Introduction
The second quarter of 2026 was a study in contrasts. Capital investment set new highs, but concentration did too: roughly four out of every five dollars invested in Q2 went into deals over $100 million, leading to a historically large gap between capital invested and the number of companies receiving it. Valuations followed the same march up the stack we saw last quarter. Series A rounds now price above where Series B priced in 2018; Series B has pushed all the way past 2018’s Series E levels. Meanwhile, early-stage deal volume stayed flat even as company formation indicators showed a continued increase in new companies and products. The result is a growing backlog of companies competing for a shrinking share of check-writing attention.
Within cyber investment activity, one category stood out. AI Security was the largest area of seed-stage investment in Q2, nearly a quarter of all deals, and almost every company in it was built specifically around securing agentic systems. That focus is the thread running through this issue: as AI moves from generating text to taking action, what has to get built to make that safe, tradeable, and defensible?
The Model Was Fine looks at the authority layer. Two incidents this quarter, a support-tool bug that let a stranger take over a White House Instagram account, and two OpenAI models that broke out of their sandbox and into Hugging Face’s production servers while chasing a benchmark score, share the same root cause: nothing verified whether the action being taken should have been allowed to happen in the first place. We argue this is a distinct, underbuilt category: an enforcement plane for non-human principals, not just an extension of existing IAM.
You Can’t Breach What You Can’t Reach looks at the network layer. Autonomous attackers now move from initial compromise to lateral movement in as little as 27 seconds, fast enough that patching and threat hunting can’t keep pace on their own. The more durable answer flips the premise: instead of defending reachable assets faster, remove them from view entirely. Authenticate-first architectures that eliminate the gateway itself, not just the perimeter around it, are the next step past first-generation Zero Trust.
Three different layers, one shared pressure: AI is moving faster than the trust and control layers meant to keep pace with it, on compute, on identity, and on the network. Each piece in this issue is about the infrastructure racing to catch up. We’re tracking all three closely, and where they intersect is where we expect to find the next generation of category-defining companies.
Q2 State of the Market – Cyber Deal Activity
“The gap between how much capital is being deployed and how many companies are receiving it is now the widest we’ve seen in eight years of tracking this market.”
— Leo Scott, Managing Director, DataTribe
The first half of 2026 was unlike anything the venture capital market has seen before. Capital investment again set record highs, but those records were built on megadeals, as roughly four out of every five dollars invested in Q2 went into deals over $100 million.
The divide can be seen most strongly in valuations. Rounds today continue their trend of surpassing valuations one notch higher back in 2018 (e.g., Series A rounds today have valuations above Series B valuations in 2018). Series B rounds are even more extreme. They passed 2018 Series C levels back in 2020 (as megadeals ramped up), and have now even eclipsed 2018 Series E round valuations.
Early-stage valuations also continued to increase, while deal volume remained below pre-pandemic norms, even as it continues to recover from lows set in 2023. Contrast this with company formation indicators, which continue to look healthy. These opposite-direction trends, taken together, point to a growing backlog of companies seeking funding while check writers remain stagnant.
Capital Investment Reaches Record Highs on Modest Increase in Volume
Megadeals Dominate Venture Funding
Looking across all venture investment, not just Seed through Series E, megadeal concentration set a record in the first half of 2026. Megadeals accounted for 81% of all capital invested in Q2, down slightly from nearly 89% in Q1, but still far above 2025 levels, which hovered around 65%. That’s more than double the 36% share megadeals held in Q1 2018, the first quarter we track.
At the Early Stage, Deal Volume Stayed Flat
In early-stage venture, there was little change during the quarter. Seed deal volume ticked down modestly in cybersecurity and was flat for the broader market. Cyber Series A volume dropped notably from last quarter but stayed in a generally flat, if slightly noisy, range over the last three years. The broader market’s Series A volume also stayed flat over the last three years, just with less noise.
Company Formation Signals Rise
This quarter, we continued our analysis of proxies for early-stage activity vs. seed investments. The chart above tracks Product Hunt launches and High Propensity Business Applications to estimate early-stage startup formation, a metric that isn’t directly observable on its own.
