Venture

YL Ventures details the challenges facing Israeli cybersecurity startups

Comment

Fibre optic data containing a computer virus hitting a laptop screen.
Image Credits: Tek Image Science Photo Library (opens in a new window) / Getty Images

Nadav Lev

Contributor

Nadav Lev, is the chief technology officer (CTO) at YL Ventures, the leading cybersecurity-focused,
early-stage venture capital firm based in Israel and the U.S.

The Israeli cybersecurity industry, much like the global one, has been undergoing an evolution that seemed to peak in 2021 with soaring funding rounds, overwhelming valuations, and multiple newly minted unicorns, only to cool down dramatically amid the market slowdown of 2022 with steep declines and frozen growth rounds. The breakneck speed of these fluctuations led to ramifications that reverberated across the industry throughout 2023, as Israeli cybersecurity startups had to adapt and find their footing in this new post-bonanza funding reality.

Each year, YL Ventures monitors, analyzes, and publishes data on funding and acquisitions in the Israeli cybersecurity market, with insights from industry luminaries to illuminate the trends and shifts in this fiercely competitive and relentlessly trailblazing industry. In 2023, despite declines in fundraising overall, we can identify trends indicating a positive trajectory for the industry, including an increase in exits. These trends are evident in continued investment in promising cybersecurity startups and in the determination of skilled, experienced entrepreneurs to find and address the most acute and urgent security problems ailing the business world today.

Image Credits: YL Ventures

Beyond the general macro aspects, specifically in the cyber domain, the prevailing explanation for this downward trajectory is a continuation of market corrections following the sharp increases of 2021. Toward the end of 2023, Israel was faced with national, economic, and geopolitical challenges. The ongoing war between Israel and Hamas has impacted the Israeli tech sector much like the rest of Israeli society, but its resilience and determination form the foundation for increased growth, stability, and longevity despite unprecedented challenges. There were several impressive funding rounds and acquisitions of Israeli cybersecurity startups in the final quarter of 2023, despite the circumstances, and the effects of these events will most likely be evident only in the first half of 2024.

Overall funding in 2023

Image Credits: YL Ventures

In 2023, the overall decline in tech investments continued, with total funding of Israeli cybersecurity startups reaching only $1.89 billion across 71 funding rounds, down 41% from 2022’s total — $3.22 billion across 94 funding rounds. “In 2021, the irrational exuberance in the financial markets led to inflated valuations across the startup landscape, including cyber,” remarks Erica Brescia, managing director at Redpoint Ventures. “What we’re witnessing now is not a slowdown, but rather a return to pre-pandemic sanity — a market correction that paves the way for healthier startups.”

Early-stage funding

Unlike overall funding trends, there was a significant increase in the average seed round for the sixth consecutive year, from $9 million in 2022 to a record $9.8 million in 2023. This can be attributed to the constant and growing need for groundbreaking security solutions to resolve unrelenting security issues and sustained investor appetite for supporting innovative founding teams able to do so. While the average seed amount grew, the number of seed rounds in 2023 was only 36, down from 46 in 2022.

Image Credits: YL Ventures

The dissonance between the increase in the average seed round and the decline in the number of rounds can be attributed to several massive rounds raised by serial entrepreneurs that pushed the average up considerably. The growing number of startups founded in 2023 by seasoned cybersecurity entrepreneurs who have one or more exits under their belt brings invaluable experience, a track record of success, and the ability to look at existing markets, detect underlying problems, and invent new categories. Cyber investors believe that this experience is significant for building category-leading companies in a competitive and crowded market, and they, therefore, allocate larger resources to support these entrepreneurs in bringing their vision for category leadership to fruition. The assumption is that they will succeed in overcoming substantial challenges, such as efficiently scaling and building a global go-to-market (GTM) strategy, given their successful past experiences in doing so. In a competitive and dynamic category like the cyber domain, the ability to execute and move quickly holds great importance for investors due to the level of risk involved.

