33N backed founders and team at a dinner last week in RSA.

TL;DR:

Quantum computing remains years away from practical advantage, but the cryptographic threat it poses is already here.

“Harvest now, decrypt later” attacks - where adversaries collect encrypted data today to crack it once quantum hardware matures - are a live concern for any organisation holding sensitive long-lived data. In response, regulatory deadlines are tightening across the world.

Crypto agility, the ability to discover, inventory, and swap cryptographic assets rapidly, is an essential need to prepare for the coming changes in paradigm.

At 33N, we’ve been spending time mapping the quantum landscape - not just the physics, but where it intersects with cybersecurity. It’s a space full of bold claims and uncertain timelines, so we wanted to share what we’ve found: what the real state of maturity is, what the threat actually looks like, and where enterprises and investors should focus today.

TLS certificate lifespans dropped from 398 days to 200 and will gradually reduce to 47 days by 2029 ^[18]. Cloudflare became the first SASE platform to ship post-quantum encryption across its entire stack — pushed automatically to customers, no configuration required ^[19]. D-Wave closed a $550M acquisition of Quantum Circuits to bring error-corrected quantum systems to market ^[20]. And Microsoft is preparing to deliver its first error-corrected quantum computers to customers this year ^[21].

The quantum era isn’t here yet — but the infrastructure shift it demands has already begun.

Quantum Computing - Where Are We Really?

Quantum computing is a fundamentally different way of processing information. Instead of classical bits (0 or 1), quantum computers use qubits that can exist in superposition - representing multiple states simultaneously - and leverage entanglement to create computational methods with no classical equivalent. But quantum computers are not simply faster supercomputers. They offer speedups only for specific classes of problems - cryptography, quantum simulations of molecules and materials, and certain optimization tasks. For everyday computing, classical machines remain superior. The industry is increasingly moving toward specialized quantum hardware designed for narrow problem sets rather than general-purpose machines. ^[1]

In practice, the technology is still gated by hardware maturity. Useful quantum computing depends on scaling up qubit counts, extending coherence times (how long qubits maintain their quantum state), and - critically - achieving reliable error correction.

One recent push has been the shift towards abstraction from focusing on physical qubits to logical qubits (groupings of logical qubits) to address these issues. ^[1]

Figure 1: Distinction Physical and Logical Qubits (Intro to Quantum)

Still, current quantum systems fit the called NISQ (Noisy Intermediate-Scale Quantum computer) class, meaning they are noisy, fragile, and limited in scope.

What exists today are mostly hybrid approaches: classical computers handle the bulk of processing and call on quantum hardware for specific subproblems. This has led to early demand for orchestration and scheduling software to manage these hybrid workflows, though the real-world adoption of these tools remains nascent. ^[24]

Most roadmaps suggest that practical quantum advantage - quantum computers consistently outperforming classical ones on useful tasks - is still five to fifteen years away, with wide disagreement on timelines. ^[2]

The quantum computing market is estimated at roughly $1–3.5 billion in 2025, with projections varying from $4 billion to $20 billion by 2030 depending on the source - reflecting genuine uncertainty about how quickly the technology will commercialize. ^{[3] [4] [5]}

A recent paper in Science described quantum technology as having reached “equivalent of the early transistor age” — functional systems exist, but scaling them requires major engineering breakthroughs ^[23]. Microsoft (in collaboration with Atom Computing) plans to deliver an error-corrected machine to research partners in Denmark, while QuEra plans to make error-corrected systems available to global customers — both targeting 2026 ^[20][21].

But as QuEra’s own chief commercial officer put it:

It’s also worth noting that this is a space highly sensitive to headlines. When Jensen Huang commented at CES in January 2025 that practical quantum computers were “at least 15 years away,” quantum stocks plunged - Rigetti fell around 40%, IonQ dropped around 35%, and billions in combined market cap evaporated in a single day. ^[6] Two months later, Huang hosted a “Quantum Day” at Nvidia’s GTC conference to walk it back. ^[7]

The episode illustrates how much hype, rather than fundamentals, still drives the space.

