This week's issue is backed by ThreatModeler and Maze.
Hope you had a great weekend!
What 👏 a 👏 week 👏 it 👏 has 👏 been 👏 .
Check in on the security homies in your life, because this last week had almost too many security issues to keep up with. And it wasn’t just one or two bad ones, it was several critical, Internet-wide issues that affected so much software.
This can feel like a really chaotic time to be in cybersecurity, but I still think it’s one of the most exciting times I’ve been a part of. There’s no question about the level of awareness and urgency to be very aggressive about security, and this week has shown the world just how important that is now.
If you’re looking for a timeline refresh, I did a bit more data analysis on LinkedIn, this time on how Frontier AI companies, model labs, and AI platforms are making major cyber investments alongside acquisitions.
Many of these were surprising to me, and I didn’t realize how deep it ran until I started digging into the data. I pulled all this data from The Signal's MCP.
What kind of data do you think I should look into next?
We will now resume your regularly scheduled vulnpocalypse. 🫡
PARTNER
Your Threat Modeling Process Wasn’t Built for the AI Era
Meet NexusAI, the next evolution in enterprise threat modeling.
AI is accelerating development, but security knowledge is still trapped in disconnected tools and one-time exercises. NexusAI introduces a smarter approach to threat modeling - one that works alongside development, builds on previous security decisions, and turns every model into reusable intelligence. Join us to see how ThreatModeler is rethinking Secure by design for the AI era.
Table of Contents
😎 Vibe Check
Click the options below to vote on whether you are a practitioner, founder, or investor. Leave a comment, and I'll anonymously feature the best takes in the next issue!
An AI-found PHP flaw sat unfixed since 2024, a PoC video leaked, and a vendor broke the embargo early citing active exploits. Coordinated disclosure in 2026 is:
Last issue’s vibe check:
Which security project always takes twice as long as planned?
🟨🟨⬜️⬜️⬜️⬜️ SOAR automation buildout
🟨⬜️⬜️⬜️⬜️⬜️ Rolling out SSO
🟨⬜️⬜️⬜️⬜️⬜️ Moving to passwordless auth
🟩🟩🟩🟩🟩🟩 Enforcing data classification
🟨⬜️⬜️⬜️⬜️⬜️ AI agent discovery
⬜️⬜️⬜️⬜️⬜️⬜️ Other (tell me)
Well, that wasn’t much of a competition! If you’ve ever felt the pain of using data classifications, let alone planning an enterprise-wide program rollout, you know how tricky this can be.
This is one of the areas I hope we can just abstract away with the use of AI. If we no longer need direct human calls and the manual application of classification labels, we can get more deterministic about the whole thing. In my mind, this is one of the biggest pitfalls of DLP and data classification programs, since each scenario is like a mini investigation.
Some of the top comments from last week’s vibe check:
💬 “Anything IAM. It’s complicated and critical to be done perfectly. Once completed, it’s time to do another update!”
💰 Market Summary
Private Markets
1 other financing transaction announced
11 venture funding rounds announced, totaling $197.6M
6 M&A announcements across 4 countries and 4 categories
67% of M&A announcements were service companies
1 company announced layoffs
Public Markets
No pure-play public cyber company had an earnings report
You know it’s a big week when even Rapid7 gets back to $1bn in market cap
» Trends, year-over-year charts, and every deal live on The Signal →
PARTNER
AI-native AppSec built to keep up with zero-days
Every new zero-day kicks off the same scramble to find the vulnerable package, where it’s used, and what to fix first. With AI finding new vulnerabilities faster than ever, that scramble doesn’t really stop.
We built Maze Code to move just as fast. Our AI agents find vulnerabilities in your code and dependencies, investigate them with context from your environment, and help you fix them. That goes for the next zero-day and the vulnerabilities that have been hiding in your backlog.
🏢 Funding
» Connect Claude, Cursor, or any MCP client to The Signal via the MCP for free. «
BlackWall (formerly BotGuard) (EE) · $100.0M Series C 🦄 | anti-bot and DDoS mitigation platform, led by AVP (more)
Modelyo Technologies (IL) · $17.0M Venture Round | secure SaaS GenAI Adoption, led by OlivTree (more)
Ultra Security (US) · $10.0M Seed | AI agent runtime security platform, led by Ludlow Ventures, Hidden Capital, Entrée Capital, Detroit Venture Partners, firedrop, and Forward Deployed Venture Capital (more)
Asymptote Labs (US) · $5.5M Seed | agent runtime security, led by Tower Research Ventures (more)
SEC filings may reflect partial or interim terms, and the final round numbers can change.
🤝 Mergers & Acquisitions
Business Cyber Security Solutions (US) · cybersecurity assessments and compliance | acquisition by Forte Technologies, undisclosed (more)
Cyberly (PL) · human risk management platform, and OutKept (BE) · anti-phishing platform | acquisitions by Aikido Security, combined into Noon, undisclosed (more)
Nethive (IT) · MSSP focused on threat monitoring and incident response | Bregal Milestone agreed to buy a majority stake, undisclosed (more)
❌ Layoffs
Fireblocks, a security platform for transferring digital assets, confirmed it plans to reduce its global workforce as part of a restructuring. (more)
🧪 Labs
Oh gosh, oh no
📚 Great Reads
Vulnerable U | #191 - My friend Matt Jay does a good overview of many of the big security issues that happened last week.
What vulnerabilities can an attacker exploit? - From a growing backlog to the next zero-day, Maze Code shows you which vulnerabilities in your code and dependencies are exploitable and helps you fix them.*
Security in the AI-Native SDLC - Marco Lancini talks about how we need to throw away the current SDLC playbook in the AI-Native age of software development.
*Sponsored
🫡 Signing Off
Have questions, comments, or feedback? Just reply back and let me know.
If you find this newsletter useful and know others who would, I'd really appreciate it if you'd forward it to them!
Mike P
P.S. Feel free to connect with me on LinkedIn.