Venture Investors See Big Promise in AI-Native Cybersecurity Startups
Penetration testing startup Xbow could soon join the unicorn club
As AI agents ramp up in the workplace, they’re opening the door to a lot of new cyber risks — and creating opportunities for a new wave of security startups, even as incumbents in the industry brace for disruption.
Some of the next-generation startups are using AI agents to significantly scale up how networks are monitored, either through penetration testing or governance — largely to beat back mass-scale automated attacks that are enabled by AI. Others are wrestling with the critical issue of how agents will verify their identities online as they begin to transact autonomously.
Investors are paying attention. Xbow, a Sequoia-backed penetration testing startup whose AI agents can probe networks around the clock, is in talks to raise a new funding round that investors expect to value it at just over $1 billion, according to multiple sources familiar with discussions. DFJ is expected to be a major participant in the round, per two of the sources. The round is not yet closed and terms could still change.
Just today, former Palo Alto Networks founder Nir Zuk announced a new AI-native cyber startup called Cylake, which is building hardware-based networks for customers whose data is too sensitive for the cloud, such as governments and defense contractors. The company raised a $45 million seed round led by Greylock.
Cogent Security, which is using agents to search for network vulnerabilities, raised a $42 million Series A two weeks ago led by Bain Capital Ventures, with participation from Greylock Partners and Definition. Another hot penetration testing company that investors told us about is RunSybil, which boasts co-founders from OpenAI and Meta.
Agents have been particularly useful at scaling up the capacity for network defense, said Vanta CEO Christina Cacioppo, whose compliance startup contracts with nearly a dozen AI security firms. “Because agents don’t get tired and don’t want vacation, you can fundamentally change the frequency of [testing.]”
A whole host of startups are working to fix identity verification for an upcoming era in which agents could have the same permissions in an organization as their owners. One that came up often in our calls was Astrix Security, which raised $45 million from Menlo Ventures and Bessemer Venture Partners in 2024. ServiceNow late last year acquired buzzy the AI identity startup Veza, which was backed by Accel, GV, Norwest, and NEA.
Subscribers can scroll down to see our list of cybersecurity startups we’re watching closely — including new AI native companies and legacy startups that are embracing AI effectively.
The troubles that a secular shift in the cybersecurity industry could pose for major players like Crowdstrike and Zscaler became clear two weeks ago when Anthropic launched Claude Code Security, a tool that autonomously scans codebases for vulnerabilities and suggests patches for human review. Both companies’ shares fell by more than 10% in the days after the announcement.
The big players’ shares have since mostly rebounded, but there’s still a lot of uncertainty in the markets. Identity verification tool Okta, for example, is down 17% so far this year. Venture investors, for their part, say Wall Street got it wrong — not about disruption, but about who’s actually in the crosshairs.
“It’s definitely a real threat for the ecosystem, but it’s not evenly distributed,” said Clayton Petty, a partner at Gradient Ventures who focuses on cybersecurity. Application security testing tools and software supply chain analysis products are directly in Anthropic’s path, Petty said, because Claude Code Security is pretty much built to do most of what they do and is already plugged into many companies’ codebase.
On the other hand, the Okta selloff is harder to justify, Petty said. “Okta is not really in the line of sight of Anthropic at all,” since it’s focused on identity certification, not securing codebases. Its decline, he suggested, reflects broader investor uncertainty about software multiples rather than any direct competitive threat from Claude Code Security.
Companies like Crowdstrike, Palo Alto Networks and Cloudflare, whose stock also got hit in the selloff, won’t be replaced very easily; they provide extensive security infrastructure that’s welded into many enterprises.
“Enduring security companies such as Crowdstrike have very deep technology underpinnings. They’re not just a UI veneer on an LLM,” said Dave Zilberman, a general partner at Norwest Venture Partners.
The future winners in AI-native cybersecurity could well be a few years out, investors told me. Wiz became the market leader for cloud-native security soon after it launched in 2020, but the cloud had already been the main operating system for businesses for a decade. There could be a similar gap as AI infrastructure in the enterprise matures.