Hope you had a great weekend!
Had a ton of stuff going on for me last week. Infosecurity Europe was jam-packed with great conversations, I went to some cool events (even went on a boat!), I did some live product demos with the Signal MCP, and I had the opportunity to give a talk on how the market has been shaping up this year. It’s always fun to talk about the cyber economy with people in person, and I got a lot of positive feedback.
If we just met last week and you just signed up for the newsletter, welcome! 🤝
PARTNER
Are you ready for the AI-attack era?
The economics of offense have shifted. AI-generated exploits are cheap, fast, and undetectable—the attack surface you see isn't the one being targeted.
runZero is built for the AI-attack era. Know every asset, every exposure, and every attack path. Validate your segmentation before the exploit drops. We deliver deep intelligence across IT, OT, IoT, cloud, and mobile, so defenders can win by default. No agents. No authentication. No appliances.
Table of Contents
😎 Vibe Check
Click the options below to vote on whether you are a practitioner, founder, or investor. Feel free to leave a comment, and I'll feature the best takes in next week’s write-up!
When frontier AI companies Anthropic or OpenAI go public via IPO, how do you think public cybersecurity stocks will respond?
Last issue’s vibe check:
By the end of 2026, will AI governance rules actually keep pace with how quickly teams are deploying AI agents?
🟨⬜️⬜️⬜️⬜️⬜️ Yes - the EU AI Act + new SEC rules force it
🟩🟩🟩🟩🟩🟩 No - Agents will keep outrunning the rules
🟨⬜️⬜️⬜️⬜️⬜️ Maybe, but only on paper
🟨🟨🟨⬜️⬜️⬜️ We'll all still be focused on discovery then
Some people had some strong feelings last week about the future of AI Governance! People overwhelmingly voted that agents will continue outrunning the rules we’ve tried to make for them, and that really tells you about the shape (and illusion) of control that is to come.
I talked a bit about why I think this is the case in this Governing the Ungovernable piece. Governing agents will go much the way “zero trust” has. Zero Trust turned out not to be one “thing” or tool, but rather a collection of principles, approaches, guidance, and checks that make up a state you operate against.
Maybe I should make an agent for that? 🤔
Some of the top comments from last week’s vibe check:
💬 “Not a chance in hell that governance rules will be able to keep up with how quickly the ground is shifting beneath us all.”
💬 “It is nearly impossible to have a deterministic agent security product to defend against the lethal trifecta so the only solution is to become behaviour led to solve for security challenges that affect your particular organization.“
🔭 Zooming Out
Stories hidden in the numbers
The AI tide will not lift all boats the same - When a frontier AI model launch tanks half the cyber stocks, but lifts the other half, you know there are no market fundamentals at play. George Kurtz called AI detection "a larger opportunity than EDR" because every employee now runs ~90 agents spread across seven attack surfaces instead of one. The wave is real, but it just doesn't lift the boats with holes in them.
💰 Market Summary
Private Markets
9 companies from 6 countries raised $381.9M across 8 unique categories
Average disclosed deal size was $54.6M (median: $10.0M)
89% of funded companies were product companies
7 companies from 3 countries were acquired across 5 unique categories
57% of acquired companies were service companies
Public Markets
2 pure play cyber public companies had an earnings report - $PANW ( ▼ 2.0% ) and $NTSK ( ▼ 0.57% ), plus 1 hybrid IT/cyber company - $RBRK ( ▼ 2.92% )
📸 YoY Snapshot
Rolling 13-week charts that compare funding and acquisitions week over week, year over year, comparing 2025 to 2026.
Funding volume and dollars picked back up over the last few weeks, but overall funding is still down about 16% YTD compared to the same time last year.
M&A also pumped the brakes a bit over the last few weeks and is down about 7% YTD compared to the same time last year.
PARTNER
How small security teams scale with Claude? Discover insights from a practitioner.
Pragmatic Claude security workflows, plus the live Escape integration
Everyone's talking about Claude in security. Far fewer have made it work in real workflows without burning tokens or breaking process.
Geet Pradhan, a security engineer who spent a year building 0→1 security automations. He covers what actually works in ProdSec, which model to pick, and how to scale without adding headcount.
