Venture funding for cybersecurity firms remains weak after 2022 collapse

Venture funding of cybersecurity vendors has dried up, although there are some signs the drought might break soon, according to research by executive recruitment firm Pinpoint Search Group.

Pinpoint’s data pegged the total amount of dough venture capitalists threw at the sector in the first quarter of 2024 at $2.3 billion—a 20% year over year decrease. That’s close to a three-year low overall.

The final month of Q1 saw a noticeable comeback, when cybersecurity funding hit $1.4 billion over 42 rounds.

Marc Sasson, co-founder and managing partner of Pinpoint, told IT Brew the numbers are mostly small in comparison with prior years, when venture capital firms oversaturated the market with investments in mid- to late-stage companies that just didn’t pan out.

“In 2021 and 2022, we saw an unbelievable amount of funding to the tune of tens of billions of dollars going into cybersecurity vendors; it was almost like a fad,” Sasson said. “In 2023, it really came down to earth.” (Companies affected that year included Cybereason, which cut 90% of its valuation that April, and IronNet, which shuttered that October.)

Though March 2024 was the first month to break a billion dollars in funding since February 2023, Sasson said much of the money is flowing to earlier-stage startups focused on emerging technologies like AI and large language models. Young companies typically need less capital than older ones, as they’re riskier, less established, and have fewer customers.

It’s too soon to predict whether the money spigot has reopened or if March was “a blip on the radar,” Sasson told us: “The next couple of quarters are going to be kind of critical to really seeing where things stand in cybersecurity.”

Another factor affecting the cybersecurity market is consolidation, as vendors like Palo Alto Networks and CrowdStrike have pushed customers to pay for all-in-one services. (CrowdStrike recently shied away from a price war with Palo Alto Networks, which has promoted “platformization” with giveaways and deferred billing.)

Sasson told IT Brew that while there is some consumer demand for consolidation, many early-stage startups focusing on single point solutions continue to do well.

“Those companies are typically not going to be that consolidation play,” Sasson said. “They’re going to sell or provide a solution for one or two specific problems under that large cybersecurity umbrella. And a lot of them are doing just fine.”

Sasson also cautioned against lumping all AI startups in the cybersecurity space together.

“The thing to really look into…is, what is the problem they’re solving?” Sasson said. “Some are using AI tools to solve data security problems…application security, or software development and lifecycle problems, supply chain problems, etc. All of those still remain problems.”