A new generation of cybersecurity startups is scaling up to serve companies in the remote-work era as a fresh wave of sophisticated attacks spreads security fears.
Venture capital is flowing into cybersecurity companies at a torrid pace. Less than six months into the year, cybersecurity startups have raised $9.9 billion globally, 96% of the total raised in 2020, according to PitchBook data. Meanwhile, the average valuation of the companies raising funds has more than doubled, to $475 million.
The push to scale comes as digital security takes over boardroom deliberations. Ransomware attacks targeting Colonial Pipeline and beef producer JBS have shown how sophisticated hackers can bring large corporations to their knees.
"When the bad actors get in from a small opening, they can bring down the entire business operation of a large company," said Ravi Mhatre, co-founder and partner at venture capital firm Lightspeed.
The seismic shift to work-from-home that began last year spurred broad new demand for security services. As the number of remote users, mobile devices and access points to data in the cloud increases, companies need more robust protection, said Brendan Burke, an emerging tech analyst at PitchBook.
Cloud security is now the fastest-growing segment within information security, Burke added, and it has been nabbing the largest checks in recent months. This category's heftiest deal of the year came in January when Lacework raised a $525 million VC round led by Sutter Hill Ventures and Altimeter Capital.
Another startup that allows companies to back up and recover cloud data, Rubrik, was valued at $3.67 billion after raising $374 million, according to PitchBook data. Rubrik's solution has seen increased adoption among companies seeking ways to fend off ransomware attacks, said Mhatre, whose firm has invested in the Bay Area startup.
Identity verification applications have also taken off as companies look to give customers and users access to applications from anywhere. To fill this niche, Trulioo raised $394 million at a $1.75 billion valuation to become the third-most valuable VC-backed company in Canada. That deal came on the heels of Okta's $6.5 billion purchase of ID verification company Auth0 in May.
The Auth0 acquisition and other large exits may help to justify the sharp valuation increase for promising young cybersecurity companies. In April, private equity giant Thoma Bravo agreed to buy Proofpoint for $12.3 billion, which would be the sector's largest buyout on record, PitchBook data shows.
As the sector has grown, the boundary between cybersecurity and other tech specialties has blurred.
Stripe, the payments platform, recently launched a technology to check user identities, putting it in competition with specialists like Okta and Trulioo.
Startups have also been expanding into industries like insurtech, pairing cyber insurance policies with software that protects clients. Two leaders taking this approach, Corvus and Coalition, both raised mega-rounds in March.
By protecting their insured customers, startups think they can reduce the risk of large claims.
"A perfect insurance product is one where customers pay premiums and never make claims," said PitchBook emerging tech analyst Robert Le.
With billions of dollars in new funding, cybersecurity startups have lined up the capital to take on incumbents or expand into green opportunities. Rising valuations reflect this opportunity, but also the broad inflation of asset prices.
"There's more capital supply than there are good places to put it at reasonable valuations. And that's driving prices up," said Mhatre.