This week's issue is backed by Speakeasy.
Hope you had a great weekend!
I’ve been thinking a lot about the Buy vs. Build debate recently and how it’s been changing with AI.
I think we’re now well past the point in the cyber industry where we can say, "Let’s just build it with AI.” Like, “let’s just build our own EDR replacement. One, that’s just not realistic, and two, never roll your own CrowdStrike. But three, I think we’re also not purely in the “just buy it” category anymore either, whether that’s a point tool or a platform. There’s really more nuance to it these days.
No, I think we are squarely in the “Stitch It Together” era. To me, that means teams will have to get more comfortable building scaffolding and connective tissue with AI in between both paid and open-source systems. This also means we’ll still have to buy lots of products and services to meet our needs. We’ll just be able to make them work together in ways that weren’t possible before, given how good AI has gotten. It’s living in two worlds at the same time, something that typically only the 0.001% of security teams at large tech companies could pull off. The new way forward is to buy, build, and stitch. That’s what I call the Stitch It Together era.
It’s good to see the industry has matured a bit and moved past the immature thinking that AI alone can just do it all for us directly. Along with that maturity comes realizing that just because you can do something with AI doesn’t mean you should.
What’s your experience with this?
In other news, if you’ve been reading this newsletter for a bit, you might notice that it’s a little more streamlined today. If you’re new here, welcome, and this is the new format I’m trying out. For the OGs who have been here a long time, you’ve been through many of these iterations with me, and I appreciate you sticking around!
I think an update was long overdue. Change can be a freeing thing sometimes. It can also drive you crazy, and you may want nothing more than to go back to the olden days. I still want the quality to be extremely high, and sometimes that requires shaking things up.
Either way, I’d love to know how you feel about the new format, so just reply and tell me off let me know what you think!
PARTNER
How MoonPay brought its AI sprawl under control
MoonPay moves money for over 30 million people, so one errant agent could do real harm. When its AI outgrew browser-level controls, employees were connecting agents to internal systems through MCP, invisible to any browser tool.
The Speakeasy AI control plane surfaced shadow AI and made every agentic action authenticated, auditable, and security-compliant. After a 30-day proof of concept, Speakeasy now governs MoonPay's 200+ MCP servers and 60,000+ agent sessions.
Table of Contents
😎 Vibe Check
Click the options below to vote on whether you are a practitioner, founder, or investor. Leave a comment, and I'll anonymously feature the best takes in the next issue!
Which security acronym/phrases deserves to be retired?
Last issue’s vibe check:
What is the security industry's most expensive habit?
🟩🟩🟩🟩🟩🟩 Trying to reinvent itself every few years
🟨🟨🟨⬜️⬜️⬜️ Creating new compliance frameworks
🟨⬜️⬜️⬜️⬜️⬜️ Spreadsheets
🟨🟨⬜️⬜️⬜️⬜️ Focusing more on offense than defense
⬜️⬜️⬜️⬜️⬜️⬜️ Other (tell me)
The more things change, the more they remain the same? It would seem that way when it comes to the cyber industry. The cyber industry often finds itself stuck between what can make it money and what can’t be stopped, only stemmed.
One I didn’t put on the options, and one I didn’t see in the comments, is mistaking talking about action for taking action. It will look different for every company out there, but it’s easy to get lost in talking about something and trying to find the best possible outcomes on paper instead of doing something tangible now. Don’t get me wrong, I’m all for strategy and planning, but some people have made careers out of planning and not doing.
I’m more surprised that new compliance frameworks beat out spreadsheets, since they go hand in hand. ¯\_(ツ)_/¯
Some of the top comments from last week’s vibe check:
💬 “I understand wanting to increase profits, but the end-user experiences vacillating between investment and (which can often include vulnerability and patch response times) on the vendor's part means you either have to do the expensive parts of keeping in-house talent or switching vendors semi-frequently... Otherwise, it's the "passing-the-buck" — outsourcing/contracting out, though that's where who bears the expenses ends up being more of a political (government or intraoffice) decision”
💬 “Who even says security is reinventing itself every few years? I feel as an industry we are stuck in 2010 on so many levels. So maybe it tried, but did it even succeed?”
💰 Market Summary
Private Markets
7 companies from 4 countries raised $87.7M across 6 unique categories
Average deal size was $12.5M (median: $4.5M)
89% of disclosed funding was for product companies
6 companies from 3 countries were acquired across 5 unique categories
M&A activity was evenly split between product and service companies
Public Markets
1 public company raised $1.4M via Post-IPO Debt
1 acquisition was made by a public company
No pure-play public cyber company had an earnings report
» Trends, year-over-year charts, and every deal live on The Signal →
🏢 Funding
» Connect Claude, Cursor, or any MCP client to The Signal via the MCP for free. «
Rein Security (IL) · $25.0M Series A | runtime application security monitoring, led by Glilot Capital Partners and Sienna Venture Capital (more)
Netsec (formerly Barbican SAS) (FR) · $10.0M Venture Round | MSSP with integrated IT operations, led by Partech (more)
Fleuret AI (FR) · $4.5M Pre-Seed | autonomous AI penetration testing platform, led by RAISE Ventures (more)
Right-Hand Cybersecurity (US) · $3.0M Venture Round | security awareness training platform, investors undisclosed (SEC Filing)
authID (US) · $1.4M Post-IPO Debt | identity and authentication as a service platform, led by Undisclosed Qualified Institutional Buyers (SEC Filing)
Guardrail Technologies Inc. (US) · $1.0M Seed | application security scanning platform, led by Filter Fund VC (more)
SEC filings may reflect partial or interim terms, and the final round numbers can change.
🤝 Mergers & Acquisitions
Product Companies:
cloudsineAI (SG) · acquired by V-Key, undisclosed | AI agent monitoring and governance platform (more)
Information Security Corporation (US) · acquired by SAIC, undisclosed | PKI and encryption software (more)
Service Companies:
BC Technologies (GB) · acquired by Business iT Specialists, undisclosed | MSSP (more)
Digital Back Office (US) · acquired by Acture Solutions, undisclosed | MSSP (more)
Optimize365 (US) · acquired by CyberFOX, undisclosed | posture management for Microsoft 365 for MSPs (more)
🧪 Labs
Some say I’m your agent’s favorite source
📚 Great Reads
The AI Security Market Moves to the Endpoint - My friends James Berthoty and Chris Hughe talk about how innovation is back at the endpoint, and so are the new security demands it brings.
Before You Hang Up - I sat down with Rob Smith to talk about how the foundational problem a company is solving is more important than what happened in the news that week, how PR firms can use data better, and more.
*Sponsored
🫡 Signing Off
Have questions, comments, or feedback? Just reply back and let me know.
If you find this newsletter useful and know others who would, I'd really appreciate it if you'd forward it to them!
Mike P
P.S. Feel free to connect with me on LinkedIn.