Of the $491M raised this week, $326M went to Exein, Fortaegis and Arcos. None of the three has a CISO as the buyer. Exein bills device makers. Fortaegis bills whoever builds the server or the drone. Arcos bills the operator of the power plant. Four of the seven rounds were European, and those four took 70% of the money.
The radar shows the other side of it. Of the 57 product launches it caught this week, the bulk were software for the security team: AI SOC, agent guardrails, GRC copilots, a kill switch for agents. The launches go one way. The money went the other.
Look at who wrote the checks. Exein's round has the EIB Group and KfW Capital in it. Fortaegis has TNO, the Dutch state research organisation. Arcos was led by HTGF, which is part-funded by the German government, with Bayern Kapital alongside. This is sovereignty and defence money, and it does not buy dashboards. It buys things that go into machines, chips and sites, because that is what a government can point to. A CISO's budget pays for a security team. A defence budget pays for equipment. The second budget is bigger, and it just showed up.
If you are a European founder, the physical and sovereign angle is fundable right now at sizes that CISO-facing tools do not get. The price is your buyer. An OEM or a ministry takes 18 months, wants certification, and does not care about your 30-second pitch. If you sell to CISOs, look at the range this week: $19M to $72M for the rounds that did. That is a healthy market. It is just a different one.
Through the eyes of a CISO buyer, you will not evaluate Exein or Fortaegis. You will meet them inside the products you already buy, in the firmware of your OT vendor and the server you rack. The useful question for your next vendor review is: who does your device security, and is it a name? "We do it ourselves" is starting to be the wrong answer.
Where I could be wrong: one $270M round makes any week look like a trend. Take Exein out and the week is $221M, mostly AI governance and DLP, and the story is agents, same as last week. So the honest version is: watch the next two months. Two more physical rounds above $100M and this is a shift. None, and it was an outlier with a good cap table.
Where I land: the security team stopped being the only customer in cybersecurity, and the market noticed before the vendors did.
Radar signals
- Palo Alto Networks put Prisma SASE on monthly pay-as-you-go billing for MSPs on 17 September: daily metering, no quote, no purchase order. Consumption pricing has reached the biggest vendor in the category.
- Harmonic Security changed its homepage headline on 16 September from "Govern AI wherever your workforce runs it" to a rotating "Understand", "Control", "Enable" AI wherever your workforce runs it. Govern is out. Enable is in.
- Kiteworks launched an agent marketplace with more than 60 ready-to-use AI agents on 17 September, six days after buying Bonfy.AI. Last week's acquisition is already a product line.
- N-able told staff at its new Dundee office, opened 13 August, that their roles were moving to the Philippines. The reason given was AI adoption.
- Runlayer's job posts for GTM systems and marketing operations say the company plans to double headcount this year. Nobody announced that. The job ads did.
- ID Quantique co-founder Grégoire Ribordy said on 18 September that he has left the company after 25 years as CEO. It now sits under IonQ.
One question
If you are building or backing a company whose buyer is a security team: what happens when the OEM or the platform you run on decides to do your job in firmware? Reply and tell me who your buyer is in three years. The best replies get quoted, anonymously, next week.
Thank you for reading.
If you want more than the newsletter: get the full market picture on the Mandos platform, and if you are building or investing in this space, let's talk.
Talk to you next Monday.
Nikoloz