Image Credits: YL Ventures

We noticed this budding trend in 2022 when nine cybersecurity startups were founded with second-time founders at the helm. In 2023, the number of serial entrepreneurs who raised seed rounds increased back to 10, after a slight dip in 2022, most still in stealth mode. This year, however, these seasoned entrepreneurs had a larger share of the seed pool than in 2022.

“History has shown that times of economic turbulence and market uncertainty are often closely followed by a resurgence of innovation. Veteran cybersecurity entrepreneurs who have witnessed this cycle in the past are eager to get in the game early and cannot resist the challenge of finding the next cybersecurity breakthrough,” says Ben Bernstein, co-founder and CEO of YL Ventures portfolio company Gutsy*, which previously built, scaled and sold cloud-native security pioneer Twistlock to Palo Alto Networks in 2019. Gutsy raised $51 million in 2023, one of the largest seed rounds in cybersecurity history, to pioneer data-driven security governance using process mining. “There are still unbelievably exciting opportunities in cybersecurity, and in building our second startup, Gutsy, we seek to dominate the field for a longer run than our previous success at Twistlock, which makes a huge difference in our approach this time. I think we’ll see a growing number of veteran founders building new companies in 2024 and opening up new and undiscovered spaces in cybersecurity that are ripe for disruption.”

Follow-on funding

The repercussions of 2021’s mega-rounds and hyped-up valuations were felt most in 2023 in all follow-on funding rounds, from Series A onward. “The bar for fundraising for each round will continue to rise into 2024, forcing founders to be laser-focused on driving strong growth with sound underlying fundamentals,” says Erica Brescia. “While 2024 will be a challenging year for fundraising, there is plenty of capital available for those who deliver best-in-class growth, and cyber will be no exception.”

Image Credits: YL Ventures

Total capital raised in Series A, B, and C rounds dropped across the board in 2023 when compared to 2022’s numbers: Series A — from $737 million in 2022 to $384 million in 2023; Series B — from $625 million in 2022 to $268 million in 2023; and Series C and onward — from $1.48 billion in 2022 to $888 million in 2023, a 40% decrease in total capital at this stage. Notable rounds in 2023 include Gem Security‘s $23 million Series A round led by GGV Capital; Grip Security‘s* $41 million Series B round led by Third Point Ventures; Island‘s $100 million Series C round led by Prysm Capital; Wiz‘s $300 million Series D round led by Greenoaks, Index Ventures and Lightspeed Venture Partners; and Cato Networks‘ $238 million Series G round led by Lightspeed Venture Partners. While investors remained optimistic about new spaces and startups in the earliest stages, they were more hesitant to invest in companies that raised capital at unhealthy valuations in 2021 and needed a significant influx of capital in 2023 to extend their runway.

We cautiously anticipate that in 2024, follow-on rounds will increase in number and size. Companies that raised funding rounds in 2021 and 2022 will invariably be forced to raise capital in the next 18 months, be acquired, or reach profitability — which is extremely difficult to achieve, as most high-growth cybersecurity startups tend to be inefficient. Instead of seeking acquisition, these companies may raise funding rounds at less attractive terms to avoid closing shop altogether. Looking further ahead to anticipate future trends, growth rounds will bounce back to their previously dominant status once the 2021 crop of startups is acquired or continues to grow more sustainably. Startups that raised seed rounds in 2023 will likely be able to raise healthy, substantial follow-on rounds in 2025, barring any external factors that may affect this trend.

Hot spaces in 2023

Image Credits: YL Ventures

Last year was undoubtedly the year of generative AI technology, enticing users and early adopters with its transformative capabilities for business productivity and personal use. Considered at first to be just another trend, GenAI quickly permeated enterprises, products, and services, becoming an unavoidable element that is everywhere. As with any new tech buzz, the security implications and opportunities were not far, just a little. As enterprises scrambled to define new security guidelines and internal policies to govern the use of GenAI technology, the use of GenAI in third-party applications, homegrown products, and among employees grew exponentially.

