt Financing from JPMorgan Chase and KKR. (more)

5. CyberArk Software, a United States-based suite of identity security and privileged access management (PAM) tools, raised $1.1B in Post-IPO Debt. (more)

6. Saviynt, a United States-based intelligent identity and access governance solution, raised a $700M Series B from KKR. (more)

7. Cyera, an Israel-based cloud-native data security platform, raised a $540M Series E from Georgian, Greenoaks, and Lightspeed. (more)

8. ReliaQuest, a United States-based SOC-as-a-Service company, raised a $500M Private Equity round from EQT, FTV Capital, and KKR. (more)

9. NinjaOne, a United States-based endpoint management and protection platform, raised a $500M Series C from CapitalG and ICONIQ Growth. (more)

10. Armis, a United States-based agentless IoT security platform, raised a $435M Venture Round from Goldman Sachs Growth Equity. (more)

The top 5 funding events in 2025 were all debt rounds by publicly traded cybersecurity companies. This marked a significant shift from previous years and signaled that even the largest cybersecurity players needed capital to make AI initiatives a reality and to fund future acquisitions.

These numbers show a return closer to the ZIRP-era highs of 2021-2022, when nearly 60 transactions exceeded $100 million.

See a bigger version of this chart here

When we look at the top 10 categories this year, and compare them to previous years, we can see a really interesting shift in what is perceived as valuable. Funding itself does not guarantee customer traction, of course, but all funding is a form of a bet. Founders and investors are constantly making bets about what the industry will care about, based on the past, the changing threat landscape, and developments in the broader tech world. It’s essentially a slow-moving prediction market that we may not see materialize for years to come.

When we look closer at these top 10 categories and how they’ve changed over the last few years:

Looking at the table, here are just a few things that the market cared about:

1. Security Foundations Dominated - The top three categories of Secure Networking, Network Security, and Security Awareness are all foundational security plays. If we take this at face value, however, we’ll miss the bigger message. These top categories were all from public cybersecurity companies that are recapitalizing and expanding their offerings and acquisition appetites. This is a Trojan horse for what comes next.

2. Identity Had the Real Moment - This is likely no surprise, as 2025 saw the further explosion of AI and Agentic AI applications. Privileged Access Management (PAM), Non-Human Identity (NHI), and all forms of Agent Identity became priority number one. The CyberArk/Palo Alto $25B acquisition was the biggest nod to this effect, but was but one of many such cases.

3. Data Security for AI Data - As AI workloads ran amok and data sprawled across every cloud imaginable, enterprises realized they had no idea where their sensitive data actually lived. Knowing your company’s data footprint went from a nice little compliance checkbox to a prerequisite for doing anything with AI.

4. AI Drove the Fraud Rebound - Fraud and financial crime protection rebounded after a soft 2024, driven by AI-generated deepfakes and synthetic identity attacks. The threat landscape expanded, and the market followed.

2025 wasn't about new breakout categories, and it wasn’t purely about “Security for AI.” It was about capital flowing back to the proven winners in foundational security and the “boring” stuff. We say “boring” tongue-in-cheek here because, despite all the tech advances, the industry still faces the same challenges. New tech, same problems. 

People say, “History doesn’t repeat itself,” but in the cyber industry, it really does.

What was the funding stage distribution?

From a volume standpoint, there were some significant changes in 2025 compared to previous years.

Early-stage funding volume rebounded significantly in 2025. After falling from 464 deals in 2022 to just 339 in 2024 (a 27% drop), early-stage funding rebounded to 408 deals in 2025. The AI wave drove this increase in part by making it easier to build new ideas, and by investors making more early-stage bets in a rapidly shifting market. Founders are getting funded again, just more selectively.

Growth-stage deals barely budged from 212 (2024) to 219 (2025). This stallout is the "graduation problem" in action. In the cybersecurity industry, you either get acquired at the Series A/B stage or go for broke and raise a lot more funding to try to become the next Wiz. This cohort is always in the most challenging situation. They are often too small to go against the largest companies, but are old enough to get outcompeted by an early-stage company if they are not careful. This is the second make-or-break phase in a company’s lifespan.

The late-stage market neither expanded nor contracted. Capital went to proven winners rather than speculative bets. Public companies had a field day in 2025 and were tapping debt markets for acquisition war chests.

When it came to funding, 2025 showed a market healing from the bottom up.

Who acquired cybersecurity companies in 2025?

TL;DR: M&A activity surged with 320 deals worth $76.4 billion in disclosed value, up 16% in deals and 66% in dollars from 2024. The 26 mega-deals ($100M+) captured virtually all disclosed value. Average disclosed deal size jumped 82% from $1.36B to $2.47B. Disclosure rates dropped to 9.7% as more PE and strategic deals happened quietly.

2025 was the year that acquisitions ripped again in the cybersecurity industry.

And it wasn't just one cyber company buying another, nor was it just cyber companies being taken private by a PE firm (although there was plenty of that). No, 2025 was the year the industry started to expand and branch out into other domains.

Highlights:

• 320 acquisitions with $76.4 billion in disclosed value. up 16% in deals and 66% in dollars from 2024

• 26 mega-deals ($100M+) captured virtually all disclosed value

• Average disclosed deal size jumped 82% from $1.36B to $2.47B

• Disclosure rates dropped to 9.7%, down from 12.3% in 2024, a sign of more PE and strategic deals happening quietly

We saw cyber companies buying IT and Observability companies. We saw IT companies buying cyber companies, either to expand their growing cyber businesses or to enter the market. We saw manufacturing and electronics companies buying cyber companies.

Here are a few of the "non-standard" acquisitions that happened in 2025 (which also happen to be some of the largest):

• ServiceNow acquired Armis, an IoT security company, for $7.8 billion.

• Palo Alto Networks acquired Chronosphere, an observability company, for $3.4 billion.

• ServiceNow acquired Veza, an identity security and governance company, for a reported $1 billion+.

• Mitsubishi Electric acquired Nozomi Networks, an IoT security company, for $1 billion.

There are horizontal and vertical expansions happening at more and more turns, and the cyber industry is permeating more and more parts of life.

How did 2025 compare to previous years?

The pattern mirrors funding: deal volume increased modestly (+16%), but dollars surged (+66%) as average deal size nearly doubled. Mega-deals drove the growth, with Google's $32B Wiz acquisition alone accounting for 42% of all disclosed value.

Where were companies acquired?

The US dominated both volume (55%) and value (98.6% of disclosed dollars). This reflects the reality that the largest cybersecurity companies are overwhelmingly American. Sometimes that's through Israeli companies that move to the US, so it’s not always clear-cut.

Who were the top acquirers?

Palo Alto Networks continued its aggressive platform expansion, making three acquisitions totaling $28.4 billion. ServiceNow emerged as a surprising consolidator, making two billion-dollar security acquisitions after years of organic investment.

What were the largest cybersecurity acquisitions in 2025?

In 2025, 26 acquisitions exceeded $100 million, up from 21 in 2024. The top 10 combined for $73.0 billion, 96% of all disclosed M&A value:

1. Wiz, a United States-based Cloud Security Platform, was acquired by Google for $32.0B. Wiz had previously raised $2.0B in funding. (more)

2. CyberArk Software, a United States-based suite of identity security and privileged access management (PAM) tools, was acquired by Palo Alto Networks for $25.0B. CyberArk Software had previously raised $1.7B in funding. (more)

3. Armis, a United States-based agentless IoT security platform, was acquired by ServiceNow for $7.8B. Armis had previously raised $1.2B in funding. (more)

4. Chronosphere, a United States-based observability platform for microservices and containers, was acquired by Palo Alto Networks for $3.4B. (more)

5. Securiti, a United States-based multi-cloud data protection and privacy company, was acquired by Veeam Software for $1.7B. Securiti had previously raised $156M in funding. (more)

6. Nozomi Networks, a United States-based operational technology (OT) security platform for industrial control systems (ICS), was acquired by Mitsubishi Electric for $1.0B. Nozomi Networks had previously raised $266M in funding. (more)

7. NetBrain Technologies, a United States-based network security and IT asset visibility platform, was acquired by Blackstone Group for $750.0M. (more)

8. Red Canary, a United States-based managed detection and response (MDR) platform, was acquired by Zscaler for $675.0M. Red Canary had previously raised $130M in funding. (more)

9. MarkMonitor, a United States-based brand fraud and abuse monitoring platform, was acquired by Com Laude for $450.0M. MarkMonitor had previously raised $45M in funding. (more)

10. Findings, a United States-based automated third-party risk assessment platform, was acquired by Diginex for $305.0M. (more)

The Biggest Deal Ever: Google Buys Wiz for $32 Billion

Google's acquisition of Wiz wasn't just the largest cybersecurity deal of 2025, and the largest in industry history.

The $32 billion price tag for a company that raised $2 billion in venture funding represents a 16x multiple on capital raised. More importantly, it signals that the hyperscalers are done building security in-house. Google tried. They launched Chronicle, acquired Mandiant for $5.4 billion in 2022, and invested heavily in their own cloud security tools. None of it worked the way Wiz did.

Wiz built what Google (or any of the hyperscalers) couldn't: a holistic cloud security platform that enterprises actually adopted. The deal closed the chapter on whether cloud providers would own security or buy it. They're buying it.

This acquisition alone accounted for 42% of all disclosed M&A value in 2025. Google's acquisition of Wiz wasn't an isolated move, either. It was part of a larger pattern that defined 2025 and saw boundaries blurring.

The Great Bundling

These cross-industry acquisitions are signaling that the boundaries between cyber, IT, and OT are dissolving.

We also saw this at the product level. In 2025, we saw some of the largest public cybersecurity companies, like CrowdStrike ($CRWD ( ▲ 0.51% ) ), push heavily into IT management and infrastructure. Moving upstream to capture not just the CISO budget, but also the CIO and CTO budgets. As these roles are converging in some organizations, it makes sense for companies to punch above their weight to grab a bigger piece of a bigger pie.

What this means is that everyone just got a whole lot more stakeholders to sort through.

These companies from outside of cyber entering this world through acquisition or product expansion will have many contacts and potential buyers that security companies may not already have. It means the art of the enterprise sell will carry more gravity if there's a natural extension play into IT, OT, and security adjacencies.

We call this The Great Bundling era, and it's just getting started.

Was AI Security the biggest trend in cybersecurity in 2025?

TL;DR: No. Despite the hype, AI Security captured just 2.6% of cybersecurity funding in 2025—not even in the top ten categories. The real story is AI being absorbed into every existing security category, not emerging as a standalone market. Identity and Access Management alone raised 4x more than all AI Security combined.

On AI & Security

"AI Security" was supposed to be the story of 2025. Every market report, every investor thesis, every vendor pitch deck predicted it would dominate. The data, however, tells a different story. AI Security captured just 2.6% of cybersecurity funding in 2025. 

Even with 75% year-over-year growth, from $377 million in 2024 to $661 million in 2025, AI Security remains a rounding error in the broader market. Despite expectations and claims from many outlets and firms that "AI Security" was the most active financing category in the cybersecurity industry in 2025, the numbers just don't add up.

Not only was the broader umbrella category for "AI Security," which includes "AI for Security" and "Security for AI," not the top category, but it wasn't even in the top ten for the year. For perspective, Identity and Access Management alone pulled in $2.75 billion in 2025, more than four times the entire AI Security category. The "boring" stuff keeps winning.

Despite the headlines, it was one of the least-funded areas in all of cyber in 2025.

The deal sizes tell the story, too. AI Security averaged $11 million per round in 2025, up from $7-8 million in prior years, but still no breakthrough mega rounds. The category is growing, but it's not scaling as an independent category that will stand on its own and command security team budgets the way that cloud security, email security, and endpoint detection and response have.

Somewhere out there, in the vast nothingness of space, an investor sheds a single tear.

AI, as it relates to the cybersecurity industry, is being adopted as a foundational technology. Is something really a differentiator when everyone is using it?

When you zoom in and look at the details, almost every cyber company has an AI story. They have to; there's no avoiding it, given customer and investor pressures alike. Every cyber company was adding AI in 2023 and 2024, because it looked as if "AI Security" would become a standalone category that would garner a lot of budget. As AI itself has matured and the capabilities of what is possible have grown, that once-perceived differentiation has started to disappear.

"AI Security" is being absorbed and integrated into every existing category at roughly the same rate AI is being adopted into business operations. This isn't a bad thing. We're lucky to live in a time when we can see the evolution of technology in industry.

