Cybersecurity: what are the top startups now?

Why are the biggest cybersecurity startups changing so quickly?

The cybersecurity startup rankings have changed dramatically because several former leaders have been acquired, while newer companies are growing quickly in data security, AI protection, and automated threat detection.

Google completed its $32 billion acquisition of Wiz in March 2026, after the cloud-security company reportedly surpassed $1 billion in annual recurring revenue (ARR) in 2025. ServiceNow completed its approximately $7.75 billion acquisition of Armis in April 2026, and Netskope went public in September 2025. Three companies that would previously have appeared near the top of a private cybersecurity ranking have therefore left the category.

The next group is already attracting extraordinary amounts of money. Cyera raised $600 million at a $12 billion valuation in June 2026, followed by a $400 million financing extension reported by CTech in September. Island raised another $400 million at a $6.4 billion valuation, while Cato Networks reported more than $350 million in annual recurring revenue.

These companies are taking different approaches. Cyera protects sensitive corporate data, Island secures work performed through enterprise applications, and Cato combines networking with security. Their growing size suggests that cybersecurity spending is spreading across several categories, rather than producing one obvious successor to Wiz.

What makes a cybersecurity startup one of the best right now?

The best cybersecurity startups today have substantial paying customers, fast-growing revenue, and products that could support much larger businesses. A high valuation helps establish investor interest, but it tells us surprisingly little about which company is actually strongest.

Consider Cyera and Cato Networks. Cyera reached a $12 billion valuation with approximately $150 million in reported annual recurring revenue, according to TechCrunch's June 2026 reporting. Cato, meanwhile, disclosed more than $350 million in ARR for 2025 and was valued above $4.8 billion in its latest financing.

Using those reported benchmarks, investors valued Cyera at roughly 80 times ARR, compared with a reference ratio of about 14 times for Cato. Neither is an exact current multiple, but the difference is enormous. Cyera has a much larger valuation despite having less than half Cato's reported revenue. Investors paying around 80 times ARR for one company and 14 for another show where they put their money, which we follow in our report on cybersecurity.

Then there is Huntress, which serves smaller businesses through managed security providers. The company reported more than $250 million in ARR, 65% annual growth, and 130% net revenue retention in July 2026. Those operating figures reveal considerably more about customer demand than a fundraising announcement alone.

We also need to distinguish established businesses from emerging technology leaders. XBOW, for example, has demonstrated impressive autonomous vulnerability discovery, but its commercial scale is less transparent than Huntress's or Cato's.

For our ranking, we focus on independent private companies and established scale-ups. We consider revenue, growth, customer adoption, financing, and competitive advantages, while treating undisclosed financial performance as a genuine limitation.

Which cybersecurity startups are leading the market today?

Cyera, Island, Abnormal AI, Cato Networks, Vanta, Chainguard, Huntress, and Torq are among the strongest private cybersecurity companies right now, although their positions look different depending on whether we prioritize valuation, revenue, or technology.

The table compares their latest established financing valuations and available commercial evidence. Revenue estimates from third parties are identified separately from company disclosures, and a historical financing valuation should not be mistaken for a continuously updated market price.

Startup	Main cybersecurity market	Latest established valuation	Revenue or commercial evidence
Cyera	Data and AI security	$12B, 2026	More than $150M reported ARR
Island	Enterprise browsers and agent security	$6.4B, 2026	Enterprise adoption; ARR undisclosed
Abnormal AI	Email and collaboration security	$5.1B, 2024	Established enterprise business; current ARR undisclosed
Cato Networks	SASE and secure networking	Above $4.8B, 2025	More than $350M ARR
Vanta	Security compliance automation	$4.15B, 2025	$300M estimated ARR
Chainguard	Software supply-chain security	$3.5B, 2025	$100M estimated ARR
Huntress	Managed detection and response	$1.5B, 2024	More than $250M ARR
Torq	AI security operations	$1.2B, 2026	$332M cumulative funding
XBOW	Autonomous penetration testing	Above $1B, 2026	$155M Series C, including extension

Is Cyera the number one cybersecurity startup right now?

Cyera is our top overall independent cybersecurity startup today, thanks to its rapid growth, $12 billion valuation, and strong position in data security for large companies adopting AI.

Its valuation rose from $3 billion in November 2024 to $6 billion in June 2025, $9 billion in January 2026, and $12 billion by June 2026. That's a fourfold increase in roughly 19 months.