It is hardly surprising, therefore, that within the Israeli cybersecurity ecosystem, seven new startups raised seed rounds in 2023 in a new category that didn’t exist in 2022 — security for GenAI. In the next few years, we anticipate that most enterprises will use GenAI across all of their environments, including production and employee use. As use grows, so does the GenAI attack surface, and security for GenAI will increasingly attract investor interest.

AppSec is among the most prevalent cybersecurity spaces for budding entrepreneurs for the third straight year. There were 11 new AppSec companies founded in 2022 and only six in 2023, indicating this space’s saturation level. While it remains a large and interesting category, in 2023, we saw consolidation begin as companies were acquired, including Enso Security* (acquired by Snyk) and Bionic (acquired by CrowdStrike). This may indicate a dry spell regarding innovation in this space, limiting the number of new funding rounds we’ll see here.

Identity and access management was at the top of the list in 2022 and remains an increasingly popular space with six new startups in 2023. Identity has been called the “new security perimeter,” a top-of-mind problem for security practitioners and C-suite executives. Today, it is one of the fastest-growing cybersecurity sectors due to the prevalence of identity-based attacks, as malicious actors find it easier to manipulate machine or human users and overly permissive identities. We foresee that while it will continue to be an attractive space for investors in 2024, it will soon become a crowded market if new, innovative, and large-enough subcategories are not created. Okta’s acquisition of identity security posture management startup Spera Security* late in 2023 exemplifies the interest in this space and its attractiveness for larger enterprises.

Vulnerability and risk management has also been among the top three hottest cybersecurity spaces in the past, with five new companies in 2023. It continues to attract investor interest due to the recent rise in requirements to report cybersecurity incidents and disclose information on the processes and methodologies used to secure against them. SEC regulations from August 2023 impose stringent transparency and reporting demands on publicly traded companies. Coupled with the May 2023 sentencing of ex-Uber CISO Joe Sullivan, following Uber’s 2016 decision not to report a breach to the Federal Trade Commission, there is now a clear incentive for companies to invest more in vulnerability and risk management solutions that proactively assess a company’s security governance and ability to measure and report on its security posture.

As CISOs pack their security stacks with many discovery tools that bombard them with alerts, they require these risk management platforms to analyze, prioritize, and deduce them. These processes are crucial to ensure developers fix what matters and avoid alert fatigue and growing frustration within developer teams. The industry is shifting toward holistic, simplified management rather than adding more tools to govern these processes, solutions, and stakeholders. Gutsy, for example, zeroed in on this acute problem space to show security professionals how their existing tools and processes work together and how they can improve and streamline what they already have. We predict sustained interest in this sector in 2024 as the industry matures.

M&A activity

A positive trend that we predicted in last year’s report and that indicates sustained interest in the Israeli cybersecurity ecosystem is an increase in the number of Israeli cybersecurity startups acquired in 2023. The number of acquisitions reached 21 last year, surpassing the 16 deals in 2022. “Reflecting on the past year and heading into 2024, the common theme in security is consolidation,” says Ofer Ben-Noon, veteran cybersecurity entrepreneur, co-founder, and CEO of Talon Cyber Security (recently acquired by Palo Alto Networks for $625 million) and former co-founder and CEO of Argus Cyber Security, acquired in 2018 by Continental. “Customers only want to invest in solutions that can address various use cases and challenges while being simple to manage. The days of using dozens of security tools are quickly coming to an end. From an M&A perspective, I expect companies to pursue integration with solutions that fill meaningful holes in their platforms, to expand the problems they can solve, and give customers extended protection without needing to add new vendors to their tech stacks.”

Image Credits: YL Ventures

The combination of this shift toward consolidation and the realization that acquisition is the only option for several startups led to an interesting decline in the average number of years it took to reach an exit. In 2022, it took startups an average of 7.1 years from founding to acquisition, while in 2023, the average dropped to only 5.2 years, even lower than 2021’s average of 5.7 years.

