Why Cyera’s Latest Funding Haul Raises IPO-or-Sale Question

•
September 23, 2026    

See Also: What Are Your Maps Not Showing You?

The New York-based data security startup kicked the year off with a $400 million Series F round led by Blackstone at a $9 billion valuation to manage how artificial intelligence interacts with sensitive data. Then in June, Evolution Equity Partners led a $600 million Series G round for Cyera at a $12 billion valuation. And on Tuesday, Goldman Sachs led Cyera’s $400 million Series G extension at the same $12 billion valuation.

Taken together, Cyera has hauled in $1.4 billion in 2026 alone, surpassing Keyfactor, which received the largest single investment of the year when Summit Partners made a strategic growth investment in the Cleveland-based digital trust vendor. The only other cybersecurity vendor to receive an investment equal to one of Cyera’s 2026 funding rounds is NinjaOne, which got $400 million in June at a $12.3 billion valuation.

This is the second consecutive year Cyera has found itself on the cybersecurity funding podium, with its $540 million Series E round in June 2025 earning the company a bronze medal, behind only the $700 million identity governance vendor Saviynt received from KKR at a $3 billion valuation and the $636 million supply-chain security firm Chainguard got across two funding rounds at a $3.5 billion valuation.

With more than $2 billion in its coffers since being established in 2021 by longtime Israeli Military Intelligence leader Yotam Segev, Cyera has now raised more than Wiz, which hauled in $1.9 billion before being sold to Google in March for $32 billion in the biggest cybersecurity acquisition of all time. Cyera is the industry’s fourth most valuable private firm, behind only McAfee, NinjaOne and Proofpoint.

And what is Cyera spending this astronomical sum of cash on? Roughly $1 billion went toward the buy of non-human identity startup Oasis Security, which closed earlier this month and will help Cyera better understand who has access to data. It makes Cyera the youngest cyber firm ever to attempt a billion-dollar deal, with CrowdStrike never spending more than $630 million on a deal since its 2011 founding (see: Cyera Bets $1B on Non-Human Identity Security With Oasis Buy).

Wiz was aggressive from an M&A standpoint during its final years as an independent company, but it never spent more than $450 million on a single transaction, which is the amount Wiz paid for application security posture management startup Dazz in November. By the time of the Dazz buy, Wiz had exceeded $500 million in annual recurring revenue. Cyera reportedly had just $150 million in ARR as of June 2026.

Cyera’s heritage is in the data security posture management market. Then it expanded into data loss prevention in October 2024 through its $162 million acquisition of Trail Security. This year, Cyera has focused on extending control to agents acting on the data layer, giving enterprises the ability to track not just prompts and responses, but also the tool calls, database queries and actions in between.

“Should these agents be able to do everything, see everything you see? There should be limiting factors, but there’s nothing invented in the data to ever do that,” Cyera Chief Strategy Officer Jason Clark told ISMG in January.

And Cyera’s buy of Oasis will help organizations layer identity information on top of data to determine who’s accessing it, whether those users or service accounts should have access and where excessive permissions create unnecessary exposure, Clark told ISMG in July. The deal will help assess the permissions that identities possess and if those permissions introduce unnecessary risk.

“You got to understand the data, and you got to understand what’s the identity, what’s the permissions?” Clark told ISMG in July. “Is it an agent identity, a non-human identity, a service account, or is it Claude Code using a human identity? And then what are the permissions behind it, and then how do you reduce the risk?”

With this much money in the bank, Cyera now finds itself at a crossroads. Does Cyera want to pursue an initial public offering and preserve the opportunity to become a generational company such as Palo Alto Networks or CrowdStrike? While the IPO route is prestigious, it hasn’t been particularly lucrative in recent years for cybersecurity companies.

SailPoint returned to the public markets in February 2025 with a $12.8 billion valuation and a trading price of $23 per share, but today, the identity governance firm is worth just $12.1 billion and is trading at $21.22 per share. Netskope debuted in September 2025 at a $7.3 billion valuation and a trading price of $19 per share. Today, the SASE vendor is worth $7.6 billion and is trading at $18.54 per share.

Only Rubrik has enjoyed meaningful public market success, going from a valuation of $5.6 billion and a trading price of $32 per share during its April 2024 IPO to a valuation of $23.7 billion and a trading price of $114.14 per share in just 29 months. Investors expect cyber startups to reach at least $500 million in revenue before going public, so an IPO would likely be at least two years out for Cyera, if not more.

Alternatively, Cyera could cash in its chips and sell. The most private equity has ever paid for a pure play cyber vendor is $14.2 billion and Cyera would likely command significantly more than that given buyers typically pay at least a 50% premium on the most recently announced valuation. So, a strategic buyer would be the most likely home for Cyera.

Strategic buyers would need to navigate antitrust concerns given that most tech companies already have native investments in AI and data security. But given the more relaxed approach the Trump administration has taken to antitrust and the amount of greenfield around both AI and data security, most large tech firms could likely pursue Cyera without ending up in the crosshairs of regulators.

Cyera has to date been extremely aggressive from both a funding and M&A standpoint, but the go public versus sell decision will give industry observers a true sense of the company’s risk appetite.