The same thing happened with the cloud from 2010 to 2020, but AI innovation has compressed the timeline. By 2015, every product added "cloud" to its positioning. By 2020, many had quietly dropped it because the cloud had become the default way of doing business.

AI is following the exact same path, just much faster.

What are the geopolitical stakes of AI security?

Beyond the funding data, there's a larger geopolitical reality shaping AI security's future. The AI security question is forcing nations into an uncomfortable choice between America's open but increasingly isolationist tech ecosystem and China's closed civil-military fusion model. Neither path is clean.

As I wrote in Understanding the AI Arms Race, the winner won't be determined by who builds the most powerful models. Instead, it will come down to who earns the world's trust to secure it. That trust is still up for grabs, and security is what will ultimately tip the scales.

How should we categorize AI Security?

In 2026, we're being more judicious about the "AI Security" product category and label. Most companies aren't securing AI, they're using AI to accelerate existing security workflows. In our view, there's a meaningful distinction between "Security for AI" (protecting models and AI applications) and "AI for Security" (using AI to improve traditional security operations). 95%+ of companies in this domain are in the AI for Security bucket.

If you're reading reports that claim Security for AI was the breakout theme and dominant category in 2025, dig into how that's being defined. When every website and pitch deck with "AI" gets lumped together, the numbers can say whatever you want them to say. Methodology matters here, but the incentives behind those methodologies matter even more.

Where did cybersecurity capital flow geographically in 2025?

TL;DR: US-to-US funding dominated, jumping 125% from $5.9B to $13.3B (2023 to 2025). European investors dramatically shifted homeward (+209% intra-Europe growth), while cross-Atlantic flows stayed relatively flat. The data suggests regional tech ecosystems are strengthening rather than globalizing.

After the market correction of 2022-2023, 2025 delivered the answer we've been waiting for. The United States recovered and surpassed its previous peak. The trajectory from $10.7B in 2023 to $11.1B in 2024 to $18.5B in 2025 represents a 66% year-over-year increase and signals that the correction period is firmly over.

In short: yes, we are very much back.

Highlights:

• US funding hit $18.5B, 30% higher than the total global funding raised in 2024, surpassing the 2022 peak of $16.3B

• Israel's remarkable recovery: $2.5B in 2025, up from $842M in 2024 (+200% YoY), setting a new all-time high

• Europe continued climbing: $1.33B in 2025, up 81% from $734M in 2024

• Deal concentration intensified: US average deal size jumped 87% from $29M to $54M

• US + Israel absorbed 91% of global cybersecurity funding across 68% of deals

How did each region perform?

The ranking chart above clearly tells the concentration story. A few observations:

• The United States held the #1 position at every single stage, commanding 58-91% of capital depending on round type. This is where later-stage capital density becomes the ultimate moat.

• Israel tells a Series A and B story. Ranking #2 at Series A ($607M, 23%) and Series B ($933M, 31%), Israel captured nearly a third of all global Series B capital. But the early stage and late stage remain thin on publicly available data. This is consistent with the Israeli model of building companies for rapid scale and exit in the US rather than long-term local growth.

• Europe showed remarkable consistency, ranking 2nd or 3rd at every stage from Series A through Growth. Most notably, Europe overtook Israel in both Series C and Growth Stage rounds. Europe's ecosystem sustains companies through later stages, even if it doesn't produce the same concentration of mega-rounds.

• The United Kingdom raised $580M across 52 deals (+41% YoY), with an average deal size of $11.2M. The UK is a pipeline story with strong early-stage activity, consistent 4th-5th ranking through Series A, but companies often look to the US for growth capital. Post-Brexit independence cuts both ways, and UK founders face harder choices about where to scale.

• Asia saw the year's most significant reversal, dropping from meaningful 2024 activity to a 64% decline. Asia still has a forming but fractured cybersecurity ecosystem, and many companies start there and end up moving to the United States.

• Emerging markets (the Middle East, Latin America, and Africa) remain far behind. The scale of the disconnect from the top regions is huge and widening.

Did "America First" policies change funding patterns?

How did new isolationist policies and the rise of American Dynamism shift where money went and where startups were formed?

Looking at the data, the answers are nuanced, but clear theme.

The US kept its capital home in 2025. US on US funding grew 56% over three years, from $8.2B to $12.8B, and US investors remain kingmakers at the growth stage, with larger follow-on capital and global scaling playbooks. The cross-Atlantic deployment to Europe remained steady but flat. Most notably, US investors showed almost no appetite for UK deals, dropping from $170M to $140M.

Europe deployed more at home (+68% from 2023 to 2025), while almost entirely pulling back from the UK. Europe's funding to the UK collapsed from $43M to just $9M. European investors still write checks to US companies, but the trend is clearly homeward. Movements like EU Inc. will only make this more appealing and easier to do, and we expect this to not only concentrate things in Europe but also broaden it.

The UK tells the most interesting story. While UK startup formation is growing and getting stronger, the figures are still very low. UK on UK funding stayed flat at ~$60M annually, meaning UK investors aren't deploying domestically at scale. Instead, UK capital is still leaving home. UK Investments in the US quadrupled from $200M to $800M, and UK investments in Europe grew 5x from $63M to $300M.

UK founders are building companies, but UK investors are still funding everyone else's ecosystems. There are a number of growing exceptions to this rule in the UK, but founders there will ultimately look to the US and Europe for growth capital, and may move there too.

The US and Europe are building self-sufficient cybersecurity economies, and regional tech ecosystems are strengthening rather than globalizing.

Public Markets and The RoS Cyber Index

TL;DR: Pure-play cybersecurity stocks underperformed the broader market in 2025. The RoS Cyber Index returned -6.5%, trailing the S&P 500. The largest platform winners (CrowdStrike, Zscaler) thrived while point products struggled. Both 2025 IPOs, SailPoint and Netskope, are underwater.

The RoS Cyber Index

To track the health of public cybersecurity markets, we created the RoS Cyber Index, an equal-weighted index of 14 pure-play cybersecurity companies. "Pure-play" means 80%+ of revenue comes from security products and services. This filters out tech giants with security divisions (Microsoft, Google, Amazon) whose stock movements reflect broader enterprise trends rather than security-specific dynamics.

The 14 companies (at the time of writing this): Palo Alto Networks, CrowdStrike, Fortinet, Zscaler, Check Point, CyberArk, Okta, SailPoint, Netskope, Qualys, SentinelOne, Varonis, Tenable, and Rapid7.

If you read the newsletter, you’ll recognize this index from the public markets update section, giving a snapshot of the past week’s performance.

As of markets close on February 2, 2026

Why equal-weighted? Market-cap weighting would let CrowdStrike and Palo Alto dominate the index, but there’s a lot more to cyber than that. Equal weighting gives a clearer picture of how the average public cyber company performed, and in 2025, that picture wasn't pretty.

2025 Index Performance

Only 5 of 14 pure-play cyber stocks finished the year in the green.

We also track cyber-adjacent companies in the infrastructure, cloud, and data recovery names where security is a growing revenue driver. These stocks often signal where the market is headed before pure-play cyber catches up.

A Defining Moment: Palo Alto Buys CyberArk

One of the biggest stories in public cyber wasn't earnings or product launches; it was Palo Alto Networks' $25 billion acquisition of CyberArk in July.

This wasn't just consolidation. It was the market's largest bet on agentic identity.

As AI agents proliferate across enterprises, the question of "who gets access to what" becomes exponentially more complex. CyberArk's privileged access management (PAM) capabilities, historically focused on human administrators, become critical infrastructure for managing machine identities, service accounts, and autonomous agents. Palo Alto paid a ~26% premium to own that position.

The deal hasn't closed yet, but this transaction signals where the platform giants think value is consolidating. Whoever controls agent identity controls the AI security stack.

The Class of 2025: Two IPOs, Two Disappointments

Both 2025 IPOs came from companies returning to public markets after previous PE take-privates. Neither took off very well, but that story has been repeating itself in the broader tech market as well. 

SailPoint's identity governance story didn't resonate the way CyberArk's PAM story did. Netskope's SSE platform faces margin pressure from CrowdStrike and Zscaler, bundling similar capabilities into broader platforms.

How did our 2025 predictions hold up?

TL;DR: We got 6.5 out of 9 predictions right (depending on how you score PE vs. strategics). We missed on AI-enabled cyber valuations, the talent market, and the PE vs. strategics call was a coin flip.

Last year, we made these predictions, and here is how we fared:

• ✅ M&A Acceleration — Deal volume jumped 20% to 743 transactions, led by Google's $32B Wiz acquisition

• ✅ AI-native Early-Stage Boom — AI security seed rounds doubled

• ✅ Geographic Concentration — US-to-US funding grew 33%; cross-border stayed flat

• ✅ At Least One IPO — SailPoint relisted in March, and Netskope went public

• ✅ Insurance-Driven Purchasing — Compliance requirements became the top mid-market driver

• ✅ Crypto/Web3 Resurgence — The Trump administration reignited the market (and the pump and dump that followed).

• ⚖️ PE was the Dominant Exit — Split decision. PE roll-ups drove 47% of deals by volume (152 services deals). But strategics took the mega-exits with Wiz, CyberArk, and Armis. PE won the middle market, but strategics won the headlines.

• ❌ Talent Market Normalization — Layoffs at cyber companies increased 31% in 2025

• ❌ AI Valuation Stabilization — Wrong. Valuations accelerated.

Closing and what we predict for 2026

2025 was a year of consolidation and concentration. 2026 will be a year of reckoning for public market expectations, for point product companies, and for the globalization thesis. The money is still flowing. The question is where it lands.

Here's what we expect to see happen in 2026 and beyond:

• Application Security Dissolves Down the Stack — With AI driving most code generation, application security must be integrated at the infrastructure, endpoint, and network layers rather than remaining a standalone category. AppSec funding declined 21% (3-year CAGR), not because it doesn't matter, but because it's being absorbed into platforms and runtime environments. Expect the "AppSec" category to start fading and morphing by 2027.

• Government and Defense Investment Increases — Isolationist policies are driving regional growth and self-sustainment across the US, Europe, and allied nations. In-Q-Tel (IQT) was already a top-20 investor by deal count in 2025. Expect defense-adjacent cyber companies and cleared vendors to see disproportionate funding as governments prioritize sovereign capability over global supply chains.

• The Services Economy Overtakes Product Innovation — 47% of 2025 M&A deals were services companies, MSPs, MSSPs, and consultancies being rolled up by PE. The market is shifting from "buy tools" to "buy outcomes," and the largest cybersecurity exits in 2026 will be PE-backed services platforms, not product companies. Product innovation will increasingly happen inside service businesses, not standalone vendors.

• A Non-US Region Has a Breakout Year — Israel posted +197% funding growth in 2025, despite geopolitical headlines, the Gulf states and ANZ grew +200%+ from small bases. In 2026, at least one non-US market will post triple-digit growth and begin competing for growth-stage capital, not just seed capital.

• The Cyber IPO Window Closes Again — SailPoint was down ~18% since its re-IPO. Netskope is down ~29% since its listing. Public cyber companies across the board underperformed the S&P500 and other global indices. Despite the narrative that the window finally opened, public markets punished both new cyber entrants. The same held true for general tech IPOs. Expect no new pure-play cyber IPOs in 2026, and PE and strategic M&A remain the only viable exits.

If you're a buyer, expect more vendors, shorter contracts, and faster cycles. AI has made POCs trivial, and switching costs are collapsing. If you're a founder, expect to pick a lane faster than you anticipate. Either get acquired early or swing for a platform play. If you're an investor, expect regional concentration and government money to reshape deal flow. The market is consolidating faster than the narratives can keep up.

If you made it this far, we can't thank you enough. If you enjoyed it, please consider sharing it with your network. This is the fourth year we've put together the Return on Security annual report, and honestly, the community that's grown around it is the reason we keep doing it.

We welcome your thoughts, questions, and feedback as we continue to monitor the constantly evolving cybersecurity landscape together.

Until 2027!

About This Report

Return on Security is an independent research firm tracking cybersecurity funding, M&A, and market trends. Founded by Mike Privette, a cybersecurity economist with 18 years of experience, from security engineer to CISO.

This is the fourth annual State of the Cybersecurity Market report. Data comes from our proprietary database:

• All data captured point-in-time from publicly available sources

• Financial figures converted to USD at current exchange rates

• We track grants, debt, and post-IPO events—not just venture capital

• We track service businesses (MSSPs, MDR, consultancies)

• We exclude fraud platforms, defense-only companies, and unverified transactions

Spot an error? Let us know.

