April 2024 Cyber Funding & M&A Brief
Published by Pinpoint Search Group — the cybersecurity executive search firm that tracks every disclosed vendor funding round and acquisition in the sector.
At a glance
Get the full April 2024 dataset — every named company, round, investor, and segment.
What April told us
April 2024 was defined by one transaction. Thoma Bravo's $5.32B take-private of Darktrace is the largest single cyber M&A event the workbook has ever recorded. The deal reprices what a legacy public-cyber asset is worth to strategic and PE capital, and marks the moment the take-private playbook became a default option for the cohort of mid-cap cyber names that went public in 2018–2021. The rest of the month was steady — 46 transactions, $999M in disclosed funding, and 6 additional acquisitions, only one of which (Armis's $150M acquisition of Silk Security) came with a disclosed value. April also brought the sector's first IPO since 2021, with Rubrik's public-market debut.
On the funding side, late-stage platform vendors carried the month. Island raised $175M Series D for the enterprise browser category — the company's third disclosed round in the workbook and a continuing signal that the browser is becoming a controlled surface in its own right. Corelight raised $150M Series E in detection. ThreatLocker raised $115M Series D in endpoint allowlisting. All three were extensions of established stories rather than new entries.
The smaller Armis acquisition of Silk Security ($150M) is worth flagging. Silk had only raised a $12.5M Seed in August 2023 — another in the year's emerging pattern of 8-to-13-month Seed-to-strategic exits in cloud and detection categories. Armis is positioning itself as a strategic buyer this year (CTCI in February, now Silk in April), which is a meaningful shift from the company's prior IoT-focused independent trajectory.
Stage and segment breakdown
| Stage | Count |
|---|---|
| Seed | 14 |
| Series A | 9 |
| Series B | 7 |
| Series C | 1 |
| Series D+ | 3 |
| Growth Funding | 2 |
| Debt | 1 |
| Acquisition | 7 |
| Top segments | Transactions |
|---|---|
| Detection/Response | 7 |
| Data | 5 |
| GRC | 4 |
| Vulnerability | 4 |
| Segmentation | 3 |
| Training | 2 |
Two deals worth your attention
Thoma Bravo's $5.32B take-private of Darktrace. Thoma Bravo agreed to take Darktrace private at a 20% premium to the trading price, ending the company's run on the London Stock Exchange. The deal is the largest cyber M&A event of 2024 so far and a structural marker for how mid-cap public cyber names get repriced through PE-led private exits — joining the multi-year take-private thread that began with SailPoint, Ping Identity, and KnowBe4 in 2022 and continued through Magnet Forensics, Sumo Logic, and Absolute Software in 2023.
Island — $175M Series D led by Coatue. Island's enterprise browser raised $175M at a $3B valuation, the largest funding event of April. The round continued one of the cleanest multi-year arcs in the workbook: $115M Series B in 2022, $100M Series C in 2023, $175M Series D in 2024 — every round a category-defining moment for the enterprise browser as its own controlled surface.
Companies we've covered before
Island first appeared in March 2022 with a $115M Series B in Browser, returning in October 2023 with a $100M Series C in the same segment. The April 2024 $175M Series D is Island's third round in the workbook and one of the cleanest single-segment growth stories on the books.
ThreatLocker first appeared in May 2021 with a $20M Series B in Endpoint, returning in April 2022 with a $100M Series C. The April 2024 $115M Series D continues a textbook ramp inside Endpoint security — same segment, same investor pattern, larger checks each round.
Silk Security first appeared in August 2023 with a $12.5M Seed in Detection/Response. Eight months later, Silk exits to Armis for $150M — the shortest Seed-to-strategic arc in the workbook for an Armis transaction, and a clean data point for how cloud-detection capability is being priced inside this year's strategic windows.
The other 44 transactions are in the data feed — including the 7 acquisitions whose values never hit the press. Get April's details and more →
Methodology
Every transaction in this brief was sourced from a primary public report and dedupe-checked against the master Pinpoint funding workbook, which now contains ~2,600 transactions back to May 2020. Funding totals reflect disclosed capital only; acquisition values are included where publicly available.
Each deal is classified against Pinpoint's normalized cybersecurity segment taxonomy — read directly off what the company says they protect and mapped to one of the canonical segments. The taxonomy has been maintained continuously since 2020 and currently covers roughly 55 segments. Identity, Data, Detection / Response, and Threat Intel have been tracked from the first month of the series; AppSec and GRC entered the following month; emergent categories (AI/LLM, Supply Chain, Quantum, Browser) are added when they first appear in vendor positioning. That normalization layer is what makes multi-year, cross-segment comparisons possible against an otherwise inconsistent vocabulary in the broader market.
About Pinpoint Search Group
Cybersecurity innovators work with Pinpoint Search Group to identify, attract, and land professionals that enable maturation, scale, and successful outcomes. As start-ups continue raising millions in funding and established vendors make acquisitions to round out their offerings, Pinpoint Search Group is keeping track.
Get the underlying data
The narrative above is the free version. The paid Pinpoint Cyber Funding Data feed gives you every named transaction, every disclosed investor, every segment classification — exportable, filterable, and updated as the deals close.