Cybersecurity Funding Tracker (669 deals)

Our funding tracker covering the cybersecurity market

Below is the table listing all the deals. You may find our methodology at the end of this page.

And, if you want to gain a deeper understanding of the market and its current dynamics, get our report covering the Cybersecurity Market.

Is cybersecurity funding really this big right now?

Yes, cybersecurity funding is huge right now, but a typical company operates in a much smaller market than the $25.14 billion headline suggests.

We tracked 671 financings across 554 cybersecurity companies, with 670 disclosed deal values adding up to $25.14 billion. The median round was $15 million. The average was much higher at $37.5 million because the biggest financings pull it upward. An average pulled up by a few huge financings is a poor guide to size, so we build our own estimate from the ground up in our cybersecurity market report.

The gap becomes much clearer when we remove large rounds. Take out financings above $50 million and only $8.70 billion remains. Those large deals represent 14.8% of known-value transactions but absorb 65.4% of the money.

So when people read about billion-dollar investments in Wiz or Keyfactor, $700 million for Saviynt or repeated nine-figure Cyera rounds, they are looking at the top of the market rather than a normal cybersecurity financing.

A recent Crunchbase review of the first half of 2026, using its broader security and privacy categories, reached a different total because its methodology is different from ours. The broad picture was similar, though: cybersecurity was still attracting historically high levels of money, while quarterly totals moved heavily with the presence or absence of very large rounds.

How many cybersecurity companies are actually getting funded?

Cybersecurity funding currently reaches 554 companies, and most of those companies show up only once.

We found 453 companies with one qualifying financing during the period, 89 with two and only 12 with three or more. That puts the repeat-fundraising population at 101 companies, or 18.2% of the market.

Yet those 101 companies received 43.6% of all known capital.

There is a very broad pool of companies that can raise once, followed by a much smaller group that keeps coming back and attracts progressively larger checks.

Some one-round companies will obviously raise again later, while others had already raised before our observation period. Still, repeated access to capital is relatively unusual within the market we can actually see.

Is cybersecurity funding controlled by a few giant companies?

Cybersecurity funding is concentrated around a small upper tier of companies, although no single startup comes close to controlling the whole market.

The ten largest companies account for 32.1% of known capital. The top five account for 21.8%.

Cyera stands out most. We counted five financings totaling $2.14 billion, giving the company 8.5% of all capital in the market on its own. Its later rounds accelerated quickly: $540 million at a $6 billion valuation, another $400 million round, then $600 million at a $12 billion valuation.

The latest Cyera financing also shows what these enormous checks are buying. The company said it had shipped more than 100 new product capabilities over the previous year across data security, privacy, identity, DLP and agentic security, while completing several acquisitions and expanding internationally.

Other companies reach serious scale in very different parts of cybersecurity. Keyfactor attracted more than $1 billion around machine identity and cryptographic infrastructure. Saviynt raised $700 million around identity security. Armis closed a $435 million pre-IPO round after passing $300 million in ARR. Exein has now accumulated $485 million across four financings in our window.

Large-round concentration is spread across a group of scale-ups rather than resting on one extraordinary company.

Company	Qualifying financings	Capital in our window
Cyera	5	$2.14B
Keyfactor	1	$1.00B
Wiz	1	$1.00B
Saviynt	1	$700M
Upwind	3	$650M
Armis	2	$635M
ReliaQuest	1	$500M
Chainguard	2	$496M
Exein	4	$485M
Kiteworks	1	$456M

Where is the money actually going in cybersecurity?

Most cybersecurity deals happen below $50 million, while most cybersecurity dollars are invested above that level.

The busiest part of the market sits between $5 million and $20 million, where we counted 278 financings. Another 157 deals fall between $20 million and $50 million. Together, those two ranges account for almost two-thirds of known-value transactions.

The economics change completely at the top. We found 60 rounds of $100 million or more. They represent only 9% of known-value deals yet account for $13.83 billion, or 55% of all capital.

Even the smallest end is surprisingly active. There are 122 rounds below $5 million. They represent 18.2% of deals but only 1.2% of the money.

That leaves two very different cybersecurity funding markets running at once. Hundreds of companies raise ordinary venture rounds in the single-digit or low-double-digit millions, while a smaller group of proven companies can raise hundreds of millions at a time.

