May 2026 Cyber Funding & M&A Brief
Published by Pinpoint Search Group — the cybersecurity executive search firm that tracks every disclosed vendor funding round and acquisition in the sector.
At a glance
Get the full May 2026 dataset — every named company, round, investor, and segment.
What May told us
May logged $694.2M in disclosed funding — up from $418M in April, but below the $1.13B we tracked in May of last year. The capital was broad and early: 19 of the month's 33 rounds were Seed or Series A, and the top of the table stayed modest, led by Exaforce's $125M Series B and Elliptic's $120M growth round. No single funded theme dominated. Where April had concentrated and June would run top-heavy, May spread its capital thin across a long tail of formation-stage companies.
On a disclosed-dollar basis, acquisition value outpaced new funding this month: the five priced deals totaled $797.9M against $694.2M of disclosed capital raised. The buyers were established security platforms rather than financial sponsors — Cisco (Astrix Security, $400M), Akamai (LayerX, $205M), KPIT (Cymotive, $120M), and Torq (Jit, $70M) all closed acquisitions, alongside undisclosed strategic deals from Zscaler (Symmetry Systems) and Check Point (Deepchecks). Identity and application-security targets accounted for most of the activity on the buy side.
Segment volume held to the pattern that has run through 2026: Identity led with seven transactions, followed by AppSec and AI/LLM at five apiece. Crypto-security also surfaced across the funded side, with Elliptic's $120M round and smaller raises for Turnkey and others — one of the more visible months for that category in the current cycle.
Stage and segment breakdown
| Stage | Count |
|---|---|
| Acquisition | 16 |
| Seed | 11 |
| Series A | 8 |
| Series C | 3 |
| Series B | 2 |
| Series D+ | 1 |
| Top segments | Transactions |
|---|---|
| Identity | 7 |
| AppSec | 5 |
| AI/LLM | 5 |
| Supply Chain | 4 |
| Crypto | 3 |
| Training | 3 |
Two deals worth your attention
Cisco's acquisition of Astrix Security — $400M. Astrix, a non-human and workload identity security vendor, was the largest disclosed acquisition of the month. The deal extends Cisco's identity-security push into the machine-identity problem — securing the service accounts, API keys, and automated agents that now outnumber human users in most enterprises. For Cisco it is a strategic capability addition to an existing security portfolio rather than a new-market entry.
Exaforce — $125M Series B led by a syndicate including HarbourVest, Peak XV, and Mayfield. Exaforce's AI-driven detection-and-response platform raised the single largest funding round of May. Coming roughly a year after its $75M Series A, the round is a fast escalation for a company applying large-model automation to security-operations workflows — one of the clearer expressions of the AI-in-the-SOC thesis drawing growth capital in the current cycle.
Companies we've covered before
Astrix Security first appeared in this series in February 2022 with a $15M seed round, followed by a $25M Series A in June 2023 and a $45M Series B in December 2024. May marks its exit to Cisco at $400M — a clean arc from early identity-security specialist to strategic acquisition, and a reclassification from Vulnerability to Identity as its non-human-identity positioning matured.
Exaforce first appeared in April 2025 with a $75M Series A, then classified under Automation. It returns this month with a $125M Series B, now classified Detection/Response — roughly thirteen months from one round to the next.
Socket has run a steady supply-chain-security escalation across the workbook: a $20M Series A in August 2023, a $40M Series B in October 2024, and now a $60M Series C in May 2026, holding its Supply Chain classification throughout.
LayerX, a browser-security vendor first tracked with a $7.5M seed in October 2022 and subsequent Series A rounds in May 2024 and April 2025, exits this month to Akamai at $205M.
The other 45 transactions are in the data feed. Get May's details and more →
Methodology
Every transaction in this brief was sourced from a primary public report and dedupe-checked against the master Pinpoint funding workbook, which now contains roughly 2,700 transactions back to May 2020. Funding totals reflect disclosed capital only; acquisition values are included where publicly available.
Each deal is classified against Pinpoint's normalized cybersecurity segment taxonomy — read directly off what the company says they protect and mapped to one of the canonical segments. The taxonomy has been maintained continuously since 2020 and currently covers roughly 55 segments. Identity, Data, Detection / Response, and Threat Intel have been tracked from the first month of the series; AppSec and GRC entered the following month; emergent categories (AI/LLM, Supply Chain, Quantum, Browser) are added when they first appear in vendor positioning. That normalization layer is what makes multi-year, cross-segment comparisons possible against an otherwise inconsistent vocabulary in the broader market.
About Pinpoint Search Group
Cybersecurity innovators work with Pinpoint Search Group to identify, attract, and land professionals that enable maturation, scale, and successful outcomes. As start-ups continue raising millions in funding and established vendors make acquisitions to round out their offerings, Pinpoint Search Group is keeping track.
Get the underlying data
The narrative above is the free version. The paid Pinpoint Cyber Funding Data feed gives you every named transaction, every disclosed investor, every segment classification — exportable, filterable, and updated as the deals close.