We made it, folks, we finally defeated January!

And just in time, too, because it’s time to brace yourselves. 2026 RSA Conference party invites are on the way. Speaking of, I’m cohosting another one this year and would love to hang out with you there. Sign up here!

Also, the Q4 2025 Cyber Earnings Season starts this week, so be on the lookout for this week to see just how the major players closed out their years.

💡 _{Share the newsletter in one click}

😎 Vibe Check

Click the options below to vote on whether you are a practitioner, founder, or investor. Feel free to leave a comment, and I'll feature the best takes in next week’s write-up!

Last issue’s vibe check:
How much do you actually care if a security product is using AI vs. not?
⬜️⬜️⬜️⬜️⬜️⬜️ It's a key factor
🟩🟩🟩🟩🟩🟩 Only if it's actually better
🟨🟨🟨🟨⬜️⬜️ I don't care, just show me it works
🟨🟨🟨⬜️⬜️⬜️ AI claims make me more suspicious

Last week’s poll showed that most people really only care about AI if it’s actually better than the current way they’re doing things, or so long that it works. There was also a healthy bit of skepticism about AI claims in general, which is no surprise given how fast things are moving in this space (see today’s vibe check).

What matters now is integrating into the AI-driven ways of working, not the other way around. If it fits without breaking the way practitioners want to work now, and without causing them to open more browser tabs, the better off things will be accepted.

Some of the top comments from last week’s vibe check:

💬 “Too many vendors are just slapping 'This product has so much AI in it ‘ and not enough actual value proposition.”

💬 “Software vendors - just prove the capabilities, I don’t care about the underlying tech as long as it fits in my environment.”

💬 “It’s much more of a data issue - are you creating/collecting/using proprietary data or are you enriching/processing differently to power your AI?”

💰 Market Summary

Private Markets

• 11 companies from 5 countries raised $403.8M across 10 unique product categories

• Average deal size was $44.9M (median: $10.0M)

• 100% of funding went to product companies

• 3 companies from 3 countries were acquired for $37.5M across 3 unique product categories

• 100% of M&A activity went to product companies

Public Markets

• No public cyber companies had an earnings report in the first few weeks of 2026

• Much of the tech-heavy US markets shed much of their gains as the U.S. Dollar weakened, and as a new successor to the U.S. Fed Chair was named by President Trump

As of markets close on January 26, 2026.

📸 YoY Snapshot

And with last week, 2026 has already racked up over $1 billion in cybersecurity funding. Just a cool five weeks to get there. 😳

M&A had a slightly quieter week, but is still moving with strong momentum for the year.

🔭 Zooming Out 🆕 

Stories hidden in the numbers

• Agent Defense: We’re now starting to see specific security measures for AI Agents emerge. Given all the hype and chaos around Openclaw over the last two weeks, solutions for this can’t come soon enough.

• European Compliance Play: Germany's heyData ($16.5M) shows EU-based compliance automation is finding funding. GDPR may be old news, but the compliance software market is still being built.

• Serial Acquirer: LevelBlue is on a cyber buying spree to consolidate one of the biggest services firms out there. This week's acquisition is their 4th in the past 12 months.

🧩 Funding By Product Category

• $250.0M for Cloud Native Application Protection Platform (CNAPP) across 1 deal

• $79.9M for Application Security across 2 deals

• $40.0M for Identity Threat Detection and Response (ITDR) across 1 deal

• $37.0M for Brand Protection across 1 deal

• $16.5M for Security and Compliance Automation across 1 deal

• $12.0M for Attack Surface Management (ASM) across 1 deal

• $5.0M for Internet Security across 1 deal

• $2.3M for Threat and Risk Prioritization across 1 deal

• $1.6M for AI Security across 1 deal

• $400.0K for Threat Intelligence across 1 deal

• An undisclosed amount for Security Log Data Management (SLDM) across 1 deal

🏢 Funding By Company

Product Companies:

• Upwind Security, an Israel-based cloud native application protection platform, raised a $250.0M Series B from Bessemer Venture Partners. (more)

• Chaitin Tech, a China-based web application security platform, raised a $71.9M Venture Round from Beijing Artificial Intelligence Industry Investment Fund, Guofang Innovation, and National Artificial Intelligence Industry Investment Fund. (more)

• Outtake, a United States-based agentic AI security platform focused on defending against identity-based attacks and phishing, raised a $40.0M Series B from ICONIQ Capital. (more)

• Memcyco, an Israel-based brand impersonation monitoring and account takeover prevention platform, raised a $37.0M Series A from NAventures. (more)

• heyData, a Germany-based security and compliance automation platform focused on vendor risk management and data privacy, raised a $16.5M Series A from Riverside Acceleration Capital. (more)

• Mesh Security, an Israel-based cybersecurity platform that provides advanced protection and threat detection capabilities, raised a $12.0M Series A from Lobby Capital. (more)

• Rein Security, an Israel-based runtime application security monitoring platform, raised a $8.0M Seed from Glilot Capital Partners. (more)

• Monarx, a United States-based threat detection and prevention platform for web hosting providers, raised a $5.0M Venture Round. SEC Filing

• Aisy.ai, a United Kingdom-based offensive security-focused threat and risk prioritization platform, raised a $2.3M Seed from Flying Fish Partners, Osney Capital, and 6 Degrees Capital. (more)

• Pallma AI, a United Kingdom-based vulnerability discovery and AI agent runtime guardrails, raised a $1.6M Pre-Seed from Marathon Venture Capital. (more)

• The Security Bulldog, a United States-based cyber threat intelligence platform, raised a $400.0K Pre-Seed from Right Side Capital Management. (more)

• Enterprise Srl, an Italy-based security log data management platform, raised an undisclosed Series A.

Service Companies:

• None

🌎 Funding By Country

• $307.0M for Israel across 4 deals

• $71.9M for China across 1 deal

• $45.4M for the United States across 3 deals

• $16.5M for Germany across 1 deal

• $3.9M for the United Kingdom across 2 deals

• An undisclosed amount for Italy across 1 deal

🤝 Mergers & Acquisitions

Product Companies:

• Pynt, an Israel-based dynamic API security testing platform, was acquired by Radware for an undisclosed amount. Pynt had previously raised $6.0M in funding. (more)

Service Companies:

• Alert Logic, a United States-based managed security operations center (MSOC) platform, was acquired by LevelBlue for an undisclosed amount. Alert Logic had previously raised $399.9M in funding. (more)

• REAL security, a Slovenia-based professional services firm focused on data protection and risk management, was acquired by Westcon-Comstor for an undisclosed amount. REAL security has not previously disclosed any funding events. (more)

• Threatscape, an Ireland-based managed security services provider, was acquired by Horizon Capital for an undisclosed amount. Threatscape has not previously disclosed any funding events. (more)

☎️ Earnings Reports

📚 Great Reads

🧪 Labs

Welcome to the 72nd week of January, everybody! 😵‍💫 

I’ll keep this week’s opener short, as I’ve been heads down working on the annual State of the Cybersecurity Industry report. I plan to release it later this week, so stay tuned.

Also, I’ve added a new section I’m testing out called “Zooming Out,” and would love any feedback you have!

💡 _{Share the newsletter in one click}

😎 Vibe Check

Click the options below to vote on whether you are a practitioner, founder, or investor. Feel free to leave a comment, and I'll feature the best takes in next week’s write-up!

Last issue’s vibe check:
What security problem is criminally underfunded?
🟨🟨🟨🟨⬜️⬜️ Open-source security
🟨🟨🟨⬜️⬜️⬜️ SMB security
🟩🟩🟩🟩🟩🟩 OT/ICS/critical infrastructure
🟨⬜️⬜️⬜️⬜️⬜️ Security workforce/education

“In today’s modern, connected, and digital world, it’s more important than ever to…”

Nah, I’m just kidding, nobody wants to read stuff written like that. I’ve got to agree with the vibe check results from last week here. A lot of us who don’t live in the OT world really take for granted things like “power” and “running water,” and how they just work, but it’s shocking to see how fragile they could be.

Some of the top comments from last week’s vibe check:

💬  Our cameras, cars, TV, fridge, and washing machine can all disclose protected information about us, and there is nothing being done about it.

💬 Open source often is critical infrastructure. I wish it were so easy

💰 Market Summary

Private Markets

• 11 companies from 5 countries raised $403.8M across 10 unique product categories

• Average deal size was $44.9M (median: $10.0M)

• 100% of funding went to product companies

• 3 companies from 3 countries were acquired for $37.5M across 3 unique product categories

• 100% of M&A activity went to product companies

Public Markets

• No public cyber companies had an earnings report in the first few weeks of 2026

As of markets close on January 23, 2026.

📸 YoY Snapshot

Funding continues this year at a breakneck pace compared to this time last year.

M&A is also still ripping along compared to this same time last year.

🔭 Zooming Out 🆕 

Stories hidden in the numbers

• Category Momentum: Operational Technology (OT) Security is having a breakout moment amid fears over critical infrastructure security. Companies in this category have raised $200.0M this week across 2 deals, or 12x the 13-week weekly average. The “criminally underfunded” segment gets some love.

• Raised from the Dead: RSA Security (yes, that one) is giving itself quite the makeover with its first publicly-noted funding round in many years (decades?). AI just might be able to bring even the oldest companies back to life.

•  AppSec Remediation Competition: The AppSec market is fragmenting into "fix vulnerabilities" vs. "prevent vulnerabilities" camps. Expect consolidation pressure on one of these models within the next 12 months.

• Leading the Charge: Ten Eleven Ventures continues its streak as one of the most active early-stage cyber investors. They've now led or participated in 4 of the last 13 weeks' seed rounds.

☎️ Earnings Reports

🧩 Funding By Product Category

• $200.0M for Operational Technology (OT) Security across 2 deals

• $135.0M for Identity and Access Management (IAM) across 1 deal

• $23.5M for Cyber Insurance across 1 deal

• $14.1M for Application Security across 2 deals

• $10.0M for Secure Remote Access across 1 deal

• $10.0M for Threat and Risk Prioritization across 1 deal

• $7.0M for Security Orchestration and Automated Response (SOAR) across 1 deal

• $4.2M for Digital Forensics and Incident Response (DFIR) across 1 deal

• An undisclosed amount for AI Privacy Assurance across 1 deal

• An undisclosed amount for Cybersecurity Education & Training across 1 deal

🏢 Funding By Company

Product Companies:

• Claroty, a United States-based secure industrial, IoT, and healthcare network security platform, raised a $150.0M Series F from Golub Growth and raised $50.0M in secondary market financing. [more]

• RSA Security, a United States-based suite of secure authentication and identity management tools, raised a $135.0M Debt Financing. [more]

• Stoïk, a France-based cyber risk insurance company, raised a $23.5M Series C from Impala and Opera Tech Ventures. [more]

• furl, a United States-based automated security and vulnerability remediation platform, raised a $10.0M Seed from Ten Eleven Ventures. [more]

• Symbiotic Security, a United States-based application vulnerability and remediation platform, raised a $10.0M Seed from Alven. [more]

• Zeroport, an Israel-based hardware-based secure remote access platform, raised a $10.0M Seed from lool ventures. [more]

• AiStrike, a United States-based AI-assisted security automation platform, raised a $7.0M Seed from Blumberg Capital. [more]

• Asymmetric Security, a United States-based AI-enabled digital forensics and incident response firm, raised a $4.2M Pre-Seed from Susa Ventures. [more]

• Dam Secure, an Australia-based IDE-integrated application security guardrails platform, raised a $4.1M Seed from Paladin Capital Group. [more]

• CyberNut, a United States-based cybersecurity education and training platform for K-12 school audiences, raised an undisclosed amount of private equity from Growth Street Partners. [more]

• Nenna AI, a Germany-based platform that helps prevent data privacy issues with AI applications, raised an undisclosed seed round from dfv Mediengruppe and IBB Ventures. [more]

Service Companies:

• None

🌎 Funding By Country

• $366.2M for the United States across 8 deals

• $23.5M for France across 1 deal

• $10.0M for Israel across 1 deal

• $4.1M for Australia across 1 deal

• An undisclosed amount for Germany across 1 deal

🤝 Mergers & Acquisitions

Product Companies:

• StandardFusion, a Canada-based governance, risk, and compliance management platform, was acquired by Wolters Kluwer for $37.4M. StandardFusion has not previously disclosed any funding events. [more]

• AI Sonar, an Ireland-based AI application discovery and governance platform, was acquired by LatticeFlow for an undisclosed amount. AI Sonar has not previously disclosed any funding events. [more]

• QTrino, an India-based quantum cryptography cyber risk readiness and hardware security modules, was acquired by Satin Creditcare Network for an undisclosed amount. QTrino has not previously disclosed any funding events. [more]

Service Companies:

• None

📚 Great Reads

🧪 Labs

Babe, wake up, a new cybersecurity acronym just dropped!