Cyera also announced $1 billion in funding across its January and June rounds, followed by another $400 million from Goldman Sachs Alternatives in September. This extension kept its valuation around the $12 billion level rather than representing another separate valuation increase.

What makes Cyera interesting is the underlying customer problem. Enterprises often have sensitive information scattered across cloud services, databases, and business applications. AI assistants and autonomous agents create more ways for that information to be accessed, copied, or exposed.

Cyera's software helps companies discover their data, understand which information is sensitive, and control access. Its products now cover data security posture management, data loss prevention, identity-related risks, and AI governance.

In January 2026, Cyera said that approximately 20% of Fortune 500 companies were customers. That would represent about 100 of America's largest corporations, an impressive customer base for a company founded in 2021.

Still, TechCrunch reported in June that Cyera remained far from profitable despite exceeding $150 million in ARR. Its premium valuation assumes that the company can continue growing exceptionally quickly.

We put Cyera first because its opportunity extends across several increasingly connected security problems. Its valuation, however, makes the expectations unusually demanding.

Is Cato Networks a better cybersecurity business than Cyera?

Cato Networks currently has a stronger publicly documented revenue base than Cyera, making it one of the safest choices for anyone ranking private cybersecurity companies by actual commercial scale.

In February 2026, Cato announced that ARR had exceeded $350 million in 2025, an increase of 43% from 2024. Using $350 million as the reference point, that implies approximately $245 million in the previous year and more than $105 million in additional recurring revenue.

That increase alone is substantial. For comparison, Sacra estimated that software supply-chain security company Chainguard had reached $100 million in total ARR by June 2026.

Cato competes in secure access service edge, commonly called SASE. Its platform combines company networking, internet access protection, and security controls into a single cloud-delivered service. Customers can therefore replace multiple networking and security products rather than manage them separately.

The company also acquired Aim Security in 2025, extending its offering into the protection of enterprise AI applications. Its strategy is to sell a broader security platform to existing networking customers.

Cato faces formidable competitors, including Palo Alto Networks, Zscaler, and Netskope. Its 43% annual growth shows that it is winning business, although growing at that rate becomes harder as its revenue base approaches half a billion dollars.

Among private cybersecurity companies with substantial disclosed ARR, Cato deserves to be near the top. We rank Cyera higher overall for its potential in data and AI security, but Cato has already demonstrated greater revenue scale.

Could Island become the next major cybersecurity platform?

Island could become one of the biggest cybersecurity companies because its enterprise browser is expanding into a system for controlling how employees and AI agents use corporate applications.

Island's original idea was relatively simple: instead of adding security tools around a conventional browser, build security controls directly into the browsing experience. That allows companies to manage access to applications, restrict sensitive-data transfers, and monitor activity without relying entirely on separate endpoint products. Building security into the browser itself is a technology bet, and we sort which bets work today and which are still tested in our market report about cybersecurity.

Investor interest has grown quickly. Island was valued at approximately $3 billion in 2024, reached $4.8 billion in March 2025, and announced a $400 million Series F at $6.4 billion in September 2026.

The latest funding comes as Island expands beyond the enterprise browser into secure networking and broader application controls. Its September announcement specifically emphasized security for both employees and autonomous AI agents.

That expansion could give Island a much bigger role inside large companies. Work increasingly happens across SaaS applications, cloud platforms, and AI tools. Island wants to become the place where companies define what users and agents are allowed to access and do.

The biggest missing number is revenue. Island has disclosed major financing rounds and enterprise customers, but its public financial information is much less detailed than Cato's or Huntress's.

We see Island as one of the most ambitious private cybersecurity platforms, although a $6.4 billion valuation alone cannot establish how close it is to becoming a business of comparable commercial size.

Is Vanta one of the fastest-growing cybersecurity startups?

Vanta is now one of the largest private companies in security compliance automation, with approximately $300 million in estimated annual recurring revenue and impressive growth from a business that originally focused on helping startups pass security audits.

According to Sacra's April 2026 research, Vanta reached $300 million ARR, growing about 69% year over year from approximately $178 million. It had already reached an estimated $250 million by the end of 2025.

That implies around $50 million of additional ARR during the first four months of 2026 alone. While these are third-party estimates, the scale suggests that Vanta has moved well beyond its original market of small technology startups pursuing SOC 2 certification.

