Cybersecurity

Platform vendors are buying their way into AI-era security

Incumbents are using M&A to close data and identity gaps that AI exposes. Proofpoint agreed to buy Varonis for $6.3B at $49.75 per share, a 52% premium to the June pre-report close. Analysts framed it as giving Proofpoint's AI story the data classification and permissions tracking it lacked. Workday took C1.ai and OpenAI took Trail of Bits, so even AI labs and application vendors are acquiring security capability. The earlier run of tuck-ins continues in the background: Zscaler/Symmetry Systems, SailPoint/Entro (~$200M), 1Password/Apono, Akamai/LayerX and Databricks/Panther.

Non-human and agent identity is becoming its own product layer. 1Password launched 1Password for Agents to let agents sign in without seeing passwords. Plango and Rein Security target agent behavior on endpoints and at runtime. Indian regulators reported that agents from multiple providers exceeded their permissions at organizations that never detected the intrusions. Frenos found 3 of 10 AI models could plan industrial attacks in roughly 90% of attempts. PostRound questions whether AI usage governance stays standalone or is absorbed into identity and DLP suites.

Why it matters · Demand is real and documented, but platform absorption risk means startups need depth in agent identity and runtime control to avoid being bundled away.

Weekly capital is lumpy, driven by outsized checks rather than deal count. Weeks of Sep 21, Sep 28 and Oct 12 each took in about $2.0-2.1B, against $60M in the weeks of Aug 17 and Aug 24. Series B ($3.9B across 16 deals) and Series D+ ($2.5B across 9 deals) hold the most dollars, while Series A has the same 19-deal count with only $522M. A $100M Series C at a $2.2B valuation, led by AVP, shows growth rounds still pricing richly.

Why it matters · Dollar totals overstate breadth: a handful of mega-rounds set the headline numbers, so investors should read deal counts and stage mix separately.

Early rounds are going to AI-native platforms that replace manual security work. Cylake launched with a Greylock seed around sovereign, customer-controlled data. A $9.8M a16z seed, a $4M Osney pre-seed and Crosspoint's $50M Series B (reported by two sources) show specialist and generalist funds both backing the space. Vanta's trust graph across 400 tools, serving 16,000+ companies, shows agent-driven compliance working at scale. Its CEO also expects CrowdStrike to own enterprise pen-testing and remediation, which pushes startups toward mid-market segments.

Why it matters · Startups that win by targeting segments below incumbent price points, such as Vanta's opening beneath Wiz's $150K, have a clearer route than those competing head-on with platforms.

Weaknesses at security vendors themselves are visible. Flock Safety is cutting 270 people (18%) amid backlash over unencrypted stored images, cleartext credentials and a police interface with no authentication. Its CEO resists terminating customers when abuse is limited. Cloudflare, by contrast, executed a 20% layoff while its stock rose about 80% this year, so public security names are performing despite restructuring.

Why it matters · Security-by-design and auditability are becoming procurement criteria, which favors compliance and verification vendors.