Cybersecurity Funding: A Quarter-by-Quarter Analysis

All funding deals in the cybersecurity market over the last years

Below is the table listing all the deals. You can find our methodology at the end of this page.

If you want a deeper understanding of the market and its current dynamics, get our report covering the Cybersecurity Market.

Is cybersecurity funding actually slowing down now?

Cybersecurity funding is currently slowing down, and Q2 2026 is the clearest broad pullback we found across the five quarters we studied.

The path to that slowdown was anything but smooth. Funding started with a large-round-heavy Q2 2025, fell sharply in Q3, spread across many more companies in Q4, then moved toward much bigger mid-sized rounds in Q1 2026. Q2 2026 reversed that last move: fewer deals closed, the typical round got much smaller, and money shifted back toward younger companies.

Looking at total dollars alone misses most of that story. Once we separate giant rounds from the rest of the market, Q1 2026 stands out as the strongest quarter, while Q2 2026 looks weaker across almost every measure.

Quarter	Deals	Capital	Capital excluding >$50M	Median round
Q2 2025	58	$2,839M	$777M	$16.5M
Q3 2025	45	$1,083M	$657M	$13.8M
Q4 2025	96	$3,375M	$1,112M	$15.0M
Q1 2026	74	$3,203M	$1,280M	$25.0M
Q2 2026	53	$1,962M	$598M	$13.0M

Was Q2 2025 really a cybersecurity boom, or did a few giant rounds inflate it?

Q2 2025 cybersecurity funding was a large-round quarter more than a broad-based boom.

The market raised about $2.84 billion, but 72.6% of that money came from rounds above $50 million. Cyera alone raised $540 million, while Cato Networks and Chainguard added another $359 million and $356 million. The five largest financings absorbed 53.6% of all capital.

Once those large rounds are stripped out, only $777 million remains. That was a healthy amount, but Q4 2025 and Q1 2026 would later produce substantially more capital from the rest of the market.

The company stories also show why investors were comfortable writing such large checks. Cyera said its customer base had doubled in six months when it announced the $540 million Series E. Chainguard said annual recurring revenue had grown to $40 million and expected to exceed $100 million before the end of its following fiscal year. Cato's $359 million round pushed its valuation above $4.8 billion.

These were already scaling businesses receiving large follow-on bets. Q2 tells us more about investor conviction in a handful of established winners than about every cybersecurity startup suddenly finding money easily.

Company	Round	Category	Stage
Cyera	$540M	Cloud Security	Series D+
Cato Networks	$359M	Network Security	Series D+
Chainguard	$356M	Application Security	Series D+
Tailscale	$160M	Network Security	Series C
Veza	$108M	Identity Security	Series D+
Cyberhaven	$100M	Endpoint Security	Series D+
Horizon3.ai	$100M	Application Security	Series D+

Why did cybersecurity funding drop so hard in Q3 2025?

Q3 2025 cybersecurity funding looked brutal in headline dollars, but the core market only softened.

Total capital fell 61.9% from Q2, while the number of deals fell 22.4%. Once rounds above $50 million are removed, the drop shrinks to about 15.5%.

The missing ingredient was giant rounds. Q3's largest financing was HeroDevs at $125 million, followed by Noma Security at $100 million. Compare that with the previous quarter, when Cyera, Cato Networks and Chainguard alone had raised more than $1.25 billion.

Money also moved down the maturity curve. First financings rose from 20.7% of Q2 deals to 40.0% in Q3, while Seed and Series A together increased from 58.6% to 71.1%.

That made Q3 a much smaller funding quarter without turning it into a dead market. Investors were still starting companies and funding early rounds; they simply wrote far fewer enormous checks to mature cybersecurity businesses.

Did cybersecurity funding really take off in Q4 2025?

Q4 2025 was the broadest cybersecurity funding expansion in the entire period we studied.

Deal count jumped 113% from Q3, reaching 96 financings, while capital rose 212%. Even after removing rounds above $50 million, funding still increased 69%.