The space of quantum computing and quantum related solutions is too vast for us to be able to cover every segment here but these are some companies that we came across while looking at the ecossystem: Qilimanjaro, Multiverse Computing, Alice & Bob, Entanglement, Quside, Wultra, Quantropi

If you are interested in learning more about Quantum Computing we strongly recommend the following article from V. Raseena.

The Quantum Threat to Cryptography

The clearest near-term impact of quantum computing isn’t about giving enterprises new computational power - it’s the threat to current encryption.

Most modern encryption depends on asymmetric cryptography (RSA, ECC), which is built on mathematical problems that are extremely hard for classical computers to solve.

Quantum computers, once mature enough, could break these in polynomial time using algorithms like Shor’s. ^[25]

Symmetric encryption (such as AES) is far less vulnerable - Grover’s algorithm only provides a quadratic speedup, meaning larger key sizes are sufficient to maintain security. ^{[26] [29]}

The real threat is to asymmetric cryptography. ^{[27] [12]}

Figure 2: Quantum computing primarily threatens asymmetric encryption.

But here’s the critical insight: you don’t need quantum computers to exist yet for the threat to be real and already relevant.

In what’s known as a “harvest now, decrypt later” attack, adversaries intercept and store encrypted data today, waiting until quantum hardware matures enough to crack it.

For any data with long retention requirements - government records, financial transactions, health data, intellectual property - this is a live concern right now. ^[30][31]

A 2025 industry survey found that 60% of organizations are already very concern about these tactics. ^[8] With NIST seeing this as threat that justifies immediate migration and making the following joint recommendation alongside NSA and CISA:

Figure 3: The harvest now, decrypt later threat - data stolen today can be decrypted once quantum hardware matures.

Regulatory bodies have taken notice. NIST published its first post-quantum cryptography standards in August 2024. ^[9] In the US, federal agencies must support TLS 1.3 by January 2030, national security systems must be fully CNSA 2.0 compliant by 2031, and NIST plans to deprecate and disallow quantum-vulnerable algorithms entirely by 2035. ^{[10] [11] [12]} Australia targets 2030 for eliminating classical public-key cryptography. ^[13] The EU’s coordinated roadmap targets 2030 for high-risk systems and 2035 for broader completion.

The direction is clear, and the migration timeline itself creates urgency regardless of when a cryptographically relevant quantum computer actually arrives.

Three Approaches to Quantum-Safe Cryptography

The industry is converging on three main approaches to quantum-safe cryptography, each with distinct trade-offs.

Post-Quantum Cryptography (PQC) refers to new encryption algorithms - that run on classical hardware and are designed to resist quantum attacks. NIST standardized the first set in August 2024 after an eight-year global review involving industry, academia, and governments. ^[9] They’re software-based and relatively cost-effective to deploy.

The catch: like all encryption, these algorithms cannot be mathematically proven secure - they represent the best candidates based on rigorous peer review, but they’re newer and less battle-tested than the algorithms they replace. They’re also prone to larger key-sizes which brings integration concerns and can impact performance in certain systems.

Quantum Key Distribution (QKD) takes a physics-based approach. Instead of relying on mathematical hardness, it uses quantum mechanics (specifically, the behavior of photons) to distribute encryption keys. Any attempt to intercept the key disturbs the quantum state and is detectable. In theory, it’s provably secure.

In practice, it’s expensive, requires dedicated fiber infrastructure, and fiber-QKD is range limited. Government agencies have been notably cautious: the US NSA explicitly does not support the use of QKD for national security communications, ^[14] the UK’s NCSC has stated it will not support QKD for government or military applications, ^[15] and a joint 2024 position paper by France’s ANSSI, Germany’s BSI, and agencies from the Netherlands and Sweden concluded that QKD is not yet sufficiently mature from a security perspective. ^[16]

That said, China is actively investing in QKD infrastructure - China has deployed a 10,000+ km QKD network - creating a real geopolitical split in approaches. ^[17][36]

Some solutions also incorporate pre-shared symmetric keys (PSK) for additional security layers - an approach endorsed by the NSA for classified systems through its Commercial Solutions for Classified (CSfC) program. Unlike PQC (math-based) or QKD (physics-based), symmetric key approaches rely on securely delivering shared random data out-of-band, which is logistically complex but can provide strong security guarantees when implemented correctly.

