Cylake raises $245m before its beta, a bet that security leaves the public cloud
Nir Zuk's six-month-old startup has raised $290m in total without a product on the market, using a convertible note that leaves its valuation unpriced.
Cylake, the cybersecurity company founded by Nir Zuk, the founder of Palo Alto Networks, said on September 8 that it has raised $245 million through a convertible note from Lightspeed Venture Partners, Picture Capital and Redpoint Ventures. The financing brings its total funding to $290 million, six months after it emerged from stealth with a $45 million seed round led by Greylock Partners. The company has more than 40 employees and does not expect to release a beta of its platform until the end of 2026, with general availability scheduled for 2027.
The size of the round is remarkable for a company with no product on the market. The structure is just as telling. A convertible note allows investors to commit capital now while deferring the question of what the company is worth. And the thesis runs against a decade of industry orthodoxy: Cylake is building security software for organisations that will not, or cannot, send their data to the public cloud.
A large cheque without a price
Neither the valuation nor the conversion terms of the note were disclosed. That is the point of the instrument. In a priced round, investors and founders must agree on a number. With a convertible note, the money arrives today and converts into equity later, usually at a discount or under a cap set against a future priced round. For a company that will not have a beta until the end of the year, the note avoids anchoring a valuation before there is any customer evidence to support one.
For investors, that brings both protection and risk. They secure a position in a company led by one of the most commercially successful founders in the industry, without paying a headline price that could later look generous. But debt-like instruments of this size also stack up claims ahead of ordinary shareholders, and the eventual dilution depends on terms outsiders cannot see. Founders watching this round should not read it as a template. It reflects investors' confidence in a specific team, not a general reopening of the market for pre-product companies.
On the arithmetic, $290 million raised by a company of just over 40 people works out to more than $7 million per employee. Much of that capital will presumably go into the engineering hiring the company says it plans, but the figure shows how far investors are prepared to front-load funding for a team they trust.
The team is the collateral
Mr Zuk founded Palo Alto Networks in 2005 and served as its chief technology officer for more than 20 years. His co-founders are Wilson Xu, who spent more than a decade at Palo Alto Networks and led its engineering organisation, and Ehud "Udi" Shamir, a co-founder of SentinelOne who later worked as an engineer at Palo Alto. According to SecurityWeek, René Bonvanie, Palo Alto's former chief marketing officer, has also joined. Ravi Mhatre, co-founder of Lightspeed, will take a board seat, and Rakesh Loonkar of Picture Capital will become a board observer.
This is the familiar logic of "repeat founder" financing in its purest form. Investors are underwriting the ability of a team to build a platform company again, and to sell it to the same large, conservative buyers it sold to before. Mr Mhatre summed up the investor case in critical terms: "Most of the market has been slow to understand how AI and SaaS have changed the game for enterprise cybersecurity."
Sovereignty as a market
The strategic bet is the most interesting part. Cylake says it is building an AI-native security platform for government agencies, highly regulated enterprises and other organisations that cannot rely on public cloud infrastructure, designed to run entirely on premises or in private cloud environments. When it launched in March, the company described its target as institutions that need advanced protection but cannot use products tied to the public cloud, including critical infrastructure operators and regulated sectors such as finance and healthcare. Mr Zuk said at the time: "Cylake is for institutions where maintaining full control over data and operations is not optional."
Announcing the new funding, he made the case more directly. For organisations of this kind, he said, "the public cloud is not the right operating model", and the security architecture "needs to be rebuilt around complete data, sovereignty, and control for an AI-native world."
That is a contrarian position. Most of the industry's growth in the past decade, including at Mr Zuk's former company, came from moving security analysis into vendor-run clouds, where data from many customers can be pooled and processed at scale. Cylake is wagering that AI changes the calculation. If effective AI security requires bringing all of an organisation's data into one place, then for a government ministry, a defence contractor or a bank subject to strict data residency rules, that place may have to be inside its own walls.
The hard part is still ahead
The difficulty is execution. Selling on-premises software to governments and regulated institutions is slow, procurement heavy and expensive to support. Customers who have spent years assembling a stack of separate security tools will need to be persuaded to consolidate onto a new platform from a company that has not yet shipped. Running advanced AI models locally also means the customer, not the vendor, carries much of the infrastructure burden, which can weigh on deployment times and margins.
There is also the matter of competition. The large security platforms, Palo Alto among them, already sell to these customers and have their own private and government cloud offerings. Cylake will need to show that a platform designed from the outset for sovereign environments is materially better than a cloud product adapted to run in one.
Our view
Cylake's round tells us more about the state of venture appetite in security than about the company itself, which has yet to prove anything in the market. Investors are willing to commit very large sums to proven founders before launch, and they are doing so through structures that postpone the valuation debate. That is rational for them, but it raises the bar Cylake must clear: by the time the note converts, it will need customers, not just a thesis.
The sovereignty argument deserves to be taken seriously. Regulation, geopolitics and the data appetite of AI are pushing some of the largest buyers of security towards keeping control in house. Founders in adjacent fields should note that on-premises is no longer a dirty word to investors. What to watch: whether the beta arrives on schedule at the end of the year, who the first named customers are, and the terms on which the note eventually converts.
Sources
- SecurityWeek: Cylake raises $245 million ahead of cybersecurity platform beta
- Globes: Nir Zuk's cybersecurity co Cylake raises $245m
- Pulse 2.0: Cylake raises $245 million through convertible note, bringing total funding to $290 million
- Globes: Nir Zuk's cybersecurity co Cylake launches with $45m
- Techzine: Founders of Palo Alto and SentinelOne launch security company Cylake
Filed under Cybersecurity. Written by InvestTimes Editorial under our editorial standards. Commentary and analysis for information only, not investment advice.