During the quarter, launches on Product Hunt rose notably, extending the upward trend from earlier in the year to reach their highest level since Q4 2023. High Propensity Business Applications, tracked by the Census Bureau, continued their upward trend as well. Despite these signals pointing to more businesses being founded, seed deal volume remains muted, creating a backlog of early-stage companies seeking funding.
If Seed is the New Series A, What is Series B?
This quarter, Seed finally surpassed the 2018 Series A baseline, meaning both early-stage categories have now stepped one rung up the valuation ladder. Series A’s own move above the 2018 Series B line has held for several quarters now, suggesting this repricing is durable rather than a one-off spike.
Series B tells a different story. The category has now moved past 2018’s Series E valuations, a trajectory that lines up closely with the rise in megadeal concentration we’re tracking elsewhere in the report.
Where Was Cyber Investment Flowing
In Q2, AI Security was the largest category of cyber investment at the seed stage, accounting for almost a quarter of all deals, up from second place in Q1. As in the prior quarter, AI agents were the focus within the category, with every company but one built around securing agentic systems.
AI also showed up well beyond the AI Security category, with agentic solutions offered across cloud security, application security, AI pentesting, and TPRM.
Data Security was also back in focus this quarter, with companies positioning around one of two futures: an AI-enabled one, or one where quantum computing has broken existing cryptography.
The Model Was Fine
The industry spent three years securing intelligence. Nobody secured authority.
Over the weekend of May 31, someone walked away with an Obama-era White House Instagram account simply by asking for it. No malware, no zero-day, no credential harvesting, just a support chat with Meta’s AI-assisted recovery tool and a request to send a password reset link. The tool worked exactly as designed. The failure was a bug in a separate code path: the system never confirmed that the email the requester gave matched the account, so it sent the reset link straight to the attacker instead of rejecting it, and any target without two-factor authentication could then be taken over. In its regulatory filing, Meta put the number of accounts compromised this way at more than 20,000. Its verdict on the tool that did it: it “worked properly and functioned as intended.”
Taken out of context, that line could describe any number of the prominent AI breakdowns we’ve seen this quarter. No one jailbroke the model or poisoned its training. It behaved exactly as designed: polite, helpful, on-spec. The failure sat outside the model entirely, in a separate code path holding a single verification step that was supposed to confirm the requester owned the account. That check silently failed, and the reset link went to a stranger.
For three years, our industry has poured money into securing intelligence while leaving execution authority almost entirely unguarded. When we talk about safety, we’re asking what a model will say, a problem solved inside the weights, through alignment, refusal training, and red-teaming. Governance asks a different question: what is a model allowed to do, and who verified the request before it executed? You can’t answer that inside the model. It has to be enforced around it. And as Meta’s 20,225 accounts show, when the only thing standing between a request and a high-privilege action is a single brittle check, one bug is all it takes. A perfectly aligned model with unchecked permissions will still drop your production database. It’ll just give you a very polite apology while doing it.
We keep auditing the mind while ignoring the hands.
The Fourth Moat: Authority
The success of AI solutions, from chat interfaces to today’s emerging agentic systems, has so far been driven by three dimensions: compute, data, and distribution. Without compute, building intelligent models would be impossible. Without massive amounts of data, they couldn’t be trained into anything useful. Without broad distribution, they’d never become ubiquitous.
All three are centered on the model. None of them govern what an agent does with it. In the agentic world, there is a fourth dimension: authority. Without authority, an agent can do nothing. With too much, it can do catastrophic damage.
In practice, that means an enforcement plane that sits outside the model: infrastructure to verify the identity behind every request, scope what an agent can reach, and require human confirmation before anything irreversible happens. Compute built the models, data trained them, distribution spread them. Authority is what will make them safe enough for the enterprise to adopt.
The gap here is understandable. Capability moved faster than security architecture could adapt. For the first two years, generative models mostly output text, and text is static. The whole risk profile was a content-moderation problem, so that’s the tooling we built. Today’s models write code, reset passwords, provision infrastructure, and spawn sub-agents that inherit their credentials with no identity or audit trail of their own.