The expansion reached both ends of the market. Deals below $5 million went from 6.7% of Q3 activity to 22.9% in Q4, while seven rounds reached at least $100 million. That combination is unusual: more tiny rounds, more mid-sized rounds and several huge rounds all arrived at the same time.

Saviynt's $700 million financing was the largest. Armis added $435 million after reporting more than $300 million in annual recurring revenue and growth above 50%. Yet those two transactions cannot explain a doubling in deal count by themselves.

Q4 was the point when cybersecurity funding really spread out. More startups were raising, more categories were active and large late-stage checks returned at the same time.

Why did Q1 2026 look stronger even with fewer cybersecurity deals?

Q1 2026 cybersecurity funding was the strongest quarter beneath the headline because investors suddenly wrote far more $20 million to $50 million checks.

Deal count fell from 96 to 74, yet capital barely moved. More importantly, funding excluding rounds above $50 million reached $1.28 billion, the highest level in our five-quarter period.

The median round jumped to $25 million. Nearly four out of ten financings landed between $20 million and $50 million, compared with less than one quarter of deals in Q4.

Large individual rounds were still there. Cyera raised another $400 million, TENEX.AI raised $250 million, Upwind raised $250 million, Claroty raised $150 million, Torq raised $140 million and XBOW raised $120 million. But Q1 did not depend heavily on one of them: the five largest rounds represented only 37.2% of total capital, the lowest concentration outside Q3.

Q1 was the quarter where financing looked easiest for companies that had moved beyond the earliest stage but had not yet become giant late-stage winners. That middle of the market would shrink dramatically three months later.

Is the Q2 2026 cybersecurity slowdown actually real?

Yes. Q2 2026 cybersecurity funding is currently showing a much broader slowdown than the apparent crash we saw in Q3 2025.

Deal count fell 28.4% from Q1, capital fell 38.8%, and the median round was almost cut in half. Funding excluding rounds above $50 million dropped even faster, falling 53.3% to $598 million.

Cyera's $600 million round softened the headline decline. The deal alone represented 30.6% of all capital for the quarter, while the three largest financings absorbed just over half of the total.

The latest external check points in the same direction. Crunchbase's July 2026 review of its broader security and privacy universe found that Q2 funding was down roughly 30% from Q1 and that round count fell by a similar amount. Its market definition is broader than ours, so we do not mix the funding totals, but the direction is remarkably similar.

Q2 2026 looks like a genuine market pullback. Smaller rounds, fewer deals and a collapse in non-megaround capital all happened together.

Are cybersecurity investors moving back to younger startups?

Cybersecurity investors moved sharply back toward young companies in Q2 2026, while the scaling rounds that defined Q1 became much harder to find.

Seed and Series A accounted for 40 of the quarter's 53 financings. First financings held steady at 21 even though the market lost 21 deals overall from Q1. Investors kept forming and backing new cybersecurity companies while cutting much deeper into later-stage activity.

The squeeze is easiest to see around the $20 million to $50 million range. That bucket had dominated Q1 but fell to 17% of deals in Q2. Later-stage transactions also dropped to 15.1% of the market.

Company age points the same way. The median funded company was around one year old in Q2, compared with three years in Q1. We have less confidence in that particular measure because founding-year coverage was only 73.6% in Q2 and was weaker in the two previous quarters. Stage, round size and first-financing activity are much cleaner evidence.

Measure	Q1 2026	Q2 2026	Change
Total deals	74	53	Down
Seed + Series A share	59.5%	75.5%	Strongly up
Later-stage share	33.8%	15.1%	Strongly down
$20M–$50M share	39.2%	17.0%	Strongly down
First financings	21	21	Flat
Median round	$25M	$13M	Down
Median company age	3 years	1 year	Younger

Is Application Security the hottest cybersecurity funding category right now?

Application Security currently has the clearest breadth story in cybersecurity funding.

Its share of deals climbed from roughly one quarter of the market in Q4 2025 to almost two fifths by Q2 2026. Capital did not rise nearly as fast, which is useful here: the category's growth cannot be explained by one enormous round.

