Week of 13–20 October 2026 · Cybersecurity
It was a quiet week for new rounds: just two disclosed raises, worth $46M combined. But the deals that did happen all point the same way. Pluto Security raised money to protect companies from the AI agents their employees are building. CodeWall raised money to attack companies with AI agents, so they find their weak spots first. And both acquisitions this week, Cohere/AISLE and Hex-Rays/HexAI, were buys of startups that use AI agents to find software vulnerabilities. The quarterly numbers explain why investors are paying attention: cybersecurity funding just had one of its strongest quarters in years.
THE BIG PICTURE: Q3 IN NUMBERS
$6.8B into cybersecurity startups in Q3, mostly in big cheques
Global cybersecurity and privacy startups raised $6.8B in the third quarter, according to Crunchbase data. That’s up about 50% from Q2 and tied for the highest quarterly total in years. The jump came from larger rounds, not more of them: the number of deals actually fell at every stage. AI startups took the overwhelming majority of the money, with identity security as the main focus. At least 18 companies working on AI and cybersecurity closed rounds of $100M or more.
The biggest rounds of the quarter:
- Keyfactor raised $1B in a July growth round led by Summit Partners.
- Island raised a $400M Series F led by Evolution Equity Partners, at a $6.4B valuation.
- Cyera raised $400M led by Goldman Sachs Growth Equity, at a $12B valuation, three months after raising $600M.
On exits, Visa’s $2.4B purchase of BioCatch was the largest acquisition of the quarter, and Cyera bought Oasis Security in a deal reportedly worth around $1B.
THE DIGEST
🇮🇱🇺🇸 Pluto Security raises $42M to secure the AI agents employees build
The total is made up of an $8.5M seed led by TLV Partners and a $34M Series A led by Jump Capital. The founders of cybersecurity company Armis also invested. Pluto monitors the AI tools employees bring into work, including the add-ons and connectors (such as MCP servers) those tools rely on. It can step in while an agent is running and stop it from taking a risky action. The company started selling in April and has passed $2M in annual recurring revenue, with more than 30 enterprise customers including Oscar Health, Workato, Sixt and AlphaSense. CEO Shahar Bahat says a newly released AI tool can show up inside a company within two hours of launch.
🇬🇧 CodeWall raises a $4M pre-seed for autonomous attack agents
Osney Capital led the London startup’s round, with InReach Ventures, Antler and angel investors taking part. CodeWall’s agents probe a company from the outside, the way a real attacker would, with no passwords, source code or inside access. They work in parallel, share what they find and map out how a break-in could actually happen. Earlier in 2026, its agents found vulnerabilities in systems belonging to McKinsey, Boston Consulting Group and Bain. It is already working with banks, and Axos Financial is a named customer.
EXITS & M&A
🇮🇱 A 25-year-old founder sells HexAI for up to $35M without raising a dollar
Hex-Rays, the Belgian company behind the widely used reverse-engineering tool IDA Pro, is buying HexAI in a deal valued at $30M to $35M. Founder Elon Gliksberg started the company in 2025. HexAI builds an operating system for AI agents that do security research. All six employees are expected to stay, and Hex-Rays plans to grow the team in Israel.
🇨🇦🇨🇿 Cohere signs a letter of intent to buy AISLE
AISLE builds AI systems that find, confirm and help fix previously unknown vulnerabilities in software. It was founded by Ondřej Vlček, the former CEO of Czech antivirus company Avast. AISLE says its tools have found more than 500 previously unknown vulnerabilities, including 18 of the 24 fixed in cURL’s October release. Vlček will lead a new unit called Cohere Cyber, and AISLE’s roughly 50 employees will join Cohere. Prague will become Cohere’s global centre for AI security. The deal follows Cohere’s acquisitions of Aleph Alpha and Reliant AI. Terms were not disclosed, and the deal has not closed yet.
PARTNERSHIPS
🇺🇦🇱🇹 December1 and Pekkla set up a joint venture in Lithuania
The Ukrainian anti-drone developer and Lithuanian defence company will mass-produce December1’s Damba electronic warfare system, entirely for Ukraine’s armed forces. The deal is part of the Build with Ukraine programme. Pekkla provides the factory, handles regulation and hires local engineers. December1 says thousands of Damba units are already deployed on the front line and at critical infrastructure. The system protects areas up to 50 km deep against FPV drones, reconnaissance drones and Shahed attack drones.
🇺🇦🇬🇧 Molfar Intelligence and IN2 formalise a partnership on information threats
The Ukrainian open-source intelligence (OSINT) company and the British strategic communications consultancy will work together to spot coordinated information manipulation and trace where information comes from and how it spreads. They had already worked together on client projects for several months. Molfar’s past work includes investigations into sanctions evasion and evidence used in International Criminal Court proceedings.
THE ANALYSIS
1. AI agents are now on both sides of the fight
Pluto, Island and Cyera are building defences for a world where AI agents act inside company systems. CodeWall, AISLE and HexAI use AI agents to do what human security researchers did: probe systems, find flaws and prove they can be exploited. The same technology that creates the new risk is becoming the main tool for dealing with it, and investors are funding both sides.
2. Small teams can now produce big outcomes
HexAI sold for up to $35M with six people and no outside funding. Pluto went from first sales in April to more than $2M in recurring revenue in about six months. In AI security research, a small, sharp team can now build something an established company will pay real money for. That shortens the path from founding to exit.
3. Funding is concentrating in fewer, larger rounds
Q3 money rose 50% while the number of deals fell. Most of it went to companies already worth billions. For early-stage founders, that means the bar is higher. Pluto stood out because it came out of stealth with revenue and well-known customers.
4. AI companies are buying security to sell sovereignty
Cohere presents AISLE as part of a “sovereign AI” platform for governments and regulated industries, built out of Prague and Germany’s Aleph Alpha. In Europe especially, buyers increasingly want AI models and security that sit outside US big tech, and owning the security layer makes Cohere easier to buy.
5. Ukraine is turning combat experience into products for export
December1 is moving production of a battle-tested electronic warfare system to an EU and NATO member state. Molfar is packaging its wartime intelligence skills for governments and companies abroad. For Ukrainian defence and security startups, cross-border partnerships are becoming the way to scale production and reach Western clients.
Bottom line: Cybersecurity money is going to companies that deal with AI agents, either by controlling them or by using them to attack. The cheques are bigger and fewer. Small, highly technical teams with agent-based tools are being bought quickly, sometimes before they ever raise money.
Sources:
- Crunchbase News – Q3 2026 cybersecurity funding
- TechCrunch – Pluto Security raises $42M
- SiliconANGLE – Pluto Security
- Pulse 2.0 – CodeWall pre-seed
- CTech – HexAI acquired by Hex-Rays
- BetaKit – Cohere to acquire AISLE
- Evertiq – Cohere/AISLE and Prague hub
- AIN.ua – December1 and Pekkla joint venture
- AIN.ua – Molfar Intelligence and IN2