Another interesting M&A trend is the rise in acquisitions led by companies that are not purely cybersecurity focused, doubling in size from five in 2022 to 10 in 2023. Underlying this dramatic increase is their growing interest in augmenting their offering with cybersecurity capabilities and talent. From a business perspective, legacy industries can improve their positioning and messaging (thereby increasing their value) if they add these capabilities. Examples include Hewlett Packard Enterprise’s acquisition of Axis Security (for $500 million), Thales’ acquisition of Imperva (for $3.6 billion) and Rubrik’s acquisition of data security company Laminar (for $250 million). Other notable exits in 2023 include Palo Alto Networks’ acquisition of Dig Security for $350 million and CrowdStrike’s acquisition of Bionic for $350 million. Leading security vendors today are increasingly involved in the early-stage “scene” and actively scout the youngest and most innovative cybersecurity startups. Their focus on the early stages directly impacts their ability to identify attractive acquisition targets, establish strong connections and present acquisition proposals quickly, as they recognize the potential within young teams and know how to leverage the challenging funding landscape to their advantage.

An unexpected turn of events

The cybersecurity sector has traditionally been the uncontested leader of Israeli high-tech, attracting interest and deal flow even when global markets made investments in other sectors unlikely. The resilience of the Israeli cybersecurity industry was tested in 2023 with an additional, unexpected, and catastrophic geopolitical force that greatly affected the entire nation and its economy in the fourth quarter of 2023 — the Israel-Hamas war. As the economy rallies to ensure Israel’s stability during this turmoil, cybersecurity has an even more critical role as a beacon of excellence in the face of adversity and strife.

While many startup founders and employees divide their time between the office and the front lines of this conflict in active military reserve duty and civilian aid efforts, business continuity remains a top priority. The ramifications of these events on the Israeli cybersecurity industry are as yet unknown. What has already been made clear is that the Israeli high-tech industry, with cybersecurity at its helm, will continue to deliver top-tier service, products, and innovation, no matter what.

*Gutsy, Spera, Grip and Enso are part of the YL Ventures portfolio.

More TechCrunch

The Twitter for Android client was “a demo app that Google had created and gave to us,” says Particle co-founder and ex-Twitter employee Sara Beykpour.

Google built some of the first social apps for Android, including Twitter and others

WhatsApp is updating its mobile apps for a fresh and more streamlined look, while also introducing a new “darker dark mode,” the company announced on Thursday. The messaging app says…

WhatsApp’s latest update streamlines navigation and adds a ‘darker dark mode’

Plinky lets you solve the problem of saving and organizing links from anywhere with a focus on simplicity and customization.

Plinky is an app for you to collect and organize links easily

The keynote kicks off at 10 a.m. PT on Tuesday and will offer glimpses into the latest versions of Android, Wear OS and Android TV.

Google I/O 2024: How to watch

For cancer patients, medicines administered in clinical trials can help save or extend lives. But despite thousands of trials in the United States each year, only 3% to 5% of…

Triomics raises $15M Series A to automate cancer clinical trials matching

Welcome back to TechCrunch Mobility — your central hub for news and insights on the future of transportation. Sign up here for free — just click TechCrunch Mobility! Tap, tap.…

Tesla drives Luminar lidar sales and Motional pauses robotaxi plans

The newly announced “Public Content Policy” will now join Reddit’s existing privacy policy and content policy to guide how Reddit’s data is being accessed and used by commercial entities and…

Reddit locks down its public data in new content policy, says use now requires a contract

Eva Ho plans to step away from her position as general partner at Fika Ventures, the Los Angeles-based seed firm she co-founded in 2016. Fika told LPs of Ho’s intention…

Fika Ventures co-founder Eva Ho will step back from the firm after its current fund is deployed

In a post on Werner Vogels’ personal blog, he details Distill, an open-source app he built to transcribe and summarize conference calls.

Amazon’s CTO built a meeting-summarizing app for some reason

Paris-based Mistral AI, a startup working on open source large language models — the building block for generative AI services — has been raising money at a $6 billion valuation,…

Sources: Mistral AI raising at a $6B valuation, SoftBank ‘not in’ but DST is

You can expect plenty of AI, but probably not a lot of hardware.