The companies being funded also cover several parts of the software-security stack. Chainguard has been scaling secure open-source infrastructure, XBOW raised $120 million around autonomous penetration testing, and Socket raised $60 million as AI-generated software increased the amount of third-party code entering production.

That cluster fits what developers are dealing with these days. AI is helping companies produce more software faster, while application, dependency and software-supply-chain security have to keep up.

Among the major categories we tracked, Application Security currently has the strongest combination of rising deal frequency and relatively broad participation.

Category	Q4 2025 deal share	Q1 2026 deal share	Q2 2026 deal share	Q2 2026 capital share
Application Security	24.0%	35.1%	39.6%	23.6%
Managed Security Services	18.8%	18.9%	22.6%	30.0%
Identity Security	21.9%	13.5%	17.0%	7.0%
Network Security	20.8%	9.5%	9.4%	1.4%
Cloud Security	7.3%	14.9%	7.5%	32.5%
Endpoint Security	7.3%	8.1%	3.8%	5.4%

Is Cloud Security really booming, or is Cyera doing most of the work?

Cloud Security is drawing huge checks today, but only a small number of companies are creating that apparent boom.

Cloud Security represented just 7.5% of Q2 deals while absorbing 32.5% of all capital. Put another way, its share of funding was about 4.3 times its share of transactions.

Cyera is the obvious reason. As seen above, the company raised $600 million in Q2 after raising another $400 million in Q1. That is $1 billion in six months from one company. Upwind's $250 million Series B in Q1 added another very large cloud-security financing.

There is genuine commercial momentum behind those rounds. Cyera says enterprises are struggling to control the sensitive data used by AI systems and agents, while Upwind argues that cloud security increasingly needs runtime context because both infrastructure and attacks are becoming more dynamic.

Investor conviction in Cloud Security is very strong at the top. We just have much less evidence that the category is expanding across dozens of funded companies in the way Application Security is.

Is Managed Security Services quietly becoming a bigger funding theme?

Managed Security Services has lately become one of the more convincing cybersecurity funding trends because both deal activity and capital have moved higher.

The category's share of capital went from 11.4% in Q4 2025 to 22.9% in Q1 2026 and 30.0% in Q2. Deal activity has also moved upward rather than relying entirely on a handful of giant checks.

Several financings show what investors are chasing. TENEX.AI raised $250 million for an AI-native managed detection and response model. Torq raised $140 million around an agentic security-operations platform. Dream raised $260 million while expanding AI-driven cyber defense for governments and critical infrastructure.

Customer spending offers another clue. ENISA's latest NIS Investments work found that European organizations were increasingly directing cybersecurity budgets toward technology and outsourcing instead of expanding internal security teams. Skills shortages remain a major constraint.

That environment suits companies promising to combine software, automation and specialist security operations. Managed Security Services now looks like more than a one-quarter funding spike.

What happened to Identity Security and Network Security funding?

Identity Security funding cooled quickly after one giant quarter, while Network Security has suffered a more persistent drop in check size.

Identity Security captured 31.5% of all capital in Q4 2025, helped enormously by Saviynt's $700 million financing. Its share then fell to 11.6% in Q1 2026 and 7.0% in Q2.

The commercial case around identity is still very much alive. Saviynt's financing announcement focused heavily on securing human identities, machine identities and AI agents. The World Economic Forum has also highlighted the growing credential and permission problems created by agentic AI. Funding simply stopped arriving at the extraordinary Q4 pace.

Network Security has had a rougher sequence. Capital share went from 27.7% in Q4 to 10.7% in Q1 and only 1.4% in Q2. Deals still represented 9.4% of the market in Q2, so companies continued to raise; the checks became much smaller.

The two categories ended up in different places. Identity remains active after a temporary funding peak, while Network Security has now seen two consecutive quarters of shrinking capital weight.

Is Europe actually catching up in cybersecurity funding?

European cybersecurity startups are catching up in deal count, but the biggest checks still lean heavily toward North America.

Europe accounted for 28.3% of Q2 2026 financings, up from only 8.5% in Q2 2025. That is a meaningful expansion in the number of European companies getting funded.