Authorities broadly recommend a hybrid combination for deploying PQC, using classical algorithms alongside it during the transition. ^[37]

The real question for most enterprises isn’t which algorithm to pick - it’s how to manage the transition.

A few players in these spaces: PQShield, KETS Quantum Security, SpeQtral, QuantumBridge, Arqit Group.

What’s Actionable Right Now - Crypto Agility

For all the uncertainty around quantum timelines, from our conversations with experts and market participants, crypto agility consistently surfaces as one of the most practical and immediate area of focus - both as a standalone capability and as the foundation for any future PQC migration.

Crypto agility is the ability of an organization to replace its existing cryptographic primitives, algorithms, or protocols with alternatives quickly and without business disruption.

It’s a concept that predates quantum concerns, but the risks posed by “harvest now, decrypt later” and impending Q-Day fears put this on top of the mind of security leaders.

Before an organization can migrate to quantum-safe algorithms, it needs to answer a deceptively simple question: what cryptography are we actually using, and where?

In practice, most enterprises don’t have this visibility. According to a 2025 industry report, only 28% of organizations maintain a full certificate inventory, and just 13% are confident they track all certificates - including rogue ones deployed outside official processes. ^[8] Without that visibility, any migration effort is flying blind.

This matters beyond quantum. Certificate lifespans are already shrinking fast. In April 2025, the CA/Browser Forum voted to reduce TLS certificate lifespans on a phased schedule: 200 days from March 2026, 100 days from March 2027, and 47 days from March 2029. ^[18]

This makes automated certificate lifecycle management an operational necessity - and crypto agility the foundation for handling both the quantum transition and the day-to-day reality of modern PKI.

Figure 4: TLS certificate lifespans are dropping to 47 days by 2029.

The migration path itself is non-trivial. Organizations will likely need to run classical and PQC in tandem, maintain backward compatibility during transition periods, and handle complexity across hardware, software, and network layers.

As Cloudflare’s own team noted, the lack of crypto agility — the ability to easily swap cryptographic algorithms — is the major bottleneck for most organizations ^[19]. MD5, broken in 2004 for the first time, is still used and thus a major vulnerability ^[38].

Despite progress at the client and transport layers ^[19], back-end systems — including origin infrastructure, certificate management, and legacy application dependencies — are still lagging.

This is where crypto agility becomes critical: it allows organizations to adapt cryptographic components with less operational disruption as the transition unfolds.

A few players in this space: QuSecure, Keyfactor, CryptoNext, ExeQuantum

The Takeaway

Quantum computing’s full potential is still years away, and timelines remain genuinely uncertain. Breakthroughs could accelerate the timeline dramatically, or persistent engineering challenges could push practical quantum advantage further out. Anyone claiming certainty is selling something.

But the cryptographic migration that quantum demands is already underway, driven by regulation, real threats like harvest-now-decrypt-later, and the operational pressures of modern certificate management.

Crypto agility is valuable regardless of when quantum arrives.

The quantum era may be uncertain, but the preparation for it is not.

If you’re building in quantum security or exploring the PQC transition, we’d love to exchange notes.

Reach out - and let the winds keep blowing.

33N Portfolio Updates 🚀

Acoru

• Started their podcast Fraud Signals, watch here

Apono

• Released its 2026 State of Agentic AI Cyber Risk Report, finding that 98% of cybersecurity leaders are slowing agentic AI adoption because security controls are not yet ready.

• Launched Agent Privilege Guard, runtime guardrails to enterprise AI agents

DataGalaxy

• Launched Portfolio, a new domain-driven governance framework designed to connect data strategy with business execution, helping enterprises run data and AI as a global value portfolio.

Equixly

• Recognized as a top Scale-up in OVHcloud ecosystem awards.

Exein

• Won the Award for Safety and Security in Embedded World 2026

• Named top-3 cybersecurity startup in Sifted’s hottest sector to watch in 2026

• Announced partnership with Abinsula and MeshSystem

• Unveiled Photon, the kernel-level runtime security platform for industrial/AI systems

StrikeReady

• Announced the integration with Netskope

• Alex Lanstein, CTO, was featured in TechTarget’s article “From security to trust: How AI is tranforming the CISO’s Job”

Upcoming Events for 33N 🤝

• FIC, Lille, 31 Mar–2 Apr

• NCSC CyberUK, Glasgow, 21–23 Apr

• GISEC, Dubai, 5-7 May

• SIM Conference, Porto, 14-15 May

• InfoSecurity Europe, London, 2-3 Jun.

