Cylake secures $245m before beta as sovereign cybersecurity bet gets enormous

Cylake has secured $245 million through a convertible note from investors including Lightspeed Venture Partners, Picture Capital and Redpoint Ventures, taking total financing to $290 million before the company’s cybersecurity platform has even reached beta. The financing follows a $45 million seed round led by Greylock Partners in March and will fund product development and hiring as Cylake builds an AI-native platform for governments and heavily regulated organizations that require their security infrastructure to remain on premises or inside private cloud environments. Beta is expected by the end of 2026 and full general availability in 2027, meaning investors are committing an unusually large amount of capital before broad commercial launch. Because the latest financing is a convertible note and Cylake did not disclose conversion terms, valuation cap, discount, maturity or interest rate, the $245 million amount cannot reliably be translated into a new company valuation.

The company was co-founded by Nir Zuk, Wilson Xu and Ehud Shamir, giving it unusually recognizable cybersecurity pedigree before product availability. Zuk founded Palo Alto Networks, while the broader founding team includes engineers and operators with substantial experience building enterprise security products. Cylake has already grown beyond 40 employees and is working with design partners ahead of beta, but it has not disclosed revenue, annual recurring revenue, contracted backlog or named customers.

Why is $245 million through a convertible note different from a conventional funding round?

A priced equity round tells the market how much investors believe the company is worth by disclosing the price paid for a defined ownership stake. A convertible note postpones some of that valuation determination because the security generally converts into equity under future terms, often around another financing or specified event.

Cylake has disclosed the amount and participating investors but not the conversion mechanics required to infer valuation. It would therefore be incorrect to claim that the $245 million round establishes a particular multibillion-dollar valuation simply because the financing amount is unusually large.

The structure can be useful when a company expects major value-changing milestones in the near future. Cylake plans to release beta before year-end and reach general availability in 2027, meaning a priced round after customer deployments could produce a more informed valuation than one completed while the product remains under development.

For investors providing the note, the attraction rests heavily on the team and perceived market opportunity. They are funding execution before public evidence exists around retention, pricing, margins or scale.

That makes the financing a strong signal of investor conviction but a weak signal of product-market fit by itself.

Why is Cylake betting against the public-cloud model used by much of modern cybersecurity?

Cylake is targeting organizations for which public cloud can create unacceptable sovereignty, regulatory or operational concerns. Its platform is intended to operate entirely on premises or inside private cloud environments so customers maintain direct control over security data, infrastructure and operations.

That approach runs counter to a long cybersecurity trend toward cloud-delivered platforms that aggregate telemetry from thousands of customers. Cloud architecture can improve deployment speed and give security vendors enormous centralized datasets for threat detection, but it can create problems for defence, government, critical infrastructure and other highly regulated organizations that cannot permit sensitive operational information to leave controlled environments.

Cylake argues that AI makes the data question even more important. Security agents become more capable when they have access to a complete view of identities, endpoints, networks and other telemetry, yet the most sensitive customers may be least willing to transmit that data to an external cloud.

The company is therefore attempting to combine AI-native security with sovereignty rather than forcing customers to choose between the two. Its unified data foundation is supposed to provide broad context without requiring organizations to surrender operational control.

The trade-off is operational complexity. Cloud security companies can update one centralized service continuously, while on-premises and private deployments may need to work across more fragmented customer infrastructure. Cylake must prove it can preserve the advantages of rapid AI-driven product iteration even when the deployment architecture is deliberately decentralized.

Does Nir Zuk’s track record justify $290 million of funding before general availability?

Founder credibility can reduce one category of startup risk because experienced security executives understand enterprise sales cycles, product architecture and how incumbents can be displaced. Nir Zuk’s history building Palo Alto Networks naturally gives investors confidence that Cylake’s team understands both the technology and commercial mechanics of large cybersecurity platforms.

It cannot eliminate product risk. Enterprise security is considerably more crowded than when Palo Alto Networks began challenging legacy firewall vendors, with Microsoft, CrowdStrike, Palo Alto Networks, Cisco, Fortinet, Wiz and numerous specialists already competing for consolidated platform spending.

The $290 million capital base gives Cylake the ability to hire senior engineers, support large design partners and build multiple security functions before generating meaningful revenue. It also raises the performance threshold because investors are funding the company at a scale more typical of a business already demonstrating commercial traction.

That tension makes the next six to twelve months unusually important. A successful beta with respected regulated customers could make the financing look prescient, while repeated launch delays would leave an enormous amount of capital committed to a thesis not yet commercially validated.

The founders may have earned the opportunity to attempt something large. The funding does not mean the market has already proved them right.

What should matter more than Cylake’s next valuation?

The first useful metric is the number and quality of design partners converting into paying customers. Cylake says it is working with leading organizations but has not identified them publicly, meaning general availability will need to bring greater evidence around actual deployments.

The second is the breadth of the platform. Cylake is describing a complete cybersecurity architecture rather than one narrow security product, which can increase customer value but makes execution considerably harder before launch.

Third, buyers need evidence that sovereignty does not weaken detection quality. Running AI and analytics inside customer-controlled infrastructure is strategically appealing only if the platform can identify threats as effectively as centralized cloud competitors.

Fourth, investors should watch capital efficiency. More than $290 million has already been secured with only around 40-plus employees disclosed, giving Cylake unusual flexibility. A business that converts that capital into a differentiated platform and large regulated customers can justify the early funding; one that simply builds a large cost base before product-market fit cannot.

Cylake has already won the financing race before entering the commercial one.

The second race matters much more.