Recent deals make the split easy to see. ReliaQuest raised more than $500 million to expand its AI-powered security operations business. Armis raised $435 million at a $6.1 billion valuation. At the other end, new cybersecurity companies continue to enter through Seed and early Series A rounds every month.

Which parts of cybersecurity are getting the biggest checks?

Cloud Security currently gets the biggest checks relative to its deal count, while Application Security has by far the largest number of funded experiments.

Cloud Security generated $5.12 billion from only 72 deals. Application Security reached almost the same amount, $4.98 billion, but needed 202 financings to get there.

Endpoint Security is another category worth watching. It has only 58 deals, the fewest of the six categories, yet its median financing is $25.5 million, the highest category median we measured. Which startups lead each security category is shown on the market grids in our market report about cybersecurity.

Managed Security Services sits at the other end of the spectrum. We found 131 financings but a median of $11 million. Investors fund a lot of companies there without routinely writing Cloud Security-sized checks.

No category gets much more than one-fifth of total capital. Cybersecurity has several large funding markets sitting beside each other rather than one category swallowing the whole sector.

Category	Deals	Capital	Capital share	Median round
Cloud Security	72	$5.12B	20.4%	$20.0M
Application Security	202	$4.98B	19.8%	$11.8M
Network Security	96	$4.30B	17.1%	$14.5M
Identity Security	112	$4.25B	16.9%	$16.0M
Managed Security Services	131	$3.72B	14.8%	$11.0M
Endpoint Security	58	$2.78B	11.0%	$25.5M
Overall market	671	$25.14B	100%	$15.0M

Why is Cloud Security pulling in so much money?

Cloud Security is pulling in unusually large checks because investors are backing platforms that can secure huge parts of enterprise infrastructure rather than one narrow security task.

Cloud Security represents only 10.7% of our deals but 20.4% of the money. Its capital share is almost twice its deal share.

Wiz is the obvious example, but Wiz alone does not explain the result. Its $1 billion financing represents roughly one-fifth of all Cloud Security capital in our dataset. Most of the category's money therefore sits elsewhere.

Upwind is another good example. It went from a $100 million Series A to a $250 million Series B as it expanded a runtime-focused cloud security platform. Across the full period, we counted $650 million of financing for Upwind.

The strongest external validation came from Google. Wiz raised $1 billion at a $12 billion valuation in 2024, then Google agreed to buy the company for $32 billion and later completed the acquisition. Google explicitly tied the deal to cloud security, multicloud environments and AI workloads.

The commercial case has held up since the deal closed. In Alphabet's first-quarter 2026 remarks, Sundar Pichai said Wiz was performing above Google's expectations and pointed to strong customer interest in cybersecurity and AI products.

A successful platform can potentially become part of the core security layer across AWS, Azure, Google Cloud and the growing number of AI workloads running on top of them. That is a very large prize, and investors are pricing some Cloud Security companies accordingly.

Is Application Security where investors are placing the most early bets?

Application Security is currently the biggest experimentation zone in cybersecurity, with far more funded companies than any other category.

We counted 202 financings across 171 Application Security companies. Ninety-eight of those deals are Seed rounds, and the median company is only two years old when it raises.

The typical check remains fairly modest by cybersecurity standards at $11.8 million. Application Security generates 30% of deals but 19.8% of capital.

Even Chainguard's $356 million Series D, the category's largest financing in our dataset, contributes only around 7% of Application Security capital. The money is spread across a large number of companies rather than dominated by one breakout round.

AI is adding another wave of formation. Crunchbase recently counted more than 150 Seed financings during 2026 for companies at the intersection of AI and security, totaling around $855 million. Its definition is broader than our Application Security category, but the direction matches what we see: investors are funding lots of young teams trying to solve newly created security problems.

These bets cover secure software supply chains, AI application security, model and agent security, code security, API security and runtime protection. Nobody knows yet which of those subcategories will produce the next Wiz-sized company. That's part of why so many early bets are being made.

How old are cybersecurity companies when big funding arrives?

Large cybersecurity checks usually arrive several years after the company is founded, even though investors are willing to fund new companies very early.

The median company in our age-covered sample was three years old when it raised. Seed companies had a median age of one year, Series A companies three years, Series B companies five years and Series C companies six years.

Companies raising more than $50 million were typically five years old. Companies raising less than $5 million were around two years old.

Different parts of cybersecurity mature at different speeds. Application Security companies had a median age of two years when they raised. Cloud Security came in at 2.5 years. Network Security was much older at five years.