As if the acquisition spree of identity companies from two weeks ago didn’t convince you that AI Agent identity is everything right now, there were even more acquisitions to that tune last week.

AI model companies are rapidly launching AI Agentification of Work across messaging platforms, AI-driven browsers, and even in the places where real work happens (Excel). And as exciting as that is, the public cyber heavyweights are launching their own assault on capability acquisition.

But it’s not just the big dogs making moves. AI acquisition moves are being made across the maturity spectrum, as there is still much to sort out in the arena.

💡 _{Share the newsletter in one click}

😎 Vibe Check

Click the options below to vote on whether you are a practitioner, founder, or investor. Feel free to leave a comment, and I'll feature the best takes in next week’s write-up!

Last issue’s vibe check:
Is AI finally solving the problem of tool integration in cyber?
🟨🟨⬜️⬜️⬜️⬜️ Yes, AI is bridging what other platforms couldn't
🟨🟨🟨🟨⬜️⬜️ It helps, but the mess underneath remains
🟩🟩🟩🟩🟩🟩 No, it's just another layer that doesn't integrate
🟨🟨🟨⬜️⬜️⬜️ Too early, ask me in 2027

Well, there you have it, folks. Sadly, it seems AI has not yet solved all of security’s tool-integration challenges. I do see this getting better over time, and it’s going to require some rethinking and retooling to make these future states a reality.

<rant> My personal opinion on solving challenges with AI is that the entire industry has been thinking far too macro for most problems for too long. The more you use AI to build things, the more you realize that you have to go lower and lower, and make the problem space smaller and smaller. More guardrails, more rules, more precedents, and more discrete blocks of work are needed to be successful.

The tools that win in the future won’t be the ones that solve these large, esoteric problems (at least not for a very long time), but it’ll be the ones that solve the small headaches that make operating or achieving things an order of magnitude easier in a coordinated way. But you’ve got to start smaller than you initially think. </rant>

Some of the top comments from last week’s vibe check:

💬 “A security stack is like an ogre. Like an ogre, it has layers. Then the analogy stops because each layer irritates the other layers it’s sandwiched by.”

Never thought I’d see a security-Shrek-themed comment in the vibe check, but damn if I’m not here for it. 🧅 👹 

💰 Market Summary

Private Markets

• 12 companies from 5 countries raised $435.1M across 8 unique product categories

• Average deal size was $43.5M (median: $30.0M)

• 100% of funding went to product companies

• 12 companies from 6 countries were acquired for $420.0M across 9 unique product categories

• 58% of M&A activity went to product companies

Public Markets

• No public cyber companies had an earnings report in the first few weeks of 2026

• U.S. stocks were down inside and outside of cyber due to the announcement of a criminal investigation into the U.S. Federal Reserve Chair, further challenging the Fed’s independence in controlling monetary policy.

As of markets close on January 16, 2026.

📸 YoY Snapshot

Funding is picking right back up where it left off in 2025 with a really strong week, and several companies coming out of stealth.

M&A is just continuing to ripe, even for a time of year when transactions are usually higher than normal.

☎️ Earnings Reports

🧩 Funding By Product Category

• $216.7M for Continuous Automated Red Teaming (CART) across 2 deals

• $60.0M for Application Security Posture Management (ASPM) across 1 deal

• $58.0M for AI Governance across 1 deal

• $55.5M for Threat and Risk Prioritization across 4 deals

• $20.0M for Distributed Ledger Technology (DLT) Security across 2 deals

• $15.0M for Human Risk Management across 1 deal

• $9.9M for Secure Remote Access across 1 deal

• An undisclosed amount for Breach & Attack Simulation (BAS) across 1 deal

🏢 Funding By Company

Product Companies:

• Armadin Security, a United States-based automated red-teaming and AI threat hunting platform, raised a $165.2M Venture Round. (more)

• Aikido Security, a Belgium-based application security posture management (ASPM) platform, raised a $60.0M Series B from DST Global. (more)

• WitnessAI, a United States-based AI governance and safety platform, raised a $58.0M Venture Round from Sound Ventures. (more)

• Novee Security, an Israel-based continuous automated red teaming and penetration testing platform, raised a $51.5M Seed from YL Ventures, Canaan Partners, and Oren Zeev. (more)

• depthfirst, a United States-based threat and risk prioritization platform, raised a $40.0M Series A from Accel. (more)

• Project Eleven, a United States-based platform for migrating blockchain networks to post-quantum cryptographic standards, raised a $20.0M Series A from Castle Island Ventures. (more)

• Zepo, a Spain-based human risk management and security awareness platform, raised a $15.0M Seed from Kibo Ventures, eCAPITAL ENTREPRENEURIAL PARTNERS, and TIN Capital. (more)

• CloudSEK, a Singapore-based externally focused threat and risk prioritization platform , raised $10.0M Series B from Connecticut Innovations and an undisclosed Secondary Market transaction. (more)

• NetBird, a United States-based open-source secure remote access platform, raised a $9.9M Series A from Pace Capital. (more)

• Fencer, a United States-based threat and risk prioritization platform for software and SaaS companies, raised a $5.5M Seed from MHS Capital. (more)

• Horizon3.ai, a United States-based breach and attack simulation platform, raised an undisclosed Venture Round from Prosperity7 Ventures. (more)

• Naoris Protocol, a United States-based Web3 application security platform, raised an undisclosed Corporate Round from MOVA Chain. (more)

Service Companies:

• None

🌎 Funding By Country

• $298.6M for the United States across 8 deals

• $60.0M for Belgium across 1 deal

• $51.5M for Israel across 1 deal

• $15.0M for Spain across 1 deal

• $10.0M for Singapore across 2 deals

🤝 Mergers & Acquisitions

Product Companies:

• Seraphic Security, an Israel-based remote enterprise browser isolation platform, was acquired by CrowdStrike for $420.0M. Seraphic Security had previously raised $29.0M in funding. (more)

• 3rdRisk, a Netherlands-based automated third-party risk management platform, was acquired by Diligent for an undisclosed amount. 3rdRisk has not previously disclosed any funding events. (more)

• Axur, a United States-based cyber threat intelligence and brand protection platform, was acquired by Infoblox for an undisclosed amount. Axur has not previously disclosed any funding events. (more)

• Build38, a Germany-based mobile application security platform, was acquired by OneSpan for an undisclosed amount. Build38 had previously raised $17.6M in funding. (more)

• DeceptIQ, a United Kingdom-based deception technology platform based on red-team hunting and attacker analysis, was acquired by Thinkst Canary for an undisclosed amount. DeceptIQ has not previously disclosed any funding events. (more)

• MCP Manager, a United States-based gateway for deploying, monitoring, and managing MCP servers and external AI applications, was acquired by Usercentrics for an undisclosed amount. MCP Manager has not previously disclosed any funding events. (more)

• StrongDM, a United States-based just-in-time privileged access management (PAM) platform for DevOps and AI workloads, was acquired by Delinea for an undisclosed amount. StrongDM had previously raised $34.0M in funding. (more)

Service Companies:

• Alpha 2, a United States-based professional services firm focused on data protection, communications security, and cryptography, was acquired by Aurex for an undisclosed amount. Alpha 2 has not previously disclosed any funding events. (more)

• Beyond Secure, a United States-based managed security services and professional services provider, was acquired by nuview for an undisclosed amount. Beyond Secure has not previously disclosed any funding events. (more)

• Brite, a United States-based managed XDR security services provider, was acquired by Sole Source Capital for an undisclosed amount. Brite has not previously disclosed any funding events. (more)

• Inovacom, a France-based managed security services provider for both physical and cyber security, was acquired by Inherent for an undisclosed amount. Inovacom has not previously disclosed any funding events. (more)

• NetSource One, a United States-based managed security services provider, was acquired by New Charter Technologies for an undisclosed amount. NetSource One has not previously disclosed any funding events. (more)

📚 Great Reads

🧪 Labs

2026 will be the year of vibedating

Well, well, well, if it isn’t the consequences of my actions coming back to haunt me.

I don’t know about you, but that whole “let’s circle back after the new year” thing is really rearing its ugly head for me these first few weeks of the year. 🥴

2026 just started, but the year has already kept up the acceleration and momentum that 2025 brought. The battle over the future of agentic and AI identity security is currently the hottest contested space in the industry, followed quickly by the evolution of security operations, and I see no signs of either slowing down any time soon.

Speaking of having no chill, 2026 is already ramping up in a big way for me and Return on Security, so be on the lookout for some new forays, mediums, and ventures throughout the year.

One of those new things is happening next week, when I’m sitting down with Maxime Lamothe-Brassard from LimaCharlie for a conversation about where AI in security operations is actually heading and what the agentic future of SecOps will look like. Max and his team have been quietly building something different: infrastructure that enables AI agents to operate directly, with the same access and capabilities as human analysts.

Our conversation will be part of a larger launch with many more talks, so make sure to sign up here!

Also, one more thing! If Return on Security has been helpful for you, no matter how long you’ve been reading, I would really value your input on this 2-minute survey:

👉️ https://forms.gle/LBA1RhNnFrLMLmmR7 👈️ 

💡 _{Share the newsletter in one click}

😎 Vibe Check

Click the options below to vote on whether you are a practitioner, founder, or investor. Feel free to leave a comment, and I'll feature the best takes in next week’s write-up!

Last issue’s vibe check:
What metric should we finally stop tracking in 2026?
🟨🟨🟨🟨⬜️⬜️ Number of vulnerabilities patched
🟩🟩🟩🟩🟩🟩 Phishing test click rates
⬜️⬜️⬜️⬜️⬜️⬜️ Tool/asset coverage
🟨⬜️⬜️⬜️⬜️⬜️ Cyber risk quantification

I really like how the votes landed last week, and how literally no one voted for tool/asset coverage. That was a false flag, and it is likely more important than ever before.

Perhaps a saving grace for using AI in cyber will be the evolution of what we should care about vs. what we have historically had to care about through rote stats.

Sadly, the phishing tests will continue until morale improves.

Some of the top comments from last week’s vibe check:

💬 “Most CVEs can’t be exploited. Worthless stat that wastes the time of most people involved. New stat should be exploitable vulns patched.”

💬 “Please stop the phishing simulation madness, I beg of you.”

💬 “Test ability to report phishing, and get that to 100%” (⬅️ I like this one a lot)

💰 Market Summary

Private Markets

• 4 companies from 1 country raised $189.1M across 4 unique product categories

• Average deal size was $47.3M (median: $24.0M)

• 100% of funding went to product companies

• 10 companies from 5 countries were acquired for $740.0M across 7 unique product categories

• M&A activity was evenly split between product and service companies

Public Markets

• No public cyber companies had an earnings report in the last few weeks of 2025

As of markets close on January 9, 2026.

📸 YoY Snapshot

This is a lower-volume time of year on the funding front, but even so, 2026 is starting off with a bang compared to 2025.

A very strong start to the year on the M&A front. The public giants are back at it again, starting this year as they finished the last.

