2021 Cyber Security Vendor Funding Report
Published by Pinpoint Search Group — the cybersecurity executive search firm that tracks every disclosed vendor funding round and acquisition in the sector.
2021 Cyber Security Vendor Transaction Highlights
Get the full 2021 dataset — every named company, round, investor, segment, and acquisition.
Crunching the Numbers
- Early-stage funding (Seed, Series A) represented 42% of total funding volume.
- 65 funding rounds above $100M accounted for 71% of all capital raised while representing just 21% of funding volume.
Join our mailing list to receive quarterly report analysis
Highlights and Analysis
In 2021 our team tracked $20.55 billion in disclosed cybersecurity vendor funding across 305 rounds — the heaviest funding year the workbook has recorded. Capital was abundant and broadly distributed: 65 rounds of $100 million or more accounted for 71% of every dollar raised, and large late-stage rounds appeared across nearly every segment. It was the high-water mark of the expansion.
The counterweight to record venture inflows was the year private equity began consolidating public cybersecurity vendors at scale. Three public-to-private take-privates — McAfee's consumer business at $14 billion, Proofpoint at $12.3 billion (Thoma Bravo), and Mimecast at $5.8 billion (Permira) — totaled $32.1 billion, more than the entire year's disclosed venture funding.
Strategic consolidation ran in parallel. Avast's $8 billion merger with NortonLifeLock was the largest strategic cyber-to-cyber transaction the workbook has tracked, and Okta's $6.5 billion acquisition of Auth0 was the largest strategic acquisition of a private cyber vendor. Disclosed M&A across the year reached $66.62 billion — a total the private-equity activity alone largely explains.
Funding Overview
The $20.55 billion was concentrated in large rounds but spread widely by sector. Funding built through the year to a Q4 peak of $8.06 billion — the heaviest quarter the workbook has recorded — with nine-figure rounds landing in segments from cloud to OT/ICS.
Capital concentrated in the categories that were also drawing the most strategic attention:
- AppSec led funding — $3.87 billion across 29 rounds, anchored by Lacework's two rounds ($1.3 billion Series D and $525 million Series C) and Invicti's $625 million growth round. Lacework's $1.3 billion was the largest single funding round of the year.
- Identity drew the second-largest pool — $3.23 billion across 31 rounds, led by Transmit Security's $543 million Series A — the largest Series A the workbook has tracked — with Socure ($450 million) and Trulioo ($394 million) behind it.
- Detection and response scaled — $1.45 billion across 20 rounds, including Orca Security's $550 million Series C, as cloud-workload protection drew repeat investment.
- Nine-figure rounds were everywhere — 65 rounds of $100 million or more spanned OT/ICS (Claroty $400 million), cyber insurance, and fraud, the breadth that distinguishes 2021 from every other year in the workbook.
The breadth of large rounds — across stage and segment — is what marks 2021 as an outlier. It was the peak of the expansion, with capital available to almost any credible team.
Market & Macro Signals
A few dynamics defined where 2021's capital went.
Private equity became a structural force in cyber. Sponsors moved from occasional buyer to dominant acquirer, taking three public vendors private and carving out two more — McAfee's enterprise business ($4 billion to STG) and FireEye's products business ($1.2 billion to STG).
Identity and access drew capital from both sides. Investors funded Transmit Security, Socure, and Trulioo while Okta acquired Auth0 for $6.5 billion — the one category funders and acquirers agreed on.
Cloud-native security reached scale. Lacework, Orca Security, and others raised nine figures as enterprise workloads moved to the cloud and protection followed.
Consumer endpoint consolidated at the top. Avast/NortonLifeLock ($8 billion) and the two McAfee transactions concentrated consumer-facing endpoint security into fewer, larger owners.
M&A Activity & Strategic Moves
Disclosed M&A reached $66.62 billion across 39 priced transactions (of 161 total) — the heaviest disclosed M&A dollar year the workbook has tracked, driven overwhelmingly by private equity. The year's defining deals were the $14 billion take-private of McAfee's consumer business and Thoma Bravo's $12.3 billion acquisition of Proofpoint.
The priced deals partition cleanly by buyer type:
- PE take-privates led the dollars. McAfee Consumer ($14 billion), Proofpoint ($12.3 billion, Thoma Bravo), and Mimecast ($5.8 billion, Permira) took three public vendors private for a combined $32.1 billion.
- PE carve-outs followed. STG acquired McAfee's enterprise business ($4 billion) and FireEye's products business ($1.2 billion); TPG rolled Thycotic and Centrify — two private vendors — together for $1.4 billion.
- Strategic cyber-to-cyber consolidation. Avast/NortonLifeLock ($8 billion) and Okta/Auth0 ($6.5 billion) were the year's largest strategic transactions, the first a merger of public consumer-security vendors and the second a strategic acquisition of a private one.
- Non-cyber strategics bought identity and fraud. TransUnion/Neustar ($3.1 billion) and Mastercard/Ekata ($850 million) pulled identity-verification assets into credit and payments.
The throughline is private equity. More than half of the year's disclosed M&A dollars came from take-privates and carve-outs — the start of large-scale sponsor consolidation of public cybersecurity vendors.
The public-market window was open as well: five tracked vendors reached the public market in 2021 — KnowBe4 and Darktrace via IPO in April, SentinelOne in June, IronNet via SPAC merger in August, and ForgeRock in September — more than in any other year the workbook covers.
Looking Ahead
2021 set a high-water mark that will be difficult to repeat.
Heading into 2022, three questions stand out:
- Whether venture funding can sustain the pace — the breadth of nine-figure rounds set a bar that depends on continued capital availability.
- Whether private equity keeps consolidating — with five public-vendor take-privates and carve-outs in a single year, the supply of public targets is an open question.
- Whether identity stays the consensus category — it drew both the most strategic acquisitions and among the most funding.
2021 was the peak of an expansion — abundant capital, broad distribution, and the onset of large-scale private-equity consolidation. The year ahead will test which of those dynamics were cyclical and which were structural.
The full 2021 dataset — every named company, round, investor, segment, and acquisition — is in the data feed. Get the full 2021 dataset →
Methodology
Every transaction in this report was sourced from a primary public report and dedupe-checked against the master Pinpoint funding workbook, which now contains ~2,600 transactions back to May 2020. Funding totals reflect disclosed capital only; acquisition values are included where publicly available. Figures are workbook-derived and reflect ongoing corrections, so they may differ slightly from the originally published 2021 report.
Each deal is classified against Pinpoint's normalized cybersecurity segment taxonomy — read directly off what the company says they protect and mapped to one of the canonical segments. The taxonomy has been maintained continuously since 2020 and currently covers roughly 55 segments. That normalization layer is what makes multi-year, cross-segment comparisons possible against an otherwise inconsistent vocabulary in the broader market.
About Pinpoint Search Group
Cybersecurity innovators work with Pinpoint Search Group to identify, attract, and land professionals that enable maturation, scale, and successful outcomes. As start-ups continue raising millions in funding and established vendors make acquisitions to round out their offerings, Pinpoint Search Group is keeping track.
Get the underlying data
The narrative above is the free version. The paid Pinpoint Cyber Funding Data feed gives you every named transaction, every disclosed investor, every segment classification — exportable, filterable, and updated as the deals close.