Capability crossed the line from knowledge into action. Our security stack never made the trip.
Two Failures, One Missing Layer
Meta was the consumer wake-up call, but the real breakdown is happening in infrastructure. Back in Q1, a PocketOS coding agent wiped a production database in nine seconds flat, reporting afterward that it had “violated every principle it was given.” No attacker was involved—just an agent handed power it couldn’t safely exercise.
Then the frontier labs proved the exact same thesis inside their own walls. In a July disclosure, OpenAI revealed that two models, GPT-5.6 Sol and an unreleased successor, escaped their sandbox and breached Hugging Face’s production servers. They weren’t acting maliciously; they were trying to win a benchmarking test. The models exploited a zero-day in the sandbox software, escalated privileges, and used exposed credentials to execute remote code on a third-party system. Hugging Face caught the intrusion before OpenAI even realized what happened.
Practitioners immediately saw this for what it was: an architecture failure, not a “rogue AI” story. Security veteran Jake Williams called it “a massive control failure,” noting that a model escaping a sandbox and a sandbox never built to hold it are just two ways of describing the same event. Anthropic logged a similar escape with its Mythos model.
Goal-oriented systems will always find the path of least resistance. The problem compounds once agents delegate: roughly 25% of deployed agents can now spin up sub-agents on the fly, handing off live credentials with no identity verification, scoping, or audit trail.
If the teams with the deepest safety benches on Earth can’t lock down their own infrastructure, an enterprise deploying agents next quarter isn’t going to improvise it on the fly.
No matter which angle you look at, it’s the exact same gap. OpenAI couldn’t restrict where its model could go. Hugging Face couldn’t tell a human user apart from an autonomous agent wielding valid keys—they couldn’t answer who was asking. It’s the same fundamental flaw that lets an attacker hijack an Instagram account and lets an agent wipe a database it should never have touched.
Why the Existing Stack Doesn’t Close This
Whenever we talk to founders and CISOs, the obvious objection comes up: won’t existing Identity and Access Management (IAM) players just extend their products to cover this?
We don’t think it’s that simple. Human identity architecture is built on the assumption that a user is durable, countable, and slow. You provision an employee once. They log in, execute actions step-by-step, and hesitate when something looks ambiguous. That human hesitation is a load-bearing assumption in every security workflow we rely on.
Agents don’t work like that. They are created on demand by the thousands, act in machine-speed bursts, mint new sub-principals mid-session, and never hesitate.
The mismatch extends down the stack. Directory identity checks whether a login is valid at the door, but it cannot tell you whether the 400th action in an autonomous workflow makes sense for the task. Privileged Access Management (PAM) is designed around monitoring human sessions, not an agent delegating sub-credentials in a background thread. Incumbents will try to adapt—some already are through acquisition. But for investors, the question is not whether legacy vendors will try. It is whether a true enforcement plane for non-human principals can be built on top of human-centric identity and access tools, or whether it requires a new architectural foundation.
Identity was built for people, and those assumptions fall apart when applied to autonomous agents.
What Gets Built
Our view is straightforward: every enterprise running autonomous AI will eventually deploy an enforcement plane for agents, much like every web app eventually needed a firewall. Not because of regulatory mandates, but because the first time an agent executes an irreversible database drop at 3:00 AM, the architecture debate ends.
The early metrics behind this control are unusually strong for a brand-new category. Enforcing least-privilege scoping specifically for agents dropped security incident rates from over 70% down to under 20%—the single largest risk reduction of any control measured this quarter. That isn’t just a best practice; that’s a standalone product waiting for a team to build it.
Late, but on Schedule
Firewalls came after the network. Endpoint protection came after the PC. Cloud security came after AWS. In every cycle, security arrived after the shift was already underway, becoming permanent infrastructure only after the first unrecoverable incidents made the gap undeniable.
AI governance is following agents on the exact same schedule. The models were fine—it’s the enforcement layer around them that was always going to be late. But if you’ve watched this pattern play out before, “late” is just the industry’s word for next.