That gap makes commercial sense. A young application-security company can launch around a newly emerging software problem quite quickly. Network and infrastructure companies usually have to prove integrations, reliability, enterprise sales and deployment across much more complex environments before investors finance them at scale.

Founding-date coverage is lower than the rest of the database, at 80.5% of deal rows, so tiny differences between categories should not be over-read. The broader progression from very young Seed companies to five-to-eight-year-old scale businesses is much more robust.

Why do so few cybersecurity companies make it to Series C?

Cybersecurity funding thins out hardest between Series B and Series C: we found 87 Series B rounds and only 31 Series C rounds.

There is plenty of activity at the start. We counted 256 known-value Seed financings and 184 Series A rounds. The population then falls by more than half from A to B, before shrinking by almost another two-thirds from B to C.

At the same time, the required checks get much larger. The median financing moves from $18.2 million at Series A to $40 million at Series B and $70 million at Series C. Startups that stall before the bigger checks arrive often share the same traits, which we study in our report covering the cybersecurity market.

Series B therefore looks like an important test. A company reaching that point has already persuaded investors to write a substantial check. Getting the next one appears to require a much smaller set of businesses with convincing enterprise traction and a credible path toward becoming a category-scale company.

Interestingly, the funnel stops narrowing once companies get through that stage. We found 31 Series C rounds and 30 Series D+ rounds. The median D+ financing then jumps to $145 million.

Cybersecurity has a wide startup funnel and a fairly exclusive scale-up club. The toughest visible filter sits between those two worlds.

Stage	Known-value deals	Capital	Capital share	Median round
Seed	256	$2.19B	8.7%	$6.0M
Series A	184	$4.27B	17.0%	$18.2M
Series B	87	$5.08B	20.2%	$40.0M
Series C	31	$3.05B	12.1%	$70.0M
Series D+	30	$6.56B	26.1%	$145.0M
Growth Equity	30	$3.40B	13.5%	$25.0M
Unknown stage	52	$590M	2.3%	$7.0M

Are investors still funding brand-new cybersecurity startups?

Yes, investors are still funding brand-new cybersecurity companies in large numbers, but those first checks account for surprisingly little of the money.

We classified 224 financings as a company's first external financing. That is one-third of all deals, and roughly 40% of the 554 companies entered our dataset through a first financing.

The median first financing was $6.45 million.

Follow-on rounds had a $23 million median and collectively attracted $22.95 billion. First financings received only about $2.14 billion.

New-company formation is alive and well these days. What changes after that first round is how selective investors become about committing serious scale capital.

The recent rise of AI security makes this especially visible. New companies are still being created around agent security, data protection, machine identity and AI application security, while much larger checks are going to businesses that have already proven they can turn those problems into enterprise revenue.

Which investors keep showing up in cybersecurity?

Cybersecurity has hundreds of investors, but a fairly small group keeps leading deals again and again.

We found 449 distinct disclosed lead-investor names. Ninety-nine appear more than once, and recurring leads are involved in more than half of the financings where a lead investor is publicly known.

Accel tops the deal count with 17 led or co-led rounds. Evolution Equity Partners and Ballistic Ventures each appear 13 times, while Bessemer, Sequoia and SYN Ventures each appear 12 times.

The group mixes specialist security investors with large generalist funds. The same ecosystem can finance a young security startup and, several years later, participate in a much larger growth round.

Lightspeed is a good example of the scale involved. The eight rounds it led or co-led in our dataset have a combined transaction value of roughly $1.95 billion. Andreessen Horowitz appears in ten rounds totaling about $1.22 billion.

Those figures are the full sizes of the rounds they led or co-led, rather than the amount each investor personally invested.

Lead investor	Led or co-led deals	Combined size of those rounds
Accel	17	$1.25B
Evolution Equity Partners	13	$1.29B
Ballistic Ventures	13	$316.5M
Bessemer Venture Partners	12	$922M
Sequoia Capital	12	$490.6M
SYN Ventures	12	$201M
Andreessen Horowitz	10	$1.22B
Insight Partners	9	$761.9M
Lightspeed Venture Partners	8	$1.95B
Team8	8	$208.5M
Ten Eleven Ventures	8	$112M

Do corporate investors really matter in cybersecurity funding?

Corporate investors matter in cybersecurity, but most deals still get done without them.

