July 2026 Cyber Funding & M&A Brief
Published by Pinpoint Search Group — the cybersecurity executive search firm that tracks every disclosed vendor funding round and acquisition in the sector.
At a glance
Get the full July 2026 dataset — every named company, round, investor, and segment.
What July told us
July opened the third quarter at $1.56B in disclosed funding across 47 transactions — a third more capital than the $1.17B we logged in July of last year, on exactly the same transaction count, and just below June's $1.68B. It is the first time in 2026 that two consecutive months have each cleared $1.5B in disclosed funding. But the month's single largest transaction was not a funding round. It was an acquisition: Cyera, the data-security vendor whose $600M round led last month's brief, turned buyer in July and acquired identity-security company Oasis Security for $1B — the largest cyber M&A event of the month and only Cyera's second acquisition on record.
The funding side was broad but top-heavy. The six largest rounds — Spur ($200M, Threat Intel), ThreatLocker ($190M, Endpoint), Glow ($180M, Endpoint), Cathedral ($160M, Offensive Cyber), Onyx Security ($113M, GRC), and Neo Security ($100M, AI/LLM) — together account for more than half of the month's disclosed capital, with Endpoint claiming two of the three largest (ThreatLocker and Glow). Below the headline rounds the month was early-stage: 25 of the 38 funding rounds were Seed or Series A, the same formation-stage distribution that has held across 2026. What stands out is the size at that early stage — Glow's $180M Series A is the third-largest Series A the workbook has recorded in six years.
Identity was the most-transacted segment of the month with eight deals, spanning both new funding and the Cyera–Oasis acquisition. Detection/Response (five), GRC (four), Security Services and Vulnerability (three each) followed. Where the largest checks landed, they spread across categories rather than clustering — Threat Intel, Endpoint, Offensive Cyber, GRC, and AI/LLM each anchored a nine-figure round — while transaction volume concentrated in Identity, the segment that has led 2026 deal flow and continued to do so into the summer.
Stage and segment breakdown
| Stage | Count |
|---|---|
| Acquisition | 9 |
| Seed | 15 |
| Series A | 10 |
| Series B | 4 |
| Series C | 1 |
| Series D+ | 1 |
| Top segments | Transactions |
|---|---|
| Identity | 8 |
| Detection/Response | 5 |
| GRC | 4 |
| Security Services | 3 |
| Vulnerability | 3 |
| Fraud | 2 |
Two deals worth your attention
Cyera — $1B acquisition of Oasis Security. A month after raising $600M, Cyera became an acquirer, buying Oasis Security — a specialist in managing machine and non-human identities — for $1B. It is the largest cyber M&A event of July and Cyera's second acquisition in the workbook, following its $162M purchase of Trail Security in October 2024. The deal extends Cyera beyond its data-security base into identity, and it consolidates two companies this series has tracked from early venture rounds: a data platform scaling by acquisition, absorbing an identity vendor that had itself raised four times since 2024. With machine identities now outnumbering human ones inside most enterprises, expect further consolidation as platform vendors move to own the non-human identity layer.
Glow — $180M Series A led by Sequoia, with Cyberstarts, Greenoaks, and Redpoint. Glow's round is the third-largest Series A the workbook has recorded in six years, behind only Transmit Security's $543M (2021) and Armadin Security's $189.9M earlier this year, and one of just seven nine-figure Series A rounds in the entire series. A raise of this size at Series A reflects the premium investors are placing on endpoint security talent and early traction, and places Glow among the most heavily capitalized early-stage vendors we track. Endpoint took two of the month's three largest funding rounds — ThreatLocker's $190M and Glow's own $180M — a category that has drawn steady late- and early-stage capital through 2026.
Companies we've covered before
Cyera and Oasis Security. Cyera first appeared in this series in March 2022 with a $60M round classified under Data, then returned repeatedly — $100M in June 2023, $300M in March 2024, $300M again that November, $500M in May 2025, $400M in December 2025, and $600M in June 2026 — scaling from early venture to platform incumbent inside the workbook. Oasis Security ran a parallel arc on the identity side: a $35M Series A in January 2024, another $35M in May 2024, and a $120M Series B in March 2026. July's $1B deal joins the two records — one of the cleaner illustrations in the series of a workbook-tracked platform acquiring a workbook-tracked specialist.
ThreatLocker. One of the longest-running independent endpoint vendors in the series, ThreatLocker first appeared with a $20M Series B in May 2021, followed by a $100M Series C in April 2022 and a $115M Series D in April 2024. July's $190M round continues an unbroken multi-year escalation and keeps the company independent as much of the endpoint category consolidates around it.
Onyx Security. Onyx first appeared just four months ago, with a $40M Series A in March 2026 classified under GRC. July's $113M Series B roughly triples that raise, making Onyx one of the fastest-escalating vendors in the current cycle.
The other 44 transactions are in the data feed. Get July's details and more →
Methodology
Every transaction in this brief was sourced from a primary public report and dedupe-checked against the master Pinpoint funding workbook, which now contains roughly 2,700 transactions back to May 2020. Funding totals reflect disclosed capital only; acquisition values are included where publicly available.
Each deal is classified against Pinpoint's normalized cybersecurity segment taxonomy — read directly off what the company says they protect and mapped to one of the canonical segments. The taxonomy has been maintained continuously since 2020 and currently covers roughly 55 segments. Identity, Data, Detection / Response, and Threat Intel have been tracked from the first month of the series; AppSec and GRC entered the following month; emergent categories (AI/LLM, Supply Chain, Quantum, Browser) are added when they first appear in vendor positioning. That normalization layer is what makes multi-year, cross-segment comparisons possible against an otherwise inconsistent vocabulary in the broader market.
About Pinpoint Search Group
Cybersecurity innovators work with Pinpoint Search Group to identify, attract, and land professionals that enable maturation, scale, and successful outcomes. As start-ups continue raising millions in funding and established vendors make acquisitions to round out their offerings, Pinpoint Search Group is keeping track.
Get the underlying data
The narrative above is the free version. The paid Pinpoint Cyber Funding Data feed gives you every named transaction, every disclosed investor, every segment classification — exportable, filterable, and updated as the deals close.