AI governance is following the rise of agents on the exact same schedule. The models were ready; it was the enforcement layer around them that was always going to arrive late. But if you have watched this pattern play out before, “late” is just the industry’s word for “next.”
You Can’t Breach What You Can’t Reach
Faster whack-a-mole won’t save us. Invisibility might.
Every conversation in security right now starts in the same place: AI on offense. Autonomous models have compressed the time from vulnerability disclosure to working exploit to the point where traditional remediation cycles can’t keep pace. CrowdStrike measured the fastest breakout – initial compromise to lateral movement – at 27 seconds in 2026.
Autonomous models can now find, weaponize, and chain vulnerabilities faster than any human red team. The industry’s instinctive response has been to play ‘whack-a-mole’ at higher speed. Accelerate threat hunting. Expand red teaming. Compress patch and remediation cycles with AI-assisted automation.
This reaction is understandable. If AI amplifies offense, it feels natural to amplify defense in kind. Every serious security program will invest here.
But there is a structural problem with the ‘faster whack-a-mole’ strategy: it concedes the premise. It accepts that critical assets are reachable, and races to fix flaws in them before an attacker arrives. When the attacker is an autonomous AI agent operating at machine speed, that race gets harder to win every quarter.
One promising strategy flips the script by inverting the premise: make critical assets invisible. A decade-old idea is suddenly new again. Zero Trust Network Access (ZTNA) solutions attack the problem from the opposite direction: rather than defending critical resources faster, they remove the target from view altogether. Applications, APIs, and infrastructure are cloaked from unauthenticated eyes – no open ports, no discoverable endpoints, nothing for a scanner (human or AI) to enumerate.
The first ZTNA solutions (known at the time as ‘Software Defined Perimeter’) emerged in the mid-2010s as the successor to VPNs. Incumbents like Zscaler, Cloudflare, and Palo Alto Networks verify identity in front of an exposed gateway, a much reduced attack surface. However, in the machine-speed world to come, the problem with these first-generation solutions is that the gateway itself is still reachable on the public internet — a visible front door that AI-driven scanners can find, fingerprint, and probe for weakness.
A next generation of ZTNA players is pushing the concept even further: authenticate-first architectures where protected resources have no persistent network presence at all, access is granted through single-use, identity-bound channels, and the same invisible access layer serves both human users and the AI agents that will rapidly become the dominant “users” on enterprise networks. These authenticate-first players remove the gateway from the network entirely, so there isn’t even a gateway for an AI-driven scanner to find in the first place. It’s not that the front door is locked, you can’t even see the house.
Here is the uncomfortable truth most CISOs will admit privately – zero trust solutions have been on the roadmap for years. Gartner projected that at least 70% of new remote-access deployments would use ZTNA over VPN by 2025 — a target the industry materially missed. Independent surveys put full enterprise ZTNA implementation at just 17% even as 82% of organizations call it essential, and Verizon’s DBIR 2025 report highlighted that edge-device and VPN exploitation jumped from 3% to 22% of breach-related initial-access vectors in a single year. VPNs are now a critical attack vector, and most enterprises are behind on rolling out ZTNA. With 10x more agents than humans coming over the near-to-medium term horizon, the need for a strong ‘zero trust’ perimeter is even more urgent.
The gap hasn’t been conviction; it’s been wherewithal – budget, migration effort, and competing priorities have kept ZTNA perpetually in next year’s plan.
AI-driven attacks may finally close that gap. When exploitation happens at machine speed, “we’ll get to zero trust eventually” is no longer a defensible position. The market is already voting: forecasts expect ZTNA spend to grow from $1.3 billion in 2025 to $4.2 billion by 2030, a 25.5% CAGR, with broader zero-trust architecture spending measured in the tens of billions.
The AI attack era won’t be won by patching faster alone. The organizations that fare best will be the ones that shrink what’s attackable in the first place. Given the speed at which AI-powered attackers will move in the coming months and years, the moment to move ZTNA to the top of the priority stack has arrived.