☎️ Earnings Reports

🧩 Funding By Product Category

Chart image date range from 2025-12-22 to 2026-01-18

• $140.0M for Security Orchestration and Automated Response (SOAR) across 1 deal

• $28.0M for Trust & Safety across 1 deal

• $20.0M for Software Supply Chain Security across 1 deal

• $1.1M for Secure Communications across 1 deal

🏢 Funding By Company

Product Companies:

• Torq, a United States-based cybersecurity platform that provides advanced protection and threat detection capabilities, raised a $140.0M Series D from Merlin Ventures. (more)

• Blackbird.AI, a United States-based narrative and disinformation threat intelligence platform, raised a $28.0M Venture Round from Ten Eleven Ventures. (more)

• Interos, a United States-based risk management and supply chain monitoring platform, raised a $20.0M Private Equity from Blue Owl and Structural Capital. (more)

• Sekur Private Data, a United States-based secure communications and privacy-focused collaboration suite, raised a $1.1M Post-IPO Equity. (more)

Service Companies:

• None

🌎 Funding By Country

They say a picture is worth 1,000 words ¯\_(ツ)_/¯

• $189.1M for the United States across 4 deals

🤝 Mergers & Acquisitions

Product Companies:

• SGNL.AI, a United States-based privileged access management (PAM) platform focused on just-in-time (JIT) access, was acquired by CrowdStrike for $740.0M. SGNL.AI had previously raised $42.0M in funding. (more)

• IriusRisk, a Spain-based automated threat modeling platform, was acquired by ThreatModeler for an undisclosed amount. IriusRisk had previously raised $38.7M in funding. (more)

• Privacy Pal, a United States-based web browser privacy tool for limiting sensitive data disclosed to AI applications, was acquired by Vocodia for an undisclosed amount. Privacy Pal has not previously disclosed any funding events. (more)

• Seald, a France-based end-to-end encryption and cryptographic identity management SDK, was acquired by OVHcloud for an undisclosed amount. Seald has not previously disclosed any funding events. (more)

• SIMS Software, a United States-based platform that tracks and identifies insider threats in the federal workspace, was acquired by TechnoMile for an undisclosed amount. SIMS Software has not previously disclosed any funding events. (more)

Service Companies:

• Advantus360, a Canada-based professional services firm focused on network, cloud, and endpoint security, was acquired by Integrity360 for an undisclosed amount. Advantus360 has not previously disclosed any funding events. (more)

• AssurancePoint, a United States-based professional services firm focused on compliance framework assessments, was acquired by Axiom GRC for an undisclosed amount. AssurancePoint has not previously disclosed any funding events. (more)

• Fortreum, a United States-based professional services firm focused on security and compliance services for the U.S. federal sector, was acquired by Gryphon Investors for an undisclosed amount. Fortreum has not previously disclosed any funding events. (more)

• Ntirety, a United States-based managed security services provider (MSSP), was acquired by 11:11 Systems for an undisclosed amount. Ntirety had previously raised $1.0M in funding. (more)

• Panacea Infosec, an India-based professional services firm focused on payment card security and PCI-DSS auditing, was acquired by SGS for an undisclosed amount. Panacea Infosec has not previously disclosed any funding events. (more)

📚 Great Reads

🧪 Labs

Welcome back and Happy New Year!

I hope that you got the chance to add shareholder value relax and unwind over the holidays with friends and family. 🫡 

This issue is a doozy, spanning multiple weeks through the end of December 2025. There’s more data in this issue, and the charts may span a longer timeframe than you're used to, so think of this as a catch-up issue.

Also, one more thing! If Return on Security has been helpful for you, no matter how long you’ve been reading, I would really value your input on this 2-minute survey:

👉️ https://forms.gle/LBA1RhNnFrLMLmmR7 👈️ 

💡 _{Share the newsletter in one click}

😎 Vibe Check

Click the options below to vote on whether you are a practitioner, founder, or investor. Feel free to leave a comment, and I'll feature the best takes in next week’s write-up!

Last issue’s vibe check:
What cybersecurity trend peaks in 2026?
🟨⬜️⬜️⬜️⬜️⬜️ Platform consolidation
🟩🟩🟩🟩🟩🟩 AI agent hype cycle
🟨🟨⬜️⬜️⬜️⬜️ Exposure management replacing vuln management
🟨🟨🟨⬜️⬜️⬜️ GenAI governance platforms
⬜️⬜️⬜️⬜️⬜️⬜️ Other (tell me)

Who would have thought that the most talked-about technology of 2025 would be the one that people think will peak in 2026? Well, statistically speaking, most of you thought that, but it’s likely a surprise for many others.

While AI agents have been the talk of the town, anyone who has spent much time with AI applications realizes the “agent” dream is still quite far away for even the simplest enterprise use case. There is still a very long way to go, and much security to sort out along the way.

I do think 2026 will be the year of governance and posture management for AI agents, but we’re not at the top of this mountain yet, I fear.

Me when I realize that AI agents haven’t even begun to peak

Some of the top comments from last week’s vibe check:

💬 “People will begin to realize that GenAI governance platforms aren't any different from... wait for it... their existing governance platforms.”

☝️ This one is going to sting for some folks!

💰 Market Summary

📸 YoY Snapshot

Nearly $1 billion in cybersecurity funding for the last few weeks of the year is pretty fitting for such a big year. I’ll have a lot more detail in the upcoming annual report on how the year shook out, but it was an epic one.

An active and high-profile end to the last few weeks of 2025 on the M&A front as well. It almost seemed as if companies didn’t “use it”, that they would “lose it.” 🤔 

☎️ Earnings Reports

🧩 Funding By Product Category

• $400.0M for Data Security Posture Management (DSPM) across 1 deal

• $130.9M for Security Operations across 2 deals

• $117.7M for Internet of Things (IoT) Security across 2 deals

• $81.0M for Security Awareness across 1 deal

• $57.9M for Professional Services across 2 deals

• $40.0M for Identity Governance & Administration (IGA) across 1 deal

• $35.0M for Secure Infrastructure across 1 deal

• $24.0M for Continuous Automated Red Teaming (CART) across 1 deal

• $12.0M for Security and Compliance Automation across 1 deal

• $9.0M for Threat and Risk Prioritization across 1 deal

• $8.8M for Fraud and Financial Crime Protection across 1 deal

• $3.6M for Data Protection across 2 deals

• $3.4M for Continuous Threat Exposure Management (CTEM) across 2 deals

• $2.6M for Mobile Device Security across 1 deal

• $2.5M for AI Governance across 2 deals

• $2.3M for Confidential Computing across 1 deal

• $2.0M for Secure Networking across 1 deal

• $2.0M for Managed Security Services Provider (MSSP) across 2 deals

• $2.0M for Identity Threat Detection and Response (ITDR) across 1 deal

• $1.4M for Cyber Risk Management across 1 deal

• $1.1M for Operational Technology (OT) Security across 1 deal

• $1.0M for Privileged Access Management (PAM) across 1 deal

• $600.0K for Data Privacy across 1 deal

• An undisclosed amount for Application Security Testing (AST) across 1 deal

• An undisclosed amount for Cybersecurity Education & Training across 1 deal

🏢 Funding By Company

Product Companies:

• Cyera, a United States-based data security posture management platform, raised $400.0M in Private Equity from Blackstone Group. (more)

• Vega, an Israel-based security operations and automation platform, raised a $120.0M Series B from Accel. (more)

• Exein, an Italy-based firmware and Internet of Things (IoT) security platform, raised $117.7M Venture Round from Blue Cloud Ventures and undisclosed Debt Financing from JP Morgan. (more)

• Adaptive Security, a United States-based security awareness training platform for AI-enabled social engineering and deepfake attacks, raised a $81.0M Series B from Bain Capital Ventures. (more)

• Act Security, an Israel-based identity governance for AI agents and applications, raised a $40.0M Series A from Notable Capital. (more)

• Echo, an Israel-based secure container image infrastructure platform, raised a $35.0M Series A from N47. (more)

• Armadin Security, a United States-based automated red-teaming and AI threat hunting platform, raised a $24.0M Seed from Ballistic Ventures. (more)

• Paramify, a United States-based security and compliance automation platform focused on government compliance frameworks, raised a $12.0M Series A from Moore Strategic Ventures. (more)

• Logpresso, a South Korea (Republic of Korea)-based security automation and event management platform, raised a $10.9M Series B from K2 Investment Partners, KB Investment, SANDSLab. (more)

• Dux Security, a United States-based threat and risk prioritization platform based on exploitability analysis, raised a $9.0M Seed from Maple Capital, Redpoint, and TLV Partners. (more)

• Verisoul, a United States-based fake user detection and protection platform, raised a $8.8M Series A from High Alpha. (more)

• Gambit Cyber, a United States-based continuous threat exposure management platform, raised a $3.4M Seed from Expeditions. (more)

• Soverli, a Switzerland-based mobile device security and digital sovereignty platform, raised a $2.6M Pre-Seed from Founderful. (more)

• Ciphero AI, a United States-based AI application governance and safety platform, raised a $2.5M Pre-Seed from Chingona Ventures and Sovereign's Capital. (more)

• Wodan AI, a Belgium-based confidential computing platform using homomorphic encryption for sensitive workloads, raised a $2.3M Pre-Seed from Adara Ventures, JME Ventures, and Swanlaab Venture Factory. (more)

• Gardiyan, a Turkey-based managed security services provider, raised a $2.0M Seed from APY Ventures. (more)

• Goldilock, a United Kingdom-based secure networking platform, raised a $2.0M Seed. (more)

• Anetac, a United States-based privileged identity threat detection and response (ITDR) platform, raised a $2.0M Venture Round. (more)

• Grayscale security, a China-based automated cybersecurity risk management platform, raised a $1.4M Series A from Tianjin Science and Technology Angel Investment and Tianjin Taiqiao.

• Bastazo, a United States-based AI-driven vulnerability prioritization platform for operational technology and critical infrastructure, raised a $1.1M Grant from BIRD Foundation. (more)

• Grizzle Technology, a Turkey-based privileged access management platform, raised a $1.0M Corporate Round from Dof Robotics.

• CYTRIO, a United States-based data privacy compliance and rights management platform, raised a $600.0K Venture Round.

• Cyra, an India-based cybersecurity education and live training platform, raised an undisclosed Seed.

• ValiantSec, a China-based application security testing platform, raised an undisclosed Venture Round from China Internet Investment Fund, Fortune Venture Capital, and Junxi Capital.

Service Companies:

• DSShield, a Saudi Arabia-based professional services firm focused on operational technology security and physical security services, raised a $54.1M Private Equity from Merak Capital. (more)

• Nordic LEVEL, a Sweden-based professional services firm focused on cyber and physical risk management services, raised a $3.8M Debt Financing.

• QUANTUM DEFEN5E, a Canada-based quantum-resistant data protection and network security platform, raised a $2.6M Seed.

• Woodway Assurance, a Canada-based platform for making sensitive data available for AI/ML use cases in a privacy-preserving manner, raised a $1.0M Seed from Aventure Capital. (more)

• Diling Technology, a China-based trust and safety platform for AI training and application data and generated outputs, raised an undisclosed Series A from Cowin Venture, Planck Venture, and South China Venture Capital. (more)

• nuview, a United States-based managed security services provider, raised an undisclosed amount of Private Equity from Mansfield Investment Partners. (more)

• Outpost24, a Sweden-based continuous threat exposure management (CTEM) platform, raised an undisclosed Private Equity from Vitruvian Partners. (more)

🌎 Funding By Country

Chart data is from December 8th to December 31st, 2025.

• $544.4M for the United States across 12 deals

• $195.0M for Israel across 3 deals

• $117.7M for Italy across 2 deals

• $54.1M for Saudi Arabia across 1 deal

• $10.9M for South Korea (Republic of Korea) across 1 deal

• $3.8M for Sweden across 2 deals

• $3.6M for Canada across 2 deals

• $3.0M for Turkey across 2 deals

• $2.6M for Switzerland across 1 deal

• $2.3M for Belgium across 1 deal

• $2.0M for the United Kingdom across 1 deal

• $1.4M for China across 3 deals

• An undisclosed amount for India across 1 deal

🤝 Mergers & Acquisitions

Chart data is from December 8th to December 31st, 2025.

Product Companies:

• Armis, a United States-based agentless IoT security platform, was acquired by ServiceNow for $7.8B. Armis had previously raised $1.2B in funding. (more)

• HYAS, a Canada-based threat intelligence and protective DNS platform, was acquired by Silent Push for an undisclosed amount. HYAS had previously raised $16.0M in funding. (more)

• Phronesis Security, an Australia-based professional services firm focused on security assessments and compliance, was acquired by Bastion Security Group for an undisclosed amount. Phronesis Security has not previously disclosed any funding events. (more)

Service Companies:

• CloudScale365, a United States-based managed services provider (MSP), was acquired by Broadwing Capital for an undisclosed amount. CloudScale365 has not previously disclosed any funding events. (more)

• Cresco Cybersecurity, a Belgium-based professional services firm focused on security assessments, training, and risk reduction, was acquired by Integrity360 for an undisclosed amount. Cresco Cybersecurity has not previously disclosed any funding events. (more)

• Itegria, a United States-based managed security services provider for Registered Investment Advisers, was acquired by ItSynergy for an undisclosed amount. Itegria has not previously disclosed any funding events. (more)

• nuview, a United States-based managed security services provider, was acquired by RFE Investment Partners for an undisclosed amount. nuview has not previously disclosed any funding events. (more)

• Sheffield Scientific, a United States-based professional services firm focused on security for critical national infrastructure, was acquired by Total Resource Management for an undisclosed amount. Sheffield Scientific has not previously disclosed any funding events. (more)

📚 Great Reads

🧪 Labs

How I hope the emails found you over the holiday break.