• South Summit, Madrid, 3-5 Jun.

• Super Return Venture, Berlin, 9-10 Jun.

When Anthropic introduced Skills last October, a new different approach to extending AI agents, most developers started discussing about MCP vs Skills. Most recently the hype on OpenClaw and Clawhub, reaching 5,705 community-built skills in few weeks, only accelerated interest for the skill paradigm. An important open question is: which one is easier to secure?

Wasn’t MCP designed with security in mind?

A CoSAI white paper revealed over 40 identified threats in MCP across 12 categories. Meanwhile, Skills face roughly 5 major security concerns. Time alone may bring more vulnerabilities, however the paradox exists: the standard designed with security boundaries (MCP) created a larger attack surface.

This isn’t theoretical. Recent weeks brought three critical MCP Git server vulnerabilities enabling remote code execution and a CVSS 10.0 zero-click RCE in Claude Desktop Extensions where a malicious calendar invite could compromise entire systems.

Show me your architecture and I will tell you who you are

The architectural differences explain why. MCP runs each integration in separate processes with scoped credentials, creating multiple attack surfaces: OAuth flows, token management, process boundaries, and supply chain integrity. Simon Willison identified “rug pulls” and “tool shadowing” vulnerabilities, while Palo Alto’s Unit 42 documented resource theft, conversation hijacking, and covert tool invocation.

Skills take a simpler approach. Running entirely within Claude’s conversation sandbox, their main concerns are prompt injection, sandbox boundaries, credential management, code execution trust, and tool access permissions. As a recent comparison article notes, Skills sacrifice MCP’s enterprise-grade isolation for deployment speed.

For organizations building with AI agents, the choice is clear:

• MCP for enterprise deployments requiring robust security infrastructure including containers, trusted execution environments and cryptographic provenance,

• Skills for rapid prototyping where prompt-level security suffices.

The emerging consensus: both will coexist, often as part of the same three-layer system. But as AI agents move to production, security teams must understand each layer and their vastly different threat landscapes.

33N Company Updates 🚀

• Hiring several positions across Sales & Marketing, after Series A!

• Launched integration with Checkpoint, MongoDB, SUSE – Read more

• Hiring several positions across Sales & Marketing, Product, HR and more – Read more

• Featured in Gartner’s new Magic Quadrant™ for Metadata Management Solutions – Read more

• Launched Polaris, Equixly’s upgraded AI assistant – Read more

• Hiring several positions, including Sales & Marketing, after Series A!

• Partnered with Mesh systems, leading US-based provider of IoT product development and managed services – Read more

• Hiring for leadership positions across Sales & Marketing and Operations – Read more

• Launched its 2026 CISO Survey, collecting feedback from 200 CISOs of US-based companies – Read more

• Named the #1 Best AI SOC Software for 2026 by Top Rank Software – Read more

Upcoming Events for 33N 🤝

• Munich Cyber Security Conference, Munich, 12-13 Feb — Gonçalo B., Gonçalo S.

• Swiss Cybersecurity Days, Bern, 17-18 Feb — Christophe

• Mobile World Congress and 4YFN, Barcelona, 2-5 Mar — Margarida, Pedro

• Montgomery Summit, Santa Monica, 10-11 Mar — Guy

• NVIDIA GTC, San Jose, 15-19 Mar — Guy, Pedro

• EIC Scalling Club Growth Forum, Paris, 18 Mar — Gonçalo M.

• KubeCon + CloudNativeCon Europe, Amsterdam, 23-26 Mar — Pedro, Lourenço

• RSA, San Francisco, 23-26 Mar — Carlos A., Carlos M., Gonçalo B., Guy

After backing the amazing team at Apono, who keep disrupting the PAM market (see Francis Odum’s recent market report), at 33N we keep thinking deeply about the future of identity of agents.

As most industry experts know, the rise of autonomous AI agents marks a real shift in enterprise security. Non-human identities already outnumber humans by up to 80:1.