We found disclosed strategic investors in 118 of 670 known-value financings, or 17.6%. The median round was $20 million when a strategic participated, compared with $12.55 million when none was disclosed.

Corporates concentrate their attention around areas close to their own infrastructure. Dell Technologies Capital appears nine times, Salesforce Ventures seven, Cisco Investments seven, Microsoft's M12 six, Okta Ventures four and CrowdStrike's Falcon Fund four.

Veza's $108 million Series D illustrates the logic well. Alongside traditional venture investors, the round included Atlassian Ventures, Workday Ventures and Snowflake Ventures. Veza is building identity and access security for human, machine and AI identities, which sits directly beside the platforms those strategic investors operate.

Okta gives us another current example. The company made Okta for AI Agents generally available in 2026, giving AI agents identities that can be discovered, governed and given controlled access to enterprise systems. As autonomous agents become another class of enterprise user, identity security starts touching a much larger part of the software stack.

Strategic participation gives us a useful clue about where large technology companies see security becoming infrastructure, even though traditional venture and growth investors still provide most of the market's capital.

Why do the US and Israel dominate cybersecurity funding?

The US and Israel currently dominate cybersecurity funding so heavily that together they account for roughly 90% of all the capital we tracked.

The United States alone contributes 73.8% of known capital. Israeli-headquartered companies contribute another 16.3%.

North America has 61.5% of deals but 74.9% of capital, so the region wins on both company count and check size. Where the money goes by region, and which companies investors back there, is something we follow in our cybersecurity market report.

Europe looks very different. European companies account for 18.1% of financings yet receive only 7.5% of the money. The median European round is $6.8 million, compared with $16.2 million in North America.

The shortage becomes most visible higher up the ladder. We found only five European financings above $50 million, compared with a much deeper pool in North America and Israel.

Official UK research published in 2026 points to a similar problem on a smaller geographic scale. The UK government's cybersecurity sector analysis said investors continued to see good founder quality and early-stage opportunities but flagged the availability of growth-stage capital as an ongoing concern.

Exein shows that Europe can still produce a very large cyber financing. The Italian company recently raised $270 million at a $1.7 billion valuation to expand its security platform for robots, vehicles, drones and other physical AI systems. Deals of that size remain unusual enough in Europe to stand out immediately.

Is cybersecurity funding still active right now?

Cybersecurity funding is still very active now, with fresh large rounds appearing alongside a steady flow of smaller financings.

Across the completed months in our period, we averaged 20.5 deals per month and had a median of 20. Deal activity therefore looks much steadier than the dollar totals.

The latest deals support that picture. Exein recently announced $270 million in new funding. MIND followed with a $72 million Series B after reporting 17x revenue growth and 8x customer growth over the previous year. MIND had raised its $30 million Series A only a year earlier.

Keyfactor provides another useful scale marker. After receiving more than $1 billion in growth investment, the company recently said it had passed $200 million in annual recurring revenue. That is the kind of commercial scale investors are increasingly willing to finance with very large checks.

The wider market is not moving upward in a straight line. Crunchbase found that cybersecurity and privacy funding declined by around 30% quarter over quarter in Q2 2026 under its broader definition. Even after that decline, first-half funding remained around $10.6 billion and historically strong.

For now, the cleaner reading is that cybersecurity funding remains busy but highly selective. Investors are still creating new companies at the bottom while putting enormous amounts of money behind a relatively small number of businesses that can show real enterprise adoption.

What should we actually take away from cybersecurity funding today?

Cybersecurity is a genuinely large funding market, but founders should pay more attention to the $15 million median round than to the billion-dollar financings that dominate the news.

Company formation is broad. More than 500 cybersecurity companies raised during our period, and new entrants keep appearing. The harder part comes later, when a company has to prove enough commercial scale to move from Series B into the much smaller late-stage group.

Cloud Security and Application Security show two very different ways to build a major funding category. Cloud attracts bigger platform bets. Application Security attracts far more early experiments. Both approaches have produced billions of dollars in financing.

Capital also travels through a fairly narrow geographic and investor network. The US and Israel capture most of the money, while a recurring set of venture firms repeatedly underwrites companies across several stages. Europe has plenty of startup activity but much thinner access to large growth checks.

And the market is still changing quickly. Recent funding around AI data protection, machine identity, AI agents and physical AI suggests that cybersecurity's next large categories are being built while enterprises are still figuring out what their new attack surface actually looks like.