To the Shareholders Return on Security Community,

Top Highlights in 2025

Some of the things I was most excited about and proud of in 2025:

• My first conference talk at BSidesSF on the topic of Trust Engineering: Building Security Leadership at Early-Stage Startups

• Getting the chance to brief GCHQ and a room full of UK investors and founders on the state of AI Security in the industry, and where I thought things were going.

• Being the emcee for the second annual Innovators & Investors Summit at Black Hat USA 2025

• Backing the UK's first specialist cybersecurity seed fund

• Open-sourcing the AI Security Shared Responsibility Model and giving the model some serious updates.

• Giving a keynote speech at Cybersec Netherlands on The State of Cybersecurity Economics in Europe

• Being the emcee for the Black Hat Europe Startup Spotlight competition and recruiting half the judges and startups

• Making more angel investments (more on that in 2026)

• Making more, absolute, banger memes

How I hope this post finds you

My goal with Return on Security has always been to build a sustainable business that could stand the test of time and be something I was really excited to work on every day.

2025 confirmed that I have indeed achieved this.

Lessons Learned

While it’s good to acknowledge a small victory lap, there is still much to do going forward. 2025 reinforced some lessons and brought some new ones:

Compounding Consistency

As I said last year, compound interest is the most powerful force in the world. That consistency kept paying dividends in 2025. It was a full year of being all-in on Return on Security, meaning no other financial safety net, and I can say that the longer I'm on this path, the better it has become. Business and personal gains (returns) add up the longer you compound. What starts small really can end up being quite significant if you stay on the path.

Better Clarity

The longer you've been doing something, the clearer you become on what matters and what doesn't. You get clear on things that move the needle for you, both professionally and personally, and what's something you don't want to focus on. It also helps you see what the next steps could look like.

I spent a lot of time soul-searching about this in 2025 to understand what growth looks like and what's the best way to achieve it. I don't know that I have all the answers yet, but I'm a lot clearer on what an answer could look like.

Resisting the Borg

At Return on Security, I’ve consistently focused on succeeding unconventionally rather than failing conventionally.

I’ve continued to do this by resisting something called the “institutional imperative.” It’s that large and unseen force that causes businesses to mindlessly imitate the behavior of their peers, no matter if it’s a good idea or not.

2025 taught me that I have found it far more enjoyable to stick to being a source of truth, rather than struggle in the quicksand of commodity competition.

Closing Notes

If you made it this far, I appreciate you taking the time and hope you enjoyed it and found it helpful. I am very fortunate to have the chance to work on something I am so excited about every day.

If any of the above resonated with you and you'd like to find a way to partner or collaborate, please reach out. Thank you all for your support throughout this ~five-year journey.

Here's to many more years of data-driven insights, news, and memes that help you understand the cybersecurity market. 🤝

Happy New Year!

Cheers, 
Mike P

Last week, I had the privilege of serving as emcee for the second annual Innovators & Investors Summit at Black Hat USA. It was a full day dedicated to conversations that matter for the future of the cybersecurity economy.

The event brought together founders, investors, and security leaders to explore how innovation gets funded, built, and scaled in a fast-moving and complex threat environment.

This post has my detailed takeaways from each session, but if you just want the 1-liner highlights, check out my LinkedIn recap.

Startup 201: What Your Lawyer and VC Won’t Tell You

Speakers: Taylor Margot

Key takeaway: Keep it simple: clean founder equity, use SAFEs, and avoid overcomplicating legal structures.

Notes:

• The most common killer of early-stage startups isn’t product failure, it’s messy founder equity.

• Early funding should almost always go through a Simple Agreement for Future Equity (SAFEs). They minimize friction, keep cap tables clean, and simplify early investor relationships.

• Complex legal structures only create problems down the road and can scare off would-be investors.

• A clean, straightforward foundation makes startups more fundable and more resilient in later rounds.

Security Below the Poverty Line

Speakers: Wendy Nather & Nils Puhlmann

Key takeaway: The gap between security “haves” and “have-nots” is widening, and compliance often adds cost without closing it.

Notes:

• Many organizations are struggling with basic security access, not just advanced defenses.

• Compliance requirements often add unnecessary overhead without addressing the root security issues.

• The widening gap means attackers can disproportionately target weaker organizations.

• The ecosystem suffers when security is out of reach for large parts of the economy.

The Vibe Code Experience

Key takeaway: Security needs to move at the speed of shipping. Our models and mindsets must evolve as fast as the code does.

Notes:

• Security can’t remain the blocker in these vibe coding times. It has to be a partner that accelerates shipping.

• Teams that adapt to the rhythm of code release cycles will stay relevant; those that don’t risk being sidelined.

• Haikus and creative storytelling showed that security culture doesn’t have to be boring.

• Security leaders need to rethink their frameworks, metrics, and approaches for developer-first environments.

Sniffing Out the BS in AI

Key takeaway: Not every problem needs AI. Start with proof, practicality, and purpose.

Notes:

• AI hype is distorting both funding and product roadmaps.

• Many “AI features” solve nothing and justify price increases.

• Proof of effectiveness should always come before big claims or marketing.

• AI should be applied only where it makes sense, not as a one-size-fits-all hammer.

• The real winners will integrate AI invisibly into solving customer pain points.

Innovation Showdown: The Startup Spotlight Final Four

Startups:

• Ryan Boerner

• Benny Porat

• Dimitry Shvartsman

• Jeremy Snyder

Key takeaway: The best pitches tell the truth, meet customers where they are, and explain problems simply.

Notes:

• Winning pitches prioritize clarity over flash. If you can’t explain it simply, you don’t understand it well enough.

• Customer empathy — meeting them where they are today — is often the deciding factor.

• Authentic storytelling builds credibility with investors and customers alike.

• Over-promising kills trust faster than any technical weakness.

Prime Security later went on to win the Startup Spotlight competition.

Self-Funded Security

Key takeaway: VC money isn’t the only path. Timing and product-market fit matter more than capital.

Notes:

• Bootstrapping can create stronger discipline and healthier businesses than chasing VC dollars.

• Money can help a company avoid dying — but it won’t guarantee success.

• Timing and true product-market fit remain the most critical factors.

• Alternative funding paths create resilience and independence in the cybersecurity economy.

Mastering the Channel Ecosystem

Speakers: Raffael Marty, Daniel Bernard, Matt Berry, Chris Bisnett, Peter Bryant

Key takeaway: The winning play in channel strategy is becoming something your partners’ customers demand.

Notes:

• Channel success depends on understanding the partner’s customer first.

• If end customers demand a product, partners will follow and demand drives adoption.

• The best channel strategies focus on alignment, not forcing a product into misfit ecosystems.

• Building long-term trust in the channel ecosystem is more valuable than short-term incentives.

Closing Remarks: The Cybersecurity Economy

Speaker: Mike Privette (me)

Key takeaway: We’re not just participants in the cybersecurity economy - we’re agents who build it up or break it down.

Notes:

• Every budget decision, hire, and policy choice actively shapes the cybersecurity economy.

• The ecosystem is dynamic and interconnected, meaning no decision happens in isolation.

• Founders, investors, leaders, and policymakers all share responsibility for resilience.

• The attacker economy shapes all of this and how defenses and investments evolve.

Final Reflections

The summit highlighted one unifying theme: cybersecurity is an economy in itself. Startups, investors, leaders, and policymakers all play a role in how it grows, where it struggles, and how it adapts to both threats and opportunities.

It was inspiring to see so many builders and innovators in one place. A huge thank you to the Black Hat team, especially Brittany Buza, for bringing it all together.

Hey -

We made it, folks! Welcome to the last issue of Security, Funded in 2025!

It was also great to run into and catch up with so many people at Black Hat Europe last week, and I can’t think of a better way to roll into the last issue of the year. Congrats to Geordie AI for winning the Startup Spotlight Competition and to VulnCheck for winning the people’s choice vote!

Although this is the last newsletter of the year, it doesn't mean I'll stop writing. It’s been a hell of a year in our industry, and now is when I start working on the flagship annual report set to come on in late January 2026. Be sure to also keep an eye out for my annual shareholder letter coming later this year, with an update on the state of the business for Return on Security.

Also, one last thing! If Return on Security has been helpful for you this year (no matter how long you’ve been reading), I would really value your input on this 2-minute survey:

👉️ https://forms.gle/LBA1RhNnFrLMLmmR7 👈️ 

This short survey will really help me stay grinding on the things that matter. 😤 👊

See you all in this format next year, and I hope you have an amazing end to your 2025!

💡 _{Share the newsletter in one click}

😎 Vibe Check

Click the options below to vote on whether you are a practitioner, founder, or investor. Feel free to leave a comment, and I'll feature the best takes in next week’s write-up!

Last issue’s vibe check:
Three quarters in a row with $5B+ in cyber funding. Is this:
🟨⬜️⬜️⬜️⬜️⬜️ Sustainable (AI wave is real)
🟩🟩🟩🟩🟩🟩 A bubble (it'll pop eventually)
🟨🟨⬜️⬜️⬜️⬜️ The new normal
⬜️⬜️⬜️⬜️⬜️⬜️ Irrelevant due to the attackers

Everyone is feeling AI bubble vibes these days, with a slight nod towards this being our “new normal.”

My personal take is that we are still somehow really early on in the AI race, even with the insane amount of technical progress that has taken place over the last three years. The more I zoom in on AI, the more it looks like we need to figure out, and the more scaffolding we need to make it successful.

When it comes to cyber, however, we have different economic levers. Most industries depend entirely on commercial viability and market demand, but not cyber. While AI hype creates speculation everywhere else, cybersecurity's structural differences and external attacker forces make it more uniquely bubble-resistant.

Some of the top comments from last week’s vibe check:

💬 “Prediction: the AI reckoning happens next year and RSAC 2027 is the first RSAC conference not dominated by talk of AI. What takes AI's place as the dominant funding attraction? Good question: exposure management? It's looking like Tenable, Rapid7, and Qualys might have a Symantec/McAfee moment in the near future.”

💰 Market Summary

Private Markets

• 15 companies from 6 countries raised $797.3M across 13 unique product categories

• Average deal size was $66.4M (median: $9.3M)

• 100% of funding went to product companies

• 5 companies from 4 countries were acquired across 5 unique product categories

• 80% of M&A activity went to product companies

Public Markets

• 2 public cyber companies had an earnings report

As of market close on December 12, 2025.

📸 YoY Snapshot

Last week’s funding was still a doozy, even if you don’t compare it to the week prior. The industry is in full Santa Rally mode. 🎅 

M&A is still going strong, with many big companies continuing to make major moves this year. If 2025’s M&A could be categorized as a story, it would be one of slumbering giants of the industry waking up and bringing their friends in.

