Several macro trends help explain where capital flowed in 2025, and why.

AI adoption is outpacing governance and identity controls

Across enterprises, AI deployment accelerated rapidly in 2025. What emerged alongside that acceleration was a growing realization: governance, identity, and control frameworks are lagging far behind usage. Organizations are adopting AI agents, automation tools, and data-driven workflows faster than they can define access boundaries, policy enforcement, or accountability.

This gap is visible in the funding data. A notable share of companies categorized under GRC are positioning themselves not as traditional compliance tools, but as control layers for modern, AI-driven environments — addressing issues such as policy enforcement, auditability, third-party exposure, and identity sprawl. The clustering of capital into these vendors suggests that investors and founders alike see governance not as a back-office function, but as a prerequisite for scalable AI adoption.

Identity remains the control plane for modern risk

Identity continued to assert itself as a central pillar of cybersecurity investment. As cloud complexity, AI usage, and third-party access expand, identity increasingly functions as the primary enforcement point for risk management.

Rather than representing a standalone category, identity has long operated as a connective layer across cloud, data, fraud, and governance. What funding patterns in 2025 reinforce is not identity’s importance, but its role as the control plane through which modern security decisions are enforced — shaping access, accountability, and policy execution across the stack.

This framing helps explain why identity-aligned platforms continue to attract capital even as category boundaries blur and buyers prioritize outcomes over tools.

Fraud, OT/ICS, and critical infrastructure stay in focus

Digital fraud remains industrialized, even as individual attack vectors evolve. Investment in fraud prevention and detection reflects persistent pressure from financial losses, regulatory scrutiny, and reputational risk. Similarly, continued funding in OT/ICS and critical infrastructure security aligns with real-world incidents and heightened awareness of systemic exposure beyond traditional IT environments.

Budgets are rising but concentration is increasing

While overall cybersecurity spend continues to grow globally, budget growth at the enterprise level remains constrained. The result is spend concentration: fewer vendors, larger contracts, and greater scrutiny. This dynamic reinforces why platforms capable of delivering measurable outcomes — rather than incremental features — attracted disproportionate investment in 2025.