Happy Tuesday, and hope you had a great, long weekend if you got the chance to be off!
Is the cure to burnout getting outside, soaking up the sun at the beach, and having a Guinness whenever possible? I’m no doctor, but yes, yes, it is. 🍺 🌞 I was also doing it for more altruistic reasons:
Your boy is always thinking of the data centers and shareholders. 🙏
Also, the cyber heavyweights struck back again last week with funding and an M&A spree after many weeks of below-normal deal flow, so maybe everyone got the rest they needed.
PARTNER
Always-On Visibility For Security Teams That Can’t Afford Blind Spots
Stay continuously audit-ready, resilient, and ahead of emerging risk.
Today’s threats move faster than manual audits, so you need real-time visibility and automation to keep risk in check.
Drata connects to your tech stack to continuously monitor controls, map to frameworks like SOC 2 and ISO 27001, and surface live risk insights.
With Drata, you streamline evidence collection, reduce manual work, and protect your brand without slowing the business down
Table of Contents
😎 Vibe Check
Click the options below to vote on whether you are a practitioner, founder, or investor. Feel free to leave a comment, and I'll feature the best takes in next week’s write-up!
If you were starting a cybersecurity company today, which category would you pick?
Last issue’s vibe check:
Which cybersecurity category sees the biggest consolidation move before year-end?
🟨🟨🟨🟨⬜️⬜️ Identity
🟨🟨🟨🟨⬜️⬜️ AppSec
🟩🟩🟩🟩🟩🟩 SecOps
🟨⬜️⬜️⬜️⬜️⬜️ Network
🟨🟨⬜️⬜️⬜️⬜️ Data Protection
🟨🟨⬜️⬜️⬜️⬜️ GRC
⬜️⬜️⬜️⬜️⬜️⬜️ Other (leave a comment)
Last week's vibe check landed on identity, AppSec, and SecOps as the top consolidation candidates for year-end.
Those domains are, incidentally, the ones that have absorbed the most VC funding over the last three years and produced the most new market entrants since 2022. The most crowded markets are the ones that need the most correction.
AppSec is the asymmetric case in the group. While identity and SecOps are seeing healthy growth at both Seed and Series A, AppSec's Seed pipeline is contracting, with deal count down 37% YoY. Frontier AI labs are trying to absorb the bottom-of-funnel that AppSec startups used to be built around. There’s an erosion of base-level capabilities happening right in front of us.
What’s also unique is that AppSec is poised to grow even more, as more AI means more software, more vulnerabilities, and more demand for security.
Some of the top comments from last week’s vibe check:
💬 “Data protection needs to start paying off soon. Perhaps consolidation will simplify the category.”
💬 “That first wave of AI SOC players is ripe for acquisition now that the industry has learned a lot more.”
🔭 Zooming Out
Stories hidden in the numbers
Stages Are Being Redefined - Looking at the median round size by stage for the trailing 12 months vs. the prior 12 months, you see some big changes. The median Series A round in cybersecurity is up 32% year-over-year, but the median Series B is flat. The “step-up” from Series A to B has shrunk from 2.5x to 1.9x. A "Series A" in 2026 is sized like a "Series B" was eighteen months ago. The path to “late-stage” or the markers for when an exit is likely are changing beneath our feet and are largely driven by AI exhaust.
💰 Market Summary
Private Markets
14 companies from 6 countries raised $130.0M across 13 unique categories
Average disclosed deal size was $10.8M (median: $3.0M)
93% of funded companies were product companies
8 companies from 5 countries were acquired for $122.9M across 7 unique categories
75% of acquired companies were product companies
Public Markets
1 public company raised $2.6B via Post-IPO Debt
1 public company had an earnings report - $PANW ( ▼ 0.97% )
Palo Alto surpassed a $200 billion market cap, while CrowdStrike surpassed the old Palo Alto market cap of $150+ billion (big things popping)
📸 YoY Snapshot
Rolling 13-week charts that compare funding and acquisitions week over week, year over year, comparing 2025 to 2026.
While the funding chart looks insane, 98% of it is from a public equities sale, but we cover the entire cyber market here, so we heck it, we ball.
M&A tried to get all the transactions in before the long weekend, just like the rest of us. 👀
PARTNER
Ever investigated a "super urgent" finding for it to be nothing?
Real exploitability for vulnerabilities, not theoretical severity scores.
You've spent hours digging into a "critical" CVE only to realize one config setting makes it impossible to exploit in your environment. You should never have had to look at it.
That's true for many of the so-called critical findings, and reachability alone won't catch that. Santiago Castiñeira, Maze's CTO, breaks down why exploitability is the crucial signal and how AI agents check every CVE the way your best security engineer would. Read the breakdown.