_{Partner With Us}

☎️ Earnings Reports

🧩 Funding By Product Category

• $700.0M for Identity and Access Management (IAM) across 1 deal

• $31.5M for API Security across 2 deals

• $20.0M for Cyber Risk Management across 1 deal

• $13.0M for Deepfake Detection across 1 deal

• $11.6M for Certificate Lifecycle Management across 1 deal

• $7.0M for Threat Intelligence across 1 deal

• $6.5M for Blockchain Security across 1 deal

• $3.8M for Multi-Factor Authentication (MFA) across 1 deal

• $2.0M for Security Analytics across 1 deal

• $1.8M for IT Asset Management (ITAM) across 1 deal

• $50.0K for Threat and Risk Prioritization across 2 deals

• An undisclosed amount for Security Operations across 1 deal

• An undisclosed amount for Managed Security Services Provider (MSSP) across 1 deal

🏢 Funding By Company

Product Companies:

• Saviynt, a United States-based intelligent identity and access governance solution for cloud applications, raised a $700.0M Series B from Kohlberg Kravis Roberts. (more)

• Prime Security, a United States-based security review automation and risk management platform, raised a $20.0M Series A from Scale Venture Partners. (more)

• Kasada, an Australia-based API security platform, raised a $19.9M Venture Round from EQT. (more)

• Resemble AI, a United States-based deepfake detection and AI verification platform, raised a $13.0M Venture Round from Berkeley Frontier Fund. (more)

• Equixly API Security, an Italy-based API security platform, raised a $11.6M Series A from 33N Ventures. (more)

• EVERTRUST, a France-based certificate lifecycle and public key infrastructure (PKI) management platform, raised a $11.6M Series A from Elephant. (more)

• Zynap, a Spain-based threat intelligence platform, raised a $7.0M Seed from K Fund and Kibo Ventures. (more)

• TestMachine, a United States-based Web3 and Blockchain security platform, raised a $6.5M Venture Round from Blockchange Ventures, Decasonic, Delphi Ventures, and New Form Capital. (more)

• Cyphlens, a United States-based mobile-based multi-factor authentication platform using visual cryptography, raised a $3.8M Seed from Cambrian Ventures. (more)

• Realm.Security, a United States-based security and cloud data aggregation and analytics platform, raised a $2.0M Venture Round from Presidio Ventures. (more)

• XFA, a United States-based privacy-focused IT asset management and security platform, raised a $1.8M Seed from Curiosity VC and ScaleFund. (more)

• ThreatCaptain, a United States-based threat and risk prioritization platform for MSSPs, raised a $50.0K Grant from South Carolina Research Authority. (more)

• CYBRET AI, a Sweden-based agentic AI security operations workflow platform, raised an undisclosed Seed from FR8, Inception Fund, Skyfall Ventures, Visionaries Club, and Wave Ventures.

• Point Wild, a United States-based threat and risk prioritization platform, raised an undisclosed Venture Round from WndrCo.

Service Companies:

• PKI Solutions, a United States-based managed security services provider (MSSP) focusing on managing identity and encryption systems, raised an undisclosed Venture Round from Arthur Ventures. (more)

🌎 Funding By Country

• $747.1M for the United States across 10 deals

• $19.9M for Australia across 1 deal

• $11.6M for Italy across 1 deal

• $11.6M for France across 1 deal

• $7.0M for Spain across 1 deal

• An undisclosed amount for Sweden across 1 deal

🤝 Mergers & Acquisitions

Product Companies:

• Cycuity, a United States-based hardware security verification platform, was acquired by Arteris for an undisclosed amount. Cycuity has not previously disclosed any funding events. (more)

• Infinipoint, an Israel-based zero-trust security company for workstations and mobile devices, was acquired by Outpost24 for an undisclosed amount. Infinipoint had previously raised $14.0M in funding. (more)

• Junglemap AB, a Sweden-based security awareness training platform, was acquired by MetaCompliance for an undisclosed amount. Junglemap AB has not previously disclosed any funding events. (more)

• Tromzo, a United States-based developer-first appsec management platform, was acquired by Checkmarx for an undisclosed amount. Tromzo had previously raised $11.1M in funding. (more)

Service Companies:

• Cyqueo, a Germany-based professional services firm focused on network and security consulting, was acquired by Spie SA for an undisclosed amount. Cyqueo has not previously disclosed any funding events. (more)

📚 Great Reads

🧪 Labs

TOGETHER WITH

Humans built the most powerful communication network in history, and then designed it to spy on us.

This wasn't an accident, and it wasn't due to some technical oversight. No, it was because we chose an economic model that treats personal data as the most abundant and cheapest fuel source available in cyberspace.

Twenty-five years later, we're all still paying the price.

TL;DR

• Ad-supported business models made surveillance the default, not privacy.

• Loyalty programs are a prime example of how “free” services extract payment through attention, time, and personal data.

• Privacy regulations have failed to change economic incentives, and companies continue to profit more from harvesting data than protecting it.

• AI has exponentially increased the stakes—your data now trains systems that shape your future and enables social engineering on a massive scale.

• Individual privacy erosion has become a significant corporate cyber risk that many companies are not accounting for.

• We chose surveillance by default, but we can still opt for privacy by design.

• An entire industry now profits from cleaning up a mess that never should have existed.

What is the Real Cost of "Free"?

What's the "value" of something free, and what is the cost?

Let's break down what the "cost" of free means when it comes to data privacy. But first, we'll need to borrow some economic terms to better understand this space:

• Free Goods - Goods that are not scarce, are available in unlimited quantities, and whose consumption by one person doesn't reduce their availability to others.

• Opportunity Cost - The value of the best alternative that you decided not to choose when you make a decision.

• Zero-Price Effect - People often exhibit a psychological bias toward things that are "free." They tend to overvalue goods or services offered at zero cost, even when the "free" option is not as good as paid alternatives.

• Hidden Costs - This idea that even when something looks "free," there might be hidden costs like time, attention, or data that someone has to "pay." When something appears to be free, you're likely paying with a different currency.

• Zero-Sum Game - The economic theory of competition where one side can only win at the other side's loss. You're either a zero or a one.

Here's a real-world example of how this works.

Vanderbilt University's recent paper, The Loyalty Trap, dissects how rewards programs have become surveillance infrastructure masquerading as customer perks. The numbers tell the story:

• McDonald's: 150 million loyalty users whose orders, locations, and app interactions are tracked.

• Nordstrom: 13 million members whose purchasing patterns are extensively profiled.

• Grubhub: 25 million monthly users whose eating habits are monitored and monetized.

It’s all done via a shareholder-value-increasing, three-stage extraction process:

Infinite Money Glitch

You get a free coffee after ten purchases at McDonald’s. They get a perpetual profile of your behavior that they can monetize indefinitely. The zero-price effect and hidden costs are playing out in real-time, millions of times per day.

Now apply these concepts to your personal data as a whole. See now why data privacy has been treated as an afterthought?

An entire industry profits from creating a problem that never should have existed, and it has remained mostly untouched for the past few decades. Only in recent years have we begun to see changes, and now a new group of businesses is addressing a problem that should never have existed.

The economic incentives, trade-offs, and rewards were never aligned to protect your personal data. "There's no such thing as a free lunch," as they say.

We could have done this differently, but we didn't realize we were playing a zero-sum game and didn't understand the trade-offs happening to us.

The Origin of the Privacy Trade-Off

Advertising was the Internet's original sin and trade-off we didn't see coming.

A few banner ads were placed on various websites we frequently visited. Maybe we'd see an ad for something we wanted to buy, or maybe we would just ignore it. Either way, our collective knowledge of what was available to us on the web grew with each new site we visited. Shopping online offered more selection than any local store could, and connected us with people and places we would never have interacted with otherwise.

Social media was the same way. It offered more connection opportunities than offline circles and allowed you to stay in touch with people whose lives may have gone in different directions from yours (also, it’s great at helping you remember random people’s birthdays).

But once businesses realized that ad-supported business models worked, they became the default operating mode. The business of user tracking to serve better, more relevant, and more timely ads was born.

We all accepted it because we had no idea what we were giving up. Even if we had known at the time, the value would have probably seemed worth it. And to be fair, neither side was truly aware of the trade-offs or how they would evolve, but the business side of the equation caught on much faster than the consumer side.

As I've written before in Understanding Digital Footprint Management, data collection went from passive analytics to aggressive aggregation in a hurry.

Scraping, mining, and reselling information you didn't know was being collected on you, and that you had no idea businesses would find valuable. All the while, the data aggregation universe was happily scraping, harvesting, and monetizing your life, turning personal details into profit.

If you want an example of just how far this has gone, consider the Gravy Analytics breach. This location data giant was breached, exposing years of granular movement data sold to law enforcement, advertisers, and who knows who else.

As Matt Johansen said in his piece on the Gravy Analytics piece:

By the time this breach came around, the genie had long been out of the bottle, and there was no chance of getting it back in.

The Industry That Shouldn't Exist

Early security professionals sounded alarms on data misuse, surveillance capitalism, and personal exposure.

But privacy wasn't "sexy," actionable, or monetizable in those days. Even within security, privacy was often viewed as a niche or legal-adjacent concern, rather than central to threat modeling or risk reduction for individuals and businesses alike.

If you need proof of systemic failure, look at the booming market for Digital Footprint Management services. Platforms like DeleteMe and others are becoming household names, but these companies are not the villains of the story. They're more like the emergency response crew at a pile-up on a section of the interstate, notoriously known for its frequent crashes.

In my analysis of the Digital Footprint Management market, I outlined how this sector emerged to help individuals and businesses claw back some measure of control:

• Data Broker Opt-Outs: Submitting takedown requests to dozens or hundreds of people-search and marketing aggregation sites.

• Search Engine De-Indexing: Hiding sensitive URLs from search engine results.

• Continuous Monitoring: Because removing data once is never enough, since it repopulates like weeds.

• Dark Web Monitoring: Trying to catch the inevitable leak after the brokers resell your details to anyone.

These services are inherently good. But the fact that they're necessary at all is an indictment of the entire system.

When companies collect and resell personal data and regulators fail to rein them in, the burden falls on individuals to clean up a mess they never knowingly created. Data privacy isn't just about protecting data. It's about what we've lost by building everything on surveillance by default.

Some examples of what’s been lost to the surveillance economy:

• Trust in technology: People are increasingly wary of the tools that promised to empower them.

• Freedom of expression: Fear of being tracked or doxxed chills open participation.

• Resilience against abuse: A Lawfare piece on people-search brokers shows, stalkers, harassers, and even murderers use purchased data to find and harm victims.

“But wait!” you say. “What about all of those privacy regulations?”

The Illusion of Control from Regulators

Giphy

Both the General Data Protection Regulation (GDPR) in the European Union and the California Consumer Privacy Act (CCPA) in the United States were designed to shift the economic incentives around data protection.

These are just the big ones, of course, and don’t even come close to describing the complexity on the regulatory side. The IAPP’s US State Privacy Legislation Tracker is the best resource I've seen for tracking what's going on in the United States.

The core idea around privacy regulation was to make noncompliance so costly that organizations would find it rational to invest in protecting personal data. The underlying premise was that, if the penalty for misuse is high enough, companies will invest in necessary consumer protection measures and curb their insatiable hunger for end-user data at all costs.

Both laws are grounded in the idea that economic incentives drive organizational behavior (and I believe that is true). By making the cost of non-compliance steep and cumbersome enough, through fines and lawsuits, and greater than the cost of compliance, GDPR and CCPA aimed to encourage proactive investment in privacy and data security.

Capitalism has entered the chat…

GDPR also introduced an unintended side effect that we couldn't have predicted: self-exclusion from innovation.

The saga of Meta’s Llama model, a family of large language models (LLMs) designed to be open and accessible, and the European Union (EU) regulators, is a case in point:

• Meta pulled its multimodal AI release in Europe, citing regulatory uncertainty.

• The Irish DPC, in coordination with other EU regulators, has spent over a year negotiating whether using public posts for AI training is compliant.

• Meanwhile, Europeans are left watching advanced tools roll out elsewhere.

Consider the cookie consent pop-ups that have blanketed the web (there’s even one on this site). Consent banners haven't meaningfully improved privacy by any measure, but they’ve almost certainly ruined the web browsing experience by the only measure that matters (perception).

They've also mostly trained people to click "Accept All" without thinking. Brilliant!

Me yelling at you for accepting cookies

But as time has passed, the limitations of privacy regulations have become clear. Enforcement is uneven. Compliance is often a superficial checkbox exercise. Fines, no matter how big they sound in headlines, are a rounding error for Big Tech. Some even get easily pushed back.

For a recent example of regulatory backsliding, consider how the Consumer Financial Protection Bureau quietly withdrew its proposed rule to limit the sales of sensitive personal information by data brokers. The agency reversed course just weeks after a new administration took office, declaring the rule no longer "necessary or appropriate."

This reversal demonstrates how quickly privacy protections can be undone by changing political winds, while individuals and businesses are left holding the bag.

The underlying goals of regulation were at least well-intentioned, however. Protecting minors and preserving individual dignity are good things and should be the default standard.

But there's a difference between a business write-down and enforcement that reshapes incentives.

Since GDPR came into effect in May 2018, total fines have reached approximately €5.88 billion (USD $6.17 billion) across all of Europe. While this sounds substantial, GDPR fines in 2024 totaled €1.2 billion, a 33% decrease from the € 1.8 billion in 2023.

For context, Meta alone generated $48.3 billion in revenue in 2024. A few hundred million in fines is simply the cost of doing business for Big Tech.