Then Escape CEO, Tristan Kalos, demos the new Claude × Escape integration live: ASM discovery, AI pentests, and clean remediation, all without leaving the assistant.
🧩 Funding By Product Category
$300.0M for Data Security Posture Management (DSPM) across 1 deal
$29.7M for Threat Intelligence across 1 deal
$23.0M for Identity Governance & Administration (IGA) across 1 deal
$10.0M for Data Loss Prevention (DLP) across 1 deal
$7.0M for Identity and Access Management (IAM) across 2 deals
$7.0M for AI Governance across 1 deal
$5.2M for Threat Modeling across 1 deal
An undisclosed amount for Operational Technology (OT) Security across 1 deal
🏢 Funding By Company
Product Companies:
Cyera, a United States-based data security posture management platform, raised a $300.0M Series G from Evolution Equity Partners. (more) Decacorn Alert 🐉
Opal Security, a United States-based identity and access governance platform, raised a $23.0M Venture Round from Battery Ventures and Greylock. (more)
Archestra.AI, a United Kingdom-based security guardrails platform to preventing agentic AI data leakage, raised a $10.0M Seed from The Twenty Minute VC. (more)
OFFROAD, a United States-based AI agent-driven workflows for identity and access management programs, raised a $7.0M Seed from Ibex Investors and Skywell Capital Partners. (more)
Willow, a United States-based AI governance platform for managing agent identity and runtime behaviors, raised a $7.0M Seed from Hetz Ventures. (more)
Oplane, a Sweden-based automated threat modeling platform, raised a $5.2M Seed from Seed Capital. (more)
SSenStone, a South Korea-based authentication and identity management for industrial control systems, raised an undisclosed Corporate Round from Hyundai Motor Group.
Service Companies:
Innefu, an India-based cyber threat intelligence platform for national security and enterprise companies, raised a $29.7M Series B from Panthera Growth Partners. (more)
SEC filings may reflect partial or interim fundraising and can understate the final round numbers.
🌎 Funding By Country
$337.0M for the United States across 4 deals
$29.7M for India across 1 deal
$10.0M for the United Kingdom across 1 deal
$5.2M for Sweden across 1 deal
An undisclosed amount for Canada across 1 deal
An undisclosed amount for South Korea across 1 deal
🤝 Mergers & Acquisitions
Product Companies:
Phosphorus Cybersecurity, a United States-based embedded operational technology security platform, was acquired by Dragos for an undisclosed amount. Phosphorus Cybersecurity had previously raised $70.0M in funding. (more)
Voidzero, a United States-based open-source JavaScript toolchain platform, was acquired by Cloudflare for an undisclosed amount. Voidzero has not previously disclosed funding. (more)
VoxCroft, a United States-based open-source intelligence (OSINT) and risk analytics firm, was acquired by RedPoint Advisors for an undisclosed amount. VoxCroft has not previously disclosed funding. (more)
Service Companies:
BreakPoint Labs, a United States-based professional services firm focused on penetration testing and vulnerability assessments, was acquired by Valiant Solutions for an undisclosed amount. BreakPoint Labs has not previously disclosed funding. (more)
Business IT Solutions, an Ireland-based managed security services provider, was acquired by Stryve for an undisclosed amount. Business IT Solutions has not previously disclosed funding. (more)
Nethouse, a Sweden-based managed security services provider, was acquired by Nordlo Group for an undisclosed amount. Nethouse has not previously disclosed funding. (more)
Security Vitals, a United States-based professional services firm focused on compliance and risk assessments, was acquired by Brightline Technologies for an undisclosed amount. Security Vitals has not previously disclosed funding. (more)
📚 Great Reads
Open Source Runs the World. It Shouldn’t Run on Goodwill Alone. - Jen Easterly, former head of the US CISA, talks about the fragile and important state of open-source software and its security, and the lack thereof.
Zero Trust for AI Agents - A security framework from Anthropic for deploying autonomous AI agents in the enterprise (PDF).
*A message from our partners
🧪 Labs
The parallels are uncanny!
🫡 Signing Off
Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.
If you find this newsletter useful and know others who would, I'd really appreciate it if you'd forward it to them!
Mike P
P.S. Feel free to connect with me on LinkedIn.