July 2022 Cyber Funding & M&A Brief
Published by Pinpoint Search Group — the cybersecurity executive search firm that tracks every disclosed vendor funding round and acquisition in the sector.
At a glance
Get the full July 2022 dataset — every named company, round, investor, and segment.
What July told us
July 2022 was the lowest-volume month of 2022 so far — 20 transactions, 13 funding rounds, and $590.6M in disclosed capital. The drop in activity reflected a seasonal Q3 slowdown more than a structural finding; the prior years' July data sets had run similarly thin. Coalition's $250M Series D+ in Cyber Insurance was the largest funded round, the company's fourth workbook event after three rounds across 2021. Halborn at $90M Series A in Crypto and Bishop Fox at $75M Series B in Vulnerability rounded out the named funded cohort.
Coalition's fourth round is worth flagging on its own. The company had cleared a $175M Series D+ in March 2021, a $205M Series D+ in September 2021, and another $205M Series D+ in October 2021, all in Cyber Insurance — a four-round single-segment arc with consistently large round sizes over roughly 16 months. The July 2022 $250M extends the trajectory and is the largest Cyber Insurance round the workbook had tracked at that point.
M&A column held volume relative to the funded side. Seven acquisitions cleared, led by Thales's $118M pickup of OneWelcome in Identity — a European defense-cyber buyer extending consumer-identity coverage — and Huntress's $22M acquisition of Curricula in security training. The remaining five M&A events cleared without disclosed values. The month also marked the AI/LLM segment's first appearance in the workbook taxonomy — HiddenLayer's $6M Seed for its machine-learning model security platform, the only AI/LLM-tagged transaction of the month and a small-cap debut entry for a category that was still pre-investable at the broader market level.
Stage and segment breakdown
| Stage | Count |
|---|---|
| Seed | 4 |
| Series A | 2 |
| Series B | 4 |
| Series C | 1 |
| Series D+ | 1 |
| Merger | 1 |
| Acquisition | 7 |
| Top segments | Transactions |
|---|---|
| GRC | 3 |
| Vulnerability | 3 |
| Training | 2 |
| Identity | 2 |
| Crypto | 2 |
| SASE | 1 |
New segment in the taxonomy this month: "AI/LLM" enters the Pinpoint segment taxonomy for the first time in July 2022. Emergent categories are added when they first appear in vendor positioning; this is the first workbook event in this classification.
Two deals worth your attention
Coalition — $250M Series D+ in Cyber Insurance. Coalition raised $250M Series D+ for its cyber insurance MGA platform, the largest funded round of July and the company's fourth workbook event. The round followed three Series D+ events across 2021 — $175M in March, $205M in September, and $205M in October — making Coalition the workbook's clearest four-round single-segment arc inside Cyber Insurance over a roughly 16-month window.
Thales's $118M acquisition of OneWelcome. Thales acquired OneWelcome at $118M, the largest disclosed M&A event of July. The deal extended Thales's customer identity coverage and is the second 2022 European-defense-cyber strategic move into Identity after the broader buyer's prior activity in adjacent categories. The deal was small by 2022 M&A standards but the only nine-figure transaction in an otherwise quiet month.
Companies we've covered before
Coalition first appeared in March 2021 with a $175M Series D+ in Cyber Insurance, returning in September 2021 with a $205M Series D+ and October 2021 with another $205M Series D+ in the same segment. The July 2022 $250M Series D+ is Coalition's fourth tracked event — same segment classification across all four — and the largest of the series.
Swimlane first appeared in January 2021 with a $40M Series B in XDR. The July 2022 $70M Series C is Swimlane's second tracked event, same segment classification, and a clean B-to-C step-up inside next-generation SOAR.
The other 18 transactions are in the data feed — including the 7 acquisitions whose values never hit the press. Get July's details and more →
Methodology
Every transaction in this brief was sourced from a primary public report and dedupe-checked against the master Pinpoint funding workbook, which now contains ~2,600 transactions back to May 2020. Funding totals reflect disclosed capital only; acquisition values are included where publicly available.
Each deal is classified against Pinpoint's normalized cybersecurity segment taxonomy — read directly off what the company says they protect and mapped to one of the canonical segments. The taxonomy has been maintained continuously since 2020 and currently covers roughly 55 segments. Identity, Data, Detection / Response, and Threat Intel have been tracked from the first month of the series; AppSec and GRC entered the following month; emergent categories (AI/LLM, Supply Chain, Quantum, Browser) are added when they first appear in vendor positioning. That normalization layer is what makes multi-year, cross-segment comparisons possible against an otherwise inconsistent vocabulary in the broader market.
About Pinpoint Search Group
Cybersecurity innovators work with Pinpoint Search Group to identify, attract, and land professionals that enable maturation, scale, and successful outcomes. As start-ups continue raising millions in funding and established vendors make acquisitions to round out their offerings, Pinpoint Search Group is keeping track.
Get the underlying data
The narrative above is the free version. The paid Pinpoint Cyber Funding Data feed gives you every named transaction, every disclosed investor, every segment classification — exportable, filterable, and updated as the deals close.