And, right now? The math still favors harvesting data over protecting it.

Reframing the Problem

Of course, it's tempting to see this as a purely technological problem.

If only we had better encryption, more effective governance and compliance tools, or greater societal awareness. If only people were more responsible with their own data!

But at its core, data privacy is a problem of economic incentives (as are many cybersecurity problems).

The business incentive to collect and exploit data is massive! The incentive to protect data is… well, not as great.

Until the economic equation changes, that is, until privacy is profitable and surveillance is expensive, nothing will fundamentally improve.

This is why I often come back to the phrase: the opportunity cost of data privacy. Every time we accept the convenience of free, frictionless experiences without questioning the trade, we're paying that cost. This is true from a personal standpoint, and it is becoming increasingly true from a business standpoint as well.

When Personal Becomes Corporate

Things are starting to turn, however.

People and businesses now have tools, awareness, and growing legal leverage to take action. Solutions exist not just to remove your data, but to reframe how and where it's used.

The value curve of privacy is shifting from blocker to differentiator. There's now a return on privacy (see what I did there?), and the market is beginning to recognize it.

Digital Footprint Management services are becoming more mainstream for a reason, and that's because they work. This isn't a luxury anymore, or only for tinfoil hat-wearing people. If you're in any profession where your identity as an executive, journalist, lawyer, activist, or just someone who values their safety is valuable, these are useful tools.

This line of thinking requires an economic reframing, one that aligns privacy protection as another form of insurance. And this is where individual privacy extends beyond just you and your sphere of influence.

Individual privacy loss doesn't stop with individuals, it has been blended and extended into the corporate realm.

Every employee who's been digitally profiled for the last 15 years represents a corporate vulnerability that nobody's accounting for in their threat models. Every executive whose home address is $0.25 on a data broker site is a social engineering target waiting to be exploited. Every developer whose GitHub contributions, LinkedIn history, and Twitter opinions can be scraped and analyzed by AI in seconds is a potential attack vector.

The Data Broker Infrastructure

From an attacker's perspective, employee exposure == attack surface. Data brokers are a discount reconnaissance infrastructure.

Every detail about your employees' lives, their relatives, their homes, their habits, and their social connections is reconnaissance data for social engineering, doxxing, or stalking.

A few years ago, this level of reconnaissance required human analysts and a risk-versus-reward calculation. Today, an attacker with an LLM ingests those data broker profiles, does additional OSINT on any other information about you, and gets the perfect context. For less than the cost of a nice dinner (or a pint of Guinness 🍺 ), an attacker can purchase comprehensive profiles of your entire executive team.

This brings to mind another economic term of asymmetric information. It’s where one party in a transaction has more or better information than the other, which can lead to advantages and leverage over the other party.

This is an externality that has not yet been fully priced in on the data privacy front. Companies that invest in employee privacy protection aren't just reducing their own risk, they're changing the economic equation for attackers.

Reducing the reconnaissance data available to attackers may make social engineering harder to execute at scale, though measuring the downstream effects on individual security controls is inherently difficult without critical industry mass. Collective defense only shifts attacker economics when enough organizations participate. We're still building from the ground up.

Final Thoughts

Smart companies are starting to figure this out. Enterprise Digital Footprint Management programs are emerging, not just as HR benefits, but as additional security controls. Executive protection services that used to focus on physical security now spend more time on digital exposure reduction than on bodyguard services.

We built an economy where personal data was free to harvest and expensive to protect.

Markets always respond to money and incentives (even the bad kind of markets). When enough organizations make reconnaissance expensive again, the entire attack model becomes less viable. Changing the cost structure changes the behavior.

The bad news is that we could have done this differently from the start. The good news is that we still can.

Hey -

POV - You’re me watching all the funding and M&A activity come in last week.

Imagine this guy, but with a beard

A lot of ground to cover from last week, so go ahead and hit the jump to the blog post version.

It’s Black Hat Europe here in London this week, and I’m looking forward to catching up with everyone. I’ll be at the AI Security Summit on Tuesday and bouncing around the conference the rest of the week. I’ll also be emceeing the Startup Spotlight Competition on Thursday and hope to see you there!

A quick programming note, but this issue and next week’s are the last two issues of 2025. 🤯 I can’t believe how fast the year has gone by, but I’m so very glad you’ve been a part of it.

2026 is already shaping up to be a big year for Return on Security, and I’m really excited for what’s coming next. If you’re a business looking to get in front of the top security leaders, investors, and founders in the world in 2026, let’s chat.

💡 _{Share the newsletter in one click}

😎 Vibe Check

Click the options below to vote on whether you are a practitioner, founder, or investor. Feel free to leave a comment, and I'll feature the best takes in next week’s write-up!

Last issue’s vibe check:
How has your security organization grown this year?
🟨🟨🟨⬜️⬜️⬜️ ⬇️ Gotten smaller
🟩🟩🟩🟩🟩🟩 ↔️ Stayed the same size
🟩🟩🟩🟩🟩🟩 ⬆️ Gotten bigger

I think last week’s vibe check results are a pretty good sign of the industry. I expected that most votes would have gone to teams staying the same size, but it’s tied with teams that have gotten bigger.

I suspect this is a tale of two worlds — one that has expanded by taking ownership of more security and IT responsibilities, and one that has been frozen in time, where CapEx (spending on tools and services) is favored over OpEx (full-time salaries and benefits).

Some of the top comments from last week’s vibe check:

💬 Leaning into the broader idea of risk management and speaking to availability as a core tenet (healthcare provider) positions infosec as a better partner than just “threat actors bad.”

💬 “Not through downsizing, but a hiring and pay freeze with increased attrition means our team has gotten a lot smaller. I'm doubtful either AI or outsourcing will be sufficient (or cost-effective) replacements for us, but that's why we simply stopped tracking sufficiency🫤”

💬 The team has stayed the same size, but the pressure of using AI for everything has effectively given us more work with less help.

💰 Market Summary

Private Markets

• 20 companies from 5 countries raised $2.7B across 17 unique product categories

• Average deal size was $170.3M (median: $25.5M)

• 100% of disclosed funding went to product companies

• 8 companies from 3 countries were acquired across 2 unique product categories

• 88% of M&A activity went to service companies

• 1 company announced layoffs

Public Markets

• 3 public cyber companies had an earnings report

As of market close on December 4, 2025.

📸 YoY Snapshot

🎵 One of these [weeks] is not like the other. 🎵 

Not only was last week the highest total for cybersecurity funding in 2025, but it also marked the third straight quarter in 2025 with over $5 billion in cybersecurity funding raised! 🤯 

Not to be outdone, M&A activity surged 20% year-over-year, with 84 acquisitions over the past 13 weeks compared to 70 in the same period last year.

_{Partner With Us}

☎️ Earnings Reports

🧩 Funding By Product Category

• $1.8B for Network Security across 1 deal

• $300.0M for Business Continuity Planning (BCP) / Disaster Recovery across 1 deal

• $160.0M for Web Application and API Protection (WAAP) across 1 deal

• $130.0M for Security Operations across 2 deals

• $105.0M for Application Security Testing (AST) across 1 deal

• $100.0M for Embedded Security across 1 deal

• $60.0M for Threat and Risk Prioritization across 1 deal

• $34.5M for AI Governance across 3 deals

• $28.0M for Deepfake Detection across 1 deal

• $23.0M for Data Protection across 1 deal

• $15.0M for Password Management across 1 deal

• $9.2M for Threat Detection and Response (TDR) across 1 deal

• $8.1M for Attack Surface Management (ASM) across 1 deal

• $2.5M for Confidential Computing across 1 deal

• An undisclosed amount for Managed Security Services Provider (MSSP) across 1 deal

• An undisclosed amount for Identity Verification across 1 deal

• An undisclosed amount for Physical Security across 1 deal

🏢 Funding By Company

Product Companies:

• Check Point Software Technologies, a United States-based suite of network and email security tools, raised a $1.8B Post-IPO Debt from Public Offering. (more)

• Eon, a United States-based cloud data backup and recovery platform, raised a $300.0M Series D from Gil Capital. (more)

• Fastly, a United States-based web application and API protection platform, raised a $160.0M Post-IPO Debt from Public Offering. (more)

• 7AI, a United States-based platform focused on agentic AI-driven security operations tasks, raised a $130.0M Series A from Index Ventures. (more)

• Antithesis, a United States-based application security testing platform, raised a $105.0M Series A from Jane Street Capital. (more)

• Axiado Corporation Inc, a United States-based embedded hardware security platform, raised a $100.0M Series C from Maverick Silicon. (more)

• Zafran Security, a United States-based threat and risk prioritization platform that uses your existing tool stack to show risks and mitigations, raised a $60.0M Series C from Menlo Ventures. (more)

• Imper.AI, a United States-based deepfake and digital impersonation protection platform, raised a $28.0M Seed from Battery Ventures and Redpoint. (more)

• Niobium Microsystems, a United States-based fully homomorphic encryption (FHE) data protection platform, raised a $23.0M Seed from Blockchange Ventures. (more)

• Lumia Security, a United States-based agentic and AI application discovery and governance platform, raised a $18.0M Seed from Team8. (more)

• Multifactor, a United States-based password management platform, raised a $15.0M Seed from Nexus Venture Partners. (more)

• Cognna, a Saudi Arabia-based threat detection and response (TDR) platform, raised a $9.2M Series A from BNVT Capital and Impact46. (more)

• Helmet Security, a United States-based governance and monitoring platform for AI agents and autonomous workflows, raised a $9.0M Seed from SYN Ventures and WhiteRabbit Ventures. (more)

• Saporo, a Switzerland-based attack surface management (ASM) platform, raised a $8.1M Series A from TIIN Capital. (more)

• Alinia AI, a Spain-based generative AI governance, safety, and compliance platform, raised a $7.5M Seed from Mouro Capital. (more)

• Mirror Security, an Ireland-based confidential computing platform for AI applications and data, raised a $2.5M Pre-Seed from Atlantic Bridge and Sure Valley Ventures. (more)

• AnChain.AI, a United States-based security operations platform for Web3 digital assets, raised an undisclosed Series B from Amino Capital, Emmanuel Vallod. (more)

• PopID, a United States-based biometric identity verification platform, raised an undisclosed Corporate Round from NEC Corporation. (more)

• Verkada, a United States-based cloud-based building video and security access management platform, raised an undisclosed Venture Round from CapitalG. (more)

Service Companies:

• Electrosoft, a United States-based managed security services provider (MSSP) to U.S. Federal and Defense agencies, raised an undisclosed Corporate Round from DigitalNet.ai. (more)

🌎 Funding By Country

• $2.7B for the United States across 16 deals

• $9.2M for Saudi Arabia across 1 deal

• $8.1M for Switzerland across 1 deal

• $7.5M for Spain across 1 deal

• $2.5M for Ireland across 1 deal

🤝 Mergers & Acquisitions

Product Companies:

• Veza, a United States-based data protection platform focused on identity and authorization, was acquired by ServiceNow for an undisclosed amount. Veza had previously raised $233.0M in funding. (more)

Service Companies:

• AMR CyberSecurity, a United Kingdom-based professional services firm focused on penetration testing and incident response, was acquired by Infinum for an undisclosed amount. AMR CyberSecurity has not previously disclosed any funding events. (more)

• Aristi, a United Kingdom-based professional services firm focused on penetration testing services, was acquired by Limerston Capital for an undisclosed amount. Aristi has not previously disclosed any funding events. (more)

• Cystemic Security, a United States-based professional services firm focused on security and data analytics consulting, was acquired by Woven Solutions for an undisclosed amount. Cystemic Security has not previously disclosed any funding events. (more)

• Invictus International Consulting, a United States-based professional services firm focused on cybersecurity operations for national defense, was acquired by Red River for an undisclosed amount. Invictus International Consulting has not previously disclosed any funding events. (more)

• Netservices, a United States-based professional services firm focused on IT and security consulting for the U.S. Armed Forces, was acquired by Synergy ECP for an undisclosed amount. Netservices has not previously disclosed any funding events. (more)

• PLEX Solutions, a United States-based professional services firm focused on penetration testing and security operations, was acquired by Markon for an undisclosed amount. PLEX Solutions has not previously disclosed any funding events. (more)

• Redshift, a South Africa-based professional services firm focused on application security and penetration testing, was acquired by Integrity360 for an undisclosed amount. Redshift has not previously disclosed any funding events. (more)

📚 Great Reads

🧪 Labs