Google I/O 2024: What to expect

Dating apps and other social friend-finders are being put on notice: Dating app giant Bumble is looking to make more acquisitions.

Bumble says it’s looking to M&A to drive growth

When Class founder Michael Chasen was in college, he and a buddy came up with the idea for Blackboard, an online classroom organizational tool. His original company was acquired for…

Blackboard founder transforms Zoom add-on designed for teachers into business tool

Groww, an Indian investment app, has become one of the first startups from the country to shift its domicile back home.

Groww joins the first wave of Indian startups moving domiciles back home from US

Technology giant Dell notified customers on Thursday that it experienced a data breach involving customers’ names and physical addresses. In an email seen by TechCrunch and shared by several people…

Dell discloses data breach of customers’ physical addresses

Featured Article

Fairgen ‘boosts’ survey results using synthetic data and AI-generated responses

The Israeli startup has raised $5.5M for its platform that uses “statistical AI” to generate synthetic data that it says is as good as the real thing.

5 hours ago
Fairgen ‘boosts’ survey results using synthetic data and AI-generated responses

Hydrow, the at-home rowing machine maker, announced Thursday that it has acquired a majority stake in Speede Fitness, the company behind the AI-enabled strength training machine. The rowing startup also…

Rowing startup Hydrow acquires a majority stake in Speede Fitness as their CEO steps down

Call centers are embracing automation. There’s debate as to whether that’s a good thing, but it’s happening — and quite possibly accelerating. According to research firm TechSci Research, the global…

Retell AI lets companies build ‘voice agents’ to answer phone calls

TikTok is starting to automatically label AI-generated content that was made on other platforms, the company announced on Thursday. With this change, if a creator posts content on TikTok that…

TikTok will automatically label AI-generated content created on platforms like DALL·E 3

India’s mobile payments regulator is likely to extend the deadline for imposing market share caps on the popular UPI (unified payments interface) payments rail by one to two years, sources…

India likely to delay UPI market caps in win for PhonePe-Google Pay duopoly

Line Man Wongnai, an on-demand food delivery service in Thailand, is considering an initial public offering on a Thai exchange or the U.S. in 2025.

Thai food delivery app Line Man Wongnai weighs IPO in Thailand, US in 2025

The problem is not the media, but the message.

Apple’s ‘Crush’ ad is disgusting

Ever wonder why conversational AI like ChatGPT says “Sorry, I can’t do that” or some other polite refusal? OpenAI is offering a limited look at the reasoning behind its own…

OpenAI offers a peek behind the curtain of its AI’s secret instructions

The federal government agency responsible for granting patents and trademarks is alerting thousands of filers whose private addresses were exposed following a second data spill in as many years. The…

US Patent and Trademark Office confirms another leak of filers’ address data

As part of an investigation into people involved in the pro-independence movement in Catalonia, the Spanish police obtained information from the encrypted services Wire and Proton, which helped the authorities…

Encrypted services Apple, Proton and Wire helped Spanish police identify activist

Match Group, the company that owns several dating apps, including Tinder and Hinge, released its first-quarter earnings report on Tuesday, which shows that Tinder’s paying user base has decreased for…

Match looks to Hinge as Tinder fails

Private social networking is making a comeback. Gratitude Plus, a startup that aims to shift social media in a more positive direction, is expanding its wellness-focused, personal reflections journal to…

Gratitude Plus makes social networking positive, private and personal

With venture totals slipping year-over-year in key markets like the United States, and concern that venture firms themselves are struggling to raise more capital, founders might be worried. After all,…

Can AI help founders fundraise more quickly and easily?

Google has found a way to bring a variation of its clever “Circle to Search” gesture to iPhone users. The new interaction, launched in January, allows Android users to search…

Google brings a variation on ‘Circle to Search’ to iPhone users

A new sculpture going live on Wednesday in the Flatiron South Public Plaza in New York is not your typical artwork. It combines technology, sociology, anthropology and art to let…

Always-on video portal lets people in NYC and Dublin interact in real time