The company now helps businesses manage security controls, vendor risks, customer security questionnaires, and numerous compliance frameworks. Its $150 million Series D in July 2025 valued the company at $4.15 billion.

An interesting comparison comes from Drata, one of Vanta's main competitors. Sacra estimated Drata's ARR at approximately $98 million in January 2025, putting Vanta's subsequent estimated revenue base at roughly three times that figure, although the measurements come from different periods.

Vanta also benefits from growing interest in AI governance. Companies adopting AI increasingly need to document who can use their systems, what controls exist, and whether they meet standards such as ISO 42001.

The question for Vanta is whether it can keep expanding beyond compliance automation as competing products become cheaper. Its current revenue estimates already make a compelling case that it belongs among the top private cybersecurity companies.

Why is Huntress growing so fast in cybersecurity?

Huntress is growing quickly because it sells sophisticated security protection to smaller businesses that usually cannot afford their own full-time security operations teams.

The company's July 2026 announcement provided unusually detailed results: more than $250 million in ARR, 65% annual growth, 130% net revenue retention, and more than 270,000 protected businesses across over 100 countries.

We can put those numbers in perspective. Using $250 million as the reference point, the ARR growth rate suggests an annualized revenue base of approximately $152 million one year earlier. Huntress therefore added at least roughly $98 million in recurring revenue over 12 months.

Its 130% net revenue retention is particularly interesting. For every $100 in recurring revenue from a group of existing customers a year earlier, that group now generates around $130 after expansions, contractions, and churn. Existing customers are becoming more valuable overall.

Huntress reaches many customers through managed service providers, which handle IT and security for multiple organizations. Its network includes more than 20,000 sellers, allowing it to distribute products to smaller businesses without building a separate enterprise sales relationship for every customer.

The company now protects 15 million identities and 5.5 million endpoints. It has expanded from endpoint threat detection into identity security, managed SIEM, and security posture management.

Huntress's business is especially impressive because its customer base looks completely different from Cyera's or Island's. Instead of depending primarily on Fortune 500 accounts, it has built a large recurring-revenue company around businesses that major cybersecurity vendors have often underserved.

Can Chainguard become a major cybersecurity company as AI writes more code?

Chainguard is one of the most promising software supply-chain security startups because AI-generated software makes trusted open-source components and secure development environments increasingly important.

The company provides hardened container images, open-source packages, and other software components designed to reduce vulnerabilities before applications are deployed.

Chainguard reached a $3.5 billion valuation following its April 2025 financing. Sacra estimated that it had grown to $100 million ARR by June 2026, up from approximately $75 million at the end of 2025.

That's about 33% growth in six months. The same research identified more than 150 paying customers, including Canva, GitLab, HPE, Snap, and Wiz.

Chainguard's approach is particularly interesting because much of the cybersecurity industry focuses on finding problems after software has been developed. Chainguard instead sells maintained software components that help prevent developers from introducing known vulnerabilities in the first place.

AI coding tools make this problem more visible. Developers can now create software quickly, but the generated applications still depend on libraries, containers, and packages that require maintenance and security updates.

If software production keeps accelerating, companies will need reliable ways to control those dependencies. Chainguard is already generating meaningful revenue from that need, although cloud providers and established developer-tool vendors could make the market more competitive.

Are AI-powered cybersecurity startups like Torq really replacing security analysts?

AI cybersecurity startup Torq is making progress in automating security operations, but there is still no convincing industry-wide evidence that autonomous agents can replace experienced security analysts completely.

Torq raised $140 million in January 2026 at a $1.2 billion valuation, bringing its total funding to $332 million. The company builds AI-powered systems that investigate alerts, connect security tools, and help organizations respond to incidents. Selling AI that investigates alerts in place of analysts raises the question of which business models make money, which we compare in our report covering the cybersecurity market.

Its financing announcement followed rapid reported growth. Israeli business publication Globes reported that Torq had seen revenue rise 300%, although a percentage without a current absolute revenue figure makes direct comparisons with Cato or Huntress difficult.

Torq competes in a market that also includes Tines, Exaforce, and established security automation providers. Their shared opportunity comes from the enormous amount of repetitive work security teams perform when reviewing alerts, investigating suspicious activity, and coordinating responses.

The real test is operational reliability. An autonomous system that correctly resolves routine alerts can save considerable analyst time. But incorrect decisions involving compromised identities, sensitive systems, or business-critical infrastructure can have expensive consequences.

