With an eye to AI, cybersecurity sector investment rebounds

Fueled by an overwhelming interest in generative artificial intelligence, startups have been filling their coffers much faster in the first half of 2024.

After record-setting venture capital and equity investment in cybersecurity companies in 2021 and 2022, the sector faced a sharp decline, with a 37% drop in funding in the fourth quarter of 2023 according to research from the DataTribe Insights.

While this followed broader trends, last year’s slump significantly reflected a decline in early-stage funding deals. There were fewer than half as many seed-round investment deals in 2023 (21) as in the fourth quarter of 2022 (49) — albeit the overall amount of capital invested in these young cybersecurity developers did not drop quite as sharply.

In the first several months of this year, seed and pre-seed capital investment in cybersecurity is bouncing back. Venture capital investment in cybersecurity overall is up for the first half of this year and is on pace to beat 2023, according to Wayne Schepens, chief cyber market analyst at CyberRisk Alliance (parent company of SC Media) and managing director of LaunchTech Communications.

“We are still a far cry from its peak, but probably for good reason,” Schepens said. “VCs have been playing it safe and continue to do so.” But the deals that have already gone down so far this year do offer encouragement, as early-stage investors are ‘going all-in’ on cybersecurity startups that focus on the use of generative AI, extended roles in identity and access management, threat exposure management, and third-party risk management solutions, he added.

“I have seen larger seed funding rounds than normal,” Schepens said. “This coupled with extended runways enabled by milestone driven add-on tranches.”

Many venture firms like Glasswing Ventures are focusing specifically on early-stage technology companies that use AI, according to Rick Grinnell, founder and managing partner of the firm and the head of its cybersecurity funding. “Last year was really sluggish … deal pacing was down to half of what was typical,” said Grinnell, whose firm has been investing in companies focused on machine learning and increasingly more advanced AI since 2016. One-third of the close to 50 companies Glasswing has invested in are cybersecurity firms.

Early-stage AI firms attract investor attention

Given the fervor over AI, as well as the technology’s rapidly increasing maturity, investors are looking more favorably on early-stage companies that can utilize AI to better find and fend off attackers — who themselves have been exploiting AI to increase the number and seeming credibility of their attacks. When Grinnell began investing in early-stage cybersecurity firms at Glasswing, and at his prior job, “AI wasn’t even on the roadmap for many investors.”

With AI entering not only the cybersecurity world, but social media and the public consciousness, companies that utilize generative AI are becoming as attractive to investors as the technology has seemingly become to the mass market, Grinnell added. In part, the use of AI is driven by the need to refine the security tools as the waves of attack get higher, alert fatigue grows and it becomes more difficult to find a signal in the noise.

Additionally, investors are seeing demand for enterprise users to embrace intelligent tools that will fight fire with fire.

“We are seeing it being adopted more and more by cyberattackers,” said Grinnell, speaking of attackers using AI to clone or copy corporate web sites, launch more complex and authentic-looking phishing campaigns and deep fakes, which often cross multiple channels. “A lot of [these attacks] are driven by the ease of leveraging AI,” he added.

On the flip side, cybersecurity startups are making strides in detecting and responding to these attacks by using AI themselves.

“It is much harder for humans to stop these threats alone,” said Grinnell, comparing the growing tempo in cyberattacks to the boom in high-frequency trading over the past two decades.

In many ways, the investment community is mirroring the broader market to make a customer base for cybersecurity software and service providers. A Deloitte Center for Integrated Research survey of 500 U.S. business and technology leaders late last year found that among more than 20 capabilities, the top technology investments included analytics, cloud, mobile, and AI.

More than half of the business leaders (58%) responding to the 2023 Deloitte survey said they were focused on investing their cybersecurity budgets on identity and access management, according to Chris Thomas, principal for Deloitte Consulting LP.

Improving identity security has also guided early-stage capital investors, looking to fund developers who can help companies better architect access control and deployment, according to a recent report from Identiverse earlier this year.

(Editor’s Note: This is part of a series of articles to feature the 15 Top Cybersecurity Trends of 2024 & 2025)