The money tells a different story. Europe received only 7.6% of Q2 capital, and its median round was $8 million. North America produced 47.2% of deals but collected 69.5% of the capital.

The Middle East has also become a recurring part of the market rather than appearing for one quarter. Its share of deals ranged from roughly 10% to 29% across the period.

As of now, Europe looks increasingly important for startup formation and smaller rounds. North America still has far more depth when companies need very large amounts of capital.

Who is actually writing cybersecurity checks now: the same VCs or more corporate investors?

Cybersecurity funding is still led by a broad group of venture investors, while corporate and strategic investors have quietly become less common.

Accel led or co-led nine deals across our period. Ballistic Ventures and Bessemer Venture Partners appeared seven times each, Team8 and Insight Partners six times each, while Andreessen Horowitz, SYN Ventures and Battery Ventures each appeared five times.

That recurring group never turned into a closed club. We counted 61 distinct lead investors in Q2 2025, 49 in Q3, 91 in Q4, 74 in Q1 2026 and 54 in Q2. Those changes mostly follow overall deal volume. In the latest quarter, no lead investor appeared on more than two deals.

Corporate participation moved more clearly downward. Strategic investors appeared in 27.6% of Q2 2025 financings and only 13.2% in Q2 2026. The median strategic-backed round also dropped to $8 million in the latest quarter.

Corporate investors are still showing up, especially around technologies adjacent to their own platforms, but they are not taking over cybersecurity venture funding. Traditional venture funds remain much more visible across the market.

What is driving cybersecurity funding today: AI, regulation, or venture-market conditions?

Cybersecurity funding today is being pulled by strong AI-security demand and regulatory pressure, while venture-market conditions decide how much of that demand turns into large funding rounds.

AI is the freshest and strongest commercial theme. The World Economic Forum's 2026 Global Cybersecurity Outlook found that 94% of surveyed respondents expected AI to be the most significant force changing cybersecurity over the coming year. The share of organizations assessing the security of their AI tools had also climbed from 37% to 64%.

The funding announcements line up with that shift. Cyera is selling data governance for enterprise AI. Saviynt is focusing on identities created by people, machines and AI agents. Torq is rebuilding security operations around agents. XBOW is automating offensive-security testing. Socket is securing software supply chains as AI produces more code.

Regulation and staffing pressure add another layer. ENISA found cybersecurity spending holding around 9% of IT budgets among the European organizations it surveyed, with compliance remaining a major investment driver. Its more recent NIS360 work also found cybersecurity legislation contributing to stronger security maturity across several critical sectors.

Those demand drivers move much more smoothly than quarterly venture totals. The violent jumps in our funding series mostly come from the financing side: how many companies reach a scale where investors are willing to write $50 million, $100 million or $500 million checks in the same three-month period.

That is why the funding chart can swing dramatically even while customer demand keeps growing. Right now, AI, data, identity and outsourced security operations remain strong commercial themes; the financing market is simply much less consistent.

What is the funding trend actually telling us?

Cybersecurity funding today looks healthy at the company-formation level but much tighter once startups need serious scaling capital.

Q4 2025 showed that the market can still expand across almost every deal size at once. Q1 2026 then showed how strong funding can become when the $20 million to $50 million range opens up. The sharp reversal in Q2 tells us that this middle layer is currently the least dependable part of the market.

Application Security has the clearest breadth today. Managed Security Services is also building momentum across both deals and capital. Cloud Security attracts extraordinary amounts of money, though much of that concentration comes from a handful of companies.

The market is also getting younger again. Seed and Series A activity held up much better than later-stage funding during the latest slowdown, and new companies continued to receive first financings.

Lead investors remain diverse. Corporate participation is fading rather than expanding, while recurring cybersecurity funds continue to rotate through deals without any one firm controlling the market.

As seen above, giant rounds can still distort a quarter dramatically. The biggest mistake would be to read every jump in cybersecurity dollars as broad acceleration or every drop as collapsing demand. Right now, investors are still willing to fund new cybersecurity ideas and back a few exceptional winners very aggressively. The harder part is getting everyone in between funded at scale.