Cybersecurity Investors Put $6.8B To Work In The Third Quarter, Mostly In Larger Rounds

Cybersecurity and privacy startups raised $6.8 billion globally in the third quarter of 2026. The total increased about 50% from the previous quarter. It also tied for the highest quarterly tally in years, showing unusually strong investor demand for security businesses.

The increase came mainly from bigger checks, not a larger number of financings. Crunchbase data shows that round counts declined sequentially across every funding stage. A smaller group of companies therefore attracted much more capital, lifting the overall total.

The biggest deals centered on artificial intelligence and identity security. Keyfactor raised $1 billion, while Island and Cyera each raised $400 million. The quarter also included major acquisitions, including Visa’s $2.4 billion purchase of BioCatch. Together, the funding and exit activity point to an upbeat market, although continued momentum remains to be seen.

Funding can rise even when deal activity falls if the surviving deals become much larger. That is what happened in Q3 2026: cybersecurity investment reached $6.8 billion, while the number of rounds declined sequentially across every stage. The headline growth therefore reflects capital concentration.

Keyfactor shows the mechanism clearly. Its $1 billion growth round alone represented a very large share of the quarter’s total. Island and Cyera each added $400 million rounds. These large financings outweighed the reduction in the number of completed deals.

This pattern suggests strong conviction in selected companies, especially those combining artificial intelligence with cybersecurity. It does not mean every cybersecurity startup found fundraising easier. Instead, investors appear to have favored established or especially promising businesses, while fewer companies received capital overall. Whether that concentrated momentum spreads remains an open question for the current quarter.

Identity security is the protection and governance of digital identities, including people, machines, and software agents. It determines which identities can access applications or data and helps organizations control those permissions. The concept matters because unauthorized or poorly governed access can expose valuable enterprise resources.

AI expands the identity challenge. Companies now need to understand how employees and AI agents interact with applications and data. Island offers tools for seeing and governing those interactions. Cyera operates a data security platform focused on AI agents, while Oasis Security built enterprise access management for them.

That focus helps explain the funding surge. At least 18 companies at the intersection of AI and cybersecurity raised $100 million or more in Q3. Keyfactor, Island, and Cyera received especially large rounds. Their deals show investors see controlling AI-related access as a major cybersecurity opportunity.

Keyfactor was the biggest fundraiser, collecting $1 billion in a July growth round led by Summit Partners. Island and Cyera tied for second with $400 million rounds announced in September. At least 18 companies combining AI and cybersecurity raised at least $100 million during the quarter.

Island’s round valued the Dallas company at $6.4 billion. Its tools help enterprises see and govern how people and AI agents interact with applications and data. Cyera’s latest investment set a $12 billion valuation for the New York company, which runs an enterprise data security platform focused on AI agents.

These valuations reveal concentrated investor interest in security products built for the AI era. They do not mean every cybersecurity company commands similar prices. Instead, the figures show that investors are placing especially high value on identity, access, and data protection as AI becomes more deeply embedded in enterprise operations.

The acquisitions show that cybersecurity’s momentum was not limited to venture funding. Buyers also spent heavily to obtain security technology and capabilities. Visa purchased BioCatch for $2.4 billion, while Cyera acquired Oasis Security in a deal reportedly valued at around $1 billion.

Visa’s purchase targeted anti-fraud technology and supported a broader effort to strengthen fraud detection and prevention for the AI age. Cyera bought Oasis Security, an enterprise access management platform built for AI agents. In both cases, the buyer gained an established technology position instead of developing everything internally.

This activity strengthened the quarter’s overall market picture, even though the IPO market was sluggish. It also showed that AI-related security needs are shaping corporate strategy. Alongside large funding rounds, acquisitions offered investors and founders another path to value, particularly in fraud prevention, access management, and protection for AI-driven systems.

The article does not list specific AI failures, but it identifies a broad concern: rapidly advancing AI technology is creating risks that companies must manage. Those risks can affect employees, enterprise data, applications, and AI agents themselves. Poorly controlled access or unexpected automated behavior can make security harder.

In practical terms, organizations may need to know which people and AI agents interact with applications and data, what permissions they have, and whether those interactions are governed. Island focuses on visibility and control across those relationships. Cyera focuses on protecting enterprise data involving AI agents, while Oasis Security addressed access management for them.

These challenges help explain the funding surge. At least 18 AI-cybersecurity companies closed rounds of $100 million or more in Q3. Investors are backing tools that address identity, access, data, and fraud concerns. As AI use expands, the article suggests the security market could continue attracting attention, though it does not predict a specific outcome.

Venture capital is investment in companies with substantial growth potential and substantial risk. Investors provide money through funding rounds so a company can develop products, expand, and pursue larger opportunities. In return, they receive an ownership stake or related financial claim. The article shows this system operating at an unusually large scale in cybersecurity.

Successive rounds let companies raise capital as they reach milestones and need more resources. Cyera raised $600 million and then another $400 million three months later, reaching a $12 billion valuation. Island raised a $400 million Series F and reached a $6.4 billion post-money valuation. These rounds allowed investors to support further growth while pricing the companies again.

The eventual outcomes can include acquisition or a public offering. Cyera acquired Oasis Security, while Aura became public through its combination with Qoria. The article also notes that IPO activity was sluggish, making acquisitions especially important routes for liquidity.