Rising in Cyber 2024: Emerging Themes
By Glenn Solomon, Oren Yunger, Dan Cahana, and Laura Hamilton
The Rising in Cyber survey of more than 100 security leaders revealed three innovation drivers needed by security teams to adapt to a growing footprint of technologies, the rise of AI, and the evolving sophistication of cyber criminals. These themes - identity and access management, cloud security, and application and code security -provide a glimpse into the future buying patterns of CISOs.
The year is off to a hot start, with 216 deals amounting to $2.9B in financing announced in Q1 alone (up from 170 deals during Q1 2023). M&A activity was also vibrant—64 deals amounting to $18.3B show that this space is not just taking equity dollars but creating value. We expect this momentum to continue as organizations look to enhance their resiliency and overall security posture.
High-profile data breaches—such as AT&T’s 73 million impacted customers and a hacking group, “BlackCat,” breaching UnitedHealth Group’s system—highlight the ongoing need for robust solutions to stop bad actors. Additionally, in 2023 the SEC introduced a new rule requiring all public companies to disclose a cybersecurity breach within four days and provide information on their risk management posture. With increased regulatory scrutiny and a push to protect consumers, it’s no surprise that companies are spending more to stay secure.
Surveying more than 100 security leaders, we identified three key themes from this year's Rising in Cyber list, and anticipate that CISOs will continue to seek solutions for these themes and startups will continue innovating around them.
1. Identity and access management
According to CrowdStrike’s Global Threat Report, identity-centric, malware-free attacks constituted 75% of incidents in 2023—a significant increase from just 40% in 2019. Attackers are finding new ways to break systems, and employee churn exacerbates the problem with ill-equipped training and a remote-first working environment. Cyberattacks, like the vishing breach of MGM’s help desk that caused outages in internal networks, ATMs, and electronic payment systems, underscore the need for security beyond simple identity access to robust access controls and authentication.
The security industry has adapted to the transition to the cloud, providing organizations with new infrastructure. However, current IAM solutions provide a baseline layer but lag behind rapidly changing human identities and an increasing number of non-human ones. An employee typically has more than 30 identities, while machines outnumber humans by 45x.
The bottom line: We believe that one of the most effective actions a CISO can take today is to enhance the company’s identity management strategies in collaboration with engineering and IT leaders. We are enthusiastic about the rising identity ecosystem, which is creating opportunities for newcomers like the startups on this list.
2. Cloud security
Cloud security has seen tremendous growth, with posture management initially driving the market and customers now seeking broader solutions. Cloud spend on the hyperscalers has already crossed $200B run rate, with Gartner predicting that more than 50% of enterprises will use cloud platforms as a business necessity by 2028. Until a few years ago, Gartner lacked a detailed cloud security market forecast. More recently, categories like CNAPP, CASP, and CSPM have become central to their reports, and new categories emerge every year.
Feedback from CISOs is clear—large incumbents are unable to cover the fast-moving pace of cloud innovation and CISOs need new tools. Companies that originally focused on posture management are expanding into runtime security, as shown by Wiz's acquisition of Gem Security*. Similarly, runtime security companies like CrowdStrike are enhancing their posture capabilities by acquiring companies like Flow Security. It is also clear that SaaS is becoming an integral part of companies’ cloud footprint and cannot be overlooked or considered as just an “IT problem.” The cloud security evolution highlights the growing demand for comprehensive, end-to-end security platforms that address the diverse needs of modern cloud security practices, drive vulnerabilities to insights, and insights to remediation.
The bottom line: Looking ahead, we anticipate an increase in the adoption of cloud security technologies and continued innovation from startups. We are already seeing a rise in companies focused on AI threat detection, automation to support both rising compliance needs as well as incident remediation, vulnerability management, and data protection.
3. Application and code security
The proliferation of SaaS applications built with open source is significantly expanding the global application security market. Approximately 90% of application code is sourced from open-source libraries, enhancing development speed but complicating maintenance. Tools like GitHub Copilot could heighten security risks if it’s trained on open-source projects with vulnerabilities, leading to suggestions that may include compromised code. Despite the use of tools like static application security testing (SAST) and software composition analysis (SCA), security teams still face challenges detecting vulnerabilities in open-source and third-party components.
We're also seeing innovation in AppSec through the introduction of AI. New startups are leveraging AI to integrate security in the application planning phase, improve security code remediation, and provide better coverage with penetration testing tools. We believe that AI can enable better collaboration between developers and security teams, which in turn will lead to enhanced security efforts across applications. Every AppSec company on the Rising in Cyber list found success through a developer-centric motion, bridging the gap between security and developer teams. With 52 deals completed in 2023 along with $4B in AppSec M&A deal volume, we anticipate continued investment and innovation in the sector.
The bottom line: Developers have started to “shift left,” moving security testing earlier in the development pipeline. In order to do so effectively, AppSec tools need to be built with both developers and security in mind. There's a promising market for startups focused on deeper vulnerability detection, earlier integration of security measures, and real-time monitoring.
*Represents a company in Notable Capital’s portfolio