Torq's funding and reported growth suggest that companies are buying into the idea. We still lack consistent public comparisons showing how much human work these systems eliminate, how often they make mistakes, and what they cost per successful investigation.

For now, Torq belongs among the leading emerging AI cybersecurity startups. Its best opportunity is automating a growing share of security operations, rather than replacing every analyst.

Is XBOW becoming the most promising autonomous hacking startup?

XBOW is one of the most exciting cybersecurity startups in autonomous penetration testing, with technology that has already demonstrated an ability to find valid vulnerabilities without continuous human direction.

In March 2026, XBOW announced a $120 million Series C at a valuation above $1 billion. It added another $35 million in May, with investors including Accenture Ventures, NVentures, Samsung Ventures, and SentinelOne's venture arm.

The company's earlier technical achievement is especially interesting. In June 2025, XBOW reported reaching first place on HackerOne's US leaderboard, demonstrating that its automated system could discover vulnerabilities accepted through a real bug-bounty platform.

Traditional penetration testing usually involves hiring security specialists to look for weaknesses in applications and infrastructure. XBOW aims to automate a substantial portion of that work and allow companies to test their systems more continuously.

The opportunity is easy to understand. If software teams release new code every day, occasional manual assessments leave long periods when vulnerabilities may go undetected.

However, finding bugs through a leaderboard and reliably assessing complicated corporate systems are different challenges. Enterprises also need accurate prioritization, low false-positive rates, and clear explanations of what should be fixed.

XBOW has strong technical evidence and serious investor backing. Its next challenge is showing that autonomous testing can become a large recurring-revenue business, with dependable results across different customer environments.

Are AI security startups becoming acquisition targets for bigger companies?

AI security startups are already attractive acquisition targets, and recent transactions suggest that many specialized technologies will end up inside larger cybersecurity platforms.

In 2025, Palo Alto Networks acquired Protect AI, Check Point announced its acquisition of Lakera, and SentinelOne acquired Prompt Security. These companies focused on protecting AI models, applications, and interactions against emerging threats.

Cato Networks also acquired Aim Security in 2025, extending its secure networking platform into AI application protection. Cyera has followed an acquisition strategy of its own, including a reported $1 billion purchase of Oasis Security as it expands into non-human identity security.

The pattern is revealing. Established cybersecurity companies want AI-specific capabilities, but several have chosen to acquire specialist teams and products rather than develop every feature internally.

The acquisitions also show how quickly a promising niche can become part of a broader platform. AI application discovery, prompt-injection detection, identity controls, and model security may remain valuable technologies without necessarily supporting dozens of independent multibillion-dollar companies.

We expect more competition over the security of autonomous agents, particularly their access to sensitive data and external applications. For young startups, the opportunity could lead to a large standalone business or a valuable acquisition, depending on how much customers prefer integrated platforms.

Which cybersecurity markets have the strongest startups today?

Data security, secure networking, compliance automation, managed detection, and software supply-chain protection currently have some of the strongest private cybersecurity companies, while autonomous testing and AI security operations offer more speculative growth opportunities.

The differences become clearer when we compare the actual problems these companies solve. A business protecting its cloud databases has different needs from a small company outsourcing threat detection or a software developer securing open-source packages.

Cybersecurity market	Leading private startups	What they currently do best
Data and AI security	Cyera	Find sensitive data and control access
Secure networking	Cato Networks	Combine networking and security
Enterprise browsers	Island	Control application and browser activity
Email security	Abnormal AI	Detect sophisticated email attacks
Managed detection	Huntress, Arctic Wolf	Investigate and respond to threats
Security compliance	Vanta, Drata	Automate audits and security controls
Software supply chains	Chainguard, Endor Labs	Secure software dependencies
AI security operations	Torq, Exaforce	Automate alert investigation
Autonomous penetration testing	XBOW	Find vulnerabilities automatically
Cloud runtime security	Upwind Security, Oligo Security	Detect risks in running applications
Identity security	ConductorOne, Teleport	Control and review access privileges

Are the most valuable cybersecurity startups actually worth their valuations?

Some cybersecurity startup valuations are supported by substantial recurring revenue, while others require years of exceptional growth to make economic sense. Cyera is the clearest example of investors paying a very large premium for future potential.