🧩 Funding By Product Category
$2.6B for Secure Networking across 1 deal
$60.0M for Software Supply Chain Security across 1 deal
$27.4M for Managed Security Services Provider (MSSP) across 1 deal
$20.0M for Email Security across 1 deal
$8.0M for Data Protection across 1 deal
$3.5M for IT Asset Management (ITAM) across 1 deal
$3.0M for Threat Intelligence across 2 deals
$3.0M for Human Risk Management across 1 deal
$2.2M for Threat & Vulnerability Management (TVM) across 1 deal
$1.5M for Identity and Access Management (IAM) across 1 deal
$1.3M for Security and Compliance Automation across 1 deal
$35.0K for Continuous Automated Red Teaming (CART) across 1 deal
$25.0K for AI Privacy Assurance across 1 deal
An undisclosed amount for Operational Technology (OT) Security across 1 deal
🏢 Funding By Company
Product Companies:
Akamai Technologies, a United States-based secure networking and website security platform, raised a $2.6B Post-IPO Debt from Public Offering. (more)
Socket, a United States-based supply chain software security platform, raised a $60.0M Series C from Thrive Capital. (more) Unicorn Alert 🦄
Ocean, a United States-based email security platform, raised a $20.0M Series A from Lightspeed Venture Partners. (more)
Quantum Bridge, a Canada-based quantum-resistant encryption key distribution and management platform, raised an $8.0M Series A from Primo Capital. (more)
Liongard, a United States-based IT assessment management platform for MSPs and MSSPs, raised a $3.5M Debt Financing. (SEC Filing - may be incomplete)
Cimento, a United States-based human risk management platform, raised a $3.0M Pre-Seed from Bowery Capital and Indie.vc.
Infrawatch, a United Kingdom-based threat intelligence platform tracking attacker infrastructure, raised a $3.0M Pre-Seed from Outward VC and Triple Point Ventures. (more)
Orbik Cybersecurity, a Spain-based automated testing and vulnerability management platform, raised a $2.2M Venture Round from MONDRAGON. (more)
Provision IAM, a United States-based identity and access management (IAM) platform designed for small banks and credit unions, raised a $1.5M Funding Round from Georgia's Own Credit Union. (more)
ComplyDo, a Germany-based security and compliance automation platform, raised a $1.3M Pre-Seed from Y Combinator. (more)
Vulnetic, a United States-based automated penetration testing platform, raised a $35.0K Pre-Seed. (SEC Filing - may be incomplete)
Cequra, a United States-based operational technology security platform focused on securing mobile industrial assets in the maritime industry, raised an undisclosed Venture Round from Motion Ventures. (more)
Ripjar, a United Kingdom-based cyber threat intelligence platform for cybercrime and national defense, raised an undisclosed Private Equity from Long Ridge Equity Partners. (more)
Service Companies:
Cyber Defense Africa, a Togo-based managed security services and consulting provider for African businesses, raised a $27.4M Debt Financing from Bank Gospodarstwa Krajowego.
SEC filings may reflect partial or interim fundraising and can understate the final round numbers.
🌎 Funding By Country
$2.7B for the United States across 9 deals
$27.4M for Togo across 1 deal
$8.0M for Canada across 1 deal
$3.0M for the United Kingdom across 2 deals
$2.2M for Spain across 1 deal
$1.3M for Germany across 1 deal
🤝 Mergers & Acquisitions
Product Companies:
Genie Security, an Israel-based endpoint-based data protection, was acquired by Cyera for $50.0M. Genie Security had previously raised $3.0M in funding. (more)
Deepchecks, an Israel-based evaluation and observability platform for AI models, was acquired by Check Point Software Technologies for an undisclosed amount. Deepchecks had previously raised $14.0M in funding. (more)
Nextron Systems, a Germany-based digital forensics and malware sandboxing platform, was acquired by Eurazeo for an undisclosed amount. Nextron Systems has not previously disclosed funding. (more)
Symmetry Systems, a United States-based data security posture management (DSPM) platform, was acquired by Zscaler for an undisclosed amount. Symmetry Systems had previously raised $75.7M in funding. (more)
Service Companies:
Kernel Advisory, a Canada-based professional services company focused on cybersecurity management, was acquired by AYCE Capital for an undisclosed amount. Kernel Advisory has not previously disclosed funding. (more)
📚 Great Reads
How fast is autonomous AI cyber capability advancing? - The UK's AI Security Institute (AISI) said the length of tasks frontier models can autonomously complete in our narrow cyber suite has been doubling every few months.
Your CEO is suffering from AI psychosis - There’s a critical difference between using agents to accomplish defined objectives and spinning up 20 agents because the dashboard makes you feel like a general commanding an army.
*A message from our partners
🧪 Labs
Maybe the real friends we made were the AI Agents we skaddeled with along the way 🥹
🫡 Signing Off
Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.
If you find this newsletter useful and know others who would, I'd really appreciate it if you'd forward it to them!
Mike P
P.S. Feel free to connect with me on LinkedIn.