Using reported and estimated ARR, we can compare several important private companies. The figures below are benchmark calculations using the available valuation and revenue references, not exact current trading multiples. Cato's valuation and ARR were both disclosed as exceeding their respective thresholds, so its precise ratio cannot be established from those figures alone. Valuations from one date set against revenue from another are why we label our sources and update the data every quarter in our cybersecurity market report.

Startup	Financing valuation	Available ARR	Indicative valuation / ARR
Cyera	$12B	$150M+	About 80x at $150M
Chainguard	$3.5B	$100M estimated	Around 35x
Vanta	$4.15B	$300M estimated	Around 14x
Cato Networks	Above $4.8B	$350M+	About 14x using the reference thresholds

These figures use revenue observations from 2025–2026 and the latest established financing valuations, so they are useful comparisons rather than perfectly synchronized multiples.

The spread between Cyera and Cato is particularly striking. At the reported revenue benchmarks, Cyera's valuation is much more demanding. An 80-times-ARR valuation requires far more future growth to become comparable to a business valued near 14 times ARR.

Imagine Cyera doubled its reported ARR benchmark from $150 million to $300 million while its valuation stayed at $12 billion. Its multiple would still be around 40 times ARR. Reaching a 20-times multiple without changing the valuation would require approximately $600 million ARR, four times that starting point.

Cyera could achieve substantial growth over the coming years. Its valuation nevertheless leaves less room for disappointment than those of competitors with larger revenue bases relative to their financing prices.

Vanta and Cato look more restrained on this particular measure. Chainguard sits between the two extremes, reflecting expectations that secure software infrastructure will become a much larger market.

Can cybersecurity startups beat CrowdStrike, Palo Alto Networks, and Microsoft?

Cybersecurity startups can take valuable customers and product categories away from CrowdStrike, Palo Alto Networks, and Microsoft, but replacing these established platforms completely looks unlikely.

Cyera can sell data-security software to companies that already use Microsoft security tools. Abnormal AI protects Microsoft 365 and Google Workspace environments against sophisticated email attacks. Huntress works closely with Microsoft's ecosystem while offering managed detection and response to smaller organizations.

This ability to coexist with incumbents is a practical advantage. A company does not need to replace its entire security system to buy a specialist product addressing a specific weakness.

Cato's competition is more direct. Its integrated networking and security platform overlaps with services offered by Palo Alto Networks, Zscaler, and Netskope. Winning large enterprise contracts in that market can mean replacing significant parts of a customer's existing infrastructure.

Large incumbents also have distribution advantages. Microsoft sells security alongside widely used enterprise software, while CrowdStrike and Palo Alto Networks can introduce new capabilities to existing customers through their platforms.

The recent acquisition wave demonstrates the alternative outcome. Wiz became part of Google Cloud, Armis joined ServiceNow, and several AI security specialists were acquired by established vendors.

The best private companies should keep winning specialized markets and expanding their products. Some will remain independent, while others will become important parts of much larger platforms.

Cybersecurity: What are the top startups now?

Cyera is our number one independent cybersecurity startup overall, with Cato Networks, Island, Vanta, Huntress, Chainguard, and Abnormal AI forming the strongest group of established contenders. Torq and XBOW stand out among the younger AI-driven companies.

Cyera leads our assessment because of its rapid growth, large enterprise customer base, $12 billion financing valuation, and expanding role in protecting data used by AI systems. The company has a convincing opportunity to become a much larger cybersecurity platform, although its valuation already assumes extraordinary future performance.

Cato Networks is the stronger choice for readers prioritizing verified commercial scale. Its reported $350 million-plus ARR, 43% annual growth, and enterprise networking platform demonstrate a sizable business. Huntress also deserves particular attention: its 65% annual growth, strong customer expansion, and reach across 270,000 businesses make it one of the industry's most compelling private operators.

Vanta has built a surprisingly large business around compliance and trust management, while Island offers one of the most ambitious approaches to securing employee and AI-agent activity. Chainguard, meanwhile, addresses the security of software components that modern applications depend on.

Cyera currently leads the independent cybersecurity startup race, but no single company dominates every important category. The market already supports several businesses generating hundreds of millions in recurring revenue, and emerging AI-security companies are creating new competition around automated investigations, software testing, and data access.

The most interesting distinction is between the startups that have already built large businesses and those valued for how large they might become. Right now, Cyera leads the overall ranking, while Cato, Vanta, and Huntress offer some of the strongest evidence of commercial success.