With that scale come new attack surfaces — agent compromise, flow manipulation, memory poisoning — layered on top of existing problems like identity sprawl, shadow AI and gaps in auditability.

The result: it’s getting harder for enterprises to bring these systems to production while still trusting their security posture.

The Expanding Risk Surface

AI agents are powerful, but risky. Enterprises are already flagging their ability to:

• Access privileged data

• Take unintended actions

• Share sensitive information

• Make decisions on unreliable data

And it’s not just theory. Deployed agents across enterprises have been caught accessing unauthorized systems, sharing sensitive data, downloading restricted content and even exposing credentials. This exposes enterprises to a dilemma, agent adoption is seen as a must to keep businesses on top of their game but as of now, this leads to exposure to many unintended risks.

This is one example of the many possible attack paths. The recent release of Agentic Browser also showed the frailty of many of these systems. A recent article on agentic risks by Unit 42 / Palo Alto Networks goes into more breadth and depth on the topic.

Where traditional IAM breaks

Most identity systems were designed for predictable humans, not dynamic, self-directed software. Role- Based Access Control (RBAC) and similar models are too static for agents that spin up, adapt, and disappear on demand. The result is predictable: agents end up over-permissioned (a security time bomb) or under- permissioned (blocking automation).

As teams rush to ship, they often cut corners—issuing broad credentials just to make things work. Add the diversity of agent types, delegation modes and environments, and the governance challenge becomes exponential. Credential sprawl, over-privilege and blurred audit trails follow quickly.

Redefining Identity for agents

Agent identities can’t just be API keys or service accounts anymore. They need to be first-class citizens in IAM: verifiable, auditable, and flexible. Two main models are emerging:

• User-Delegated Agents: Linked to a user’s context (OAuth-style) but with dynamic, time-bound permissions.

• Standalone Agents: Issued their own short-lived certificates and verified through zero-knowledge proofs. Frameworks like SPIFFE/SPIRE are a strong foundation for this.

Zero Trust as the New Baseline

Implicit trust won’t survive the agent era. Continuous verification has to be the default. A modern architecture should center on:

• Just-in-Time Access: Ephemeral, task-scoped permissions that vanish when work is done.

• Dynamic Access Control: Runtime, context-aware enforcement (PBAC over RBAC).

• Traceability: Agents cryptographically signing actions to ensure provenance.

• Intent-Based Authorization: Humans define goals, not every click — enforced via policy-as-code.

• Fast Revocation: Credentials must be pulled instantly when anomalies appear.

What’s Still Unsolved

Big questions remain. How do we govern intent instead of individual actions? Can identity scale to millions of agents without latency? Will standards emerge or will major vendors build their own silos? And what happens when agents operate through GUIs, bypassing traditional API-based security altogether?

The Takeaway

Agentic AI breaks the legacy IAM model. Securing this next wave means moving beyond static controls to identity systems that are cryptographically strong, zero-trust by design and capable of governing at machine speed and scale.

If you’re building in Agentic Identity and open to exchanging on what the future brings or exchange contacts in the identity industry, don’t hesitate to reach out. Let the winds keep blowing!

Upcoming Events for 33N 🤝

• Cyber IA, Paris, 3 Feb — Pedro

• Cloud Native Days, Paris, 3 Feb — Pedro

• Munich Cyber Security Conference, Munich, 12-13 Feb — Gonçalo B., Gonçalo S.

• Swiss Cybersecurity Days, Bern, 17-18 Feb — Christophe

• Mobile World Congress and 4YFN, Barcelona, 2-5 Mar — Margarida, Pedro

Reach out to meet us there!

Exein announced an additional €100 million in funding this week, extending its Series C and bringing total capital raised in 2025 to €170 million. The round is led by Blue Cloud Ventures, with participation from HV Capital, Intrepid Growth Partners, Geodesic and J.P. Morgan, which also provided a financing facility.

A year of hyper-growth

Notably, this extension comes just five months after Exein’s €70 million Series C and caps a year of exceptional momentum. The company has delivered 5x year-on-year revenue growth, nearly doubled its valuation since July, and scaled its embedded security platform to more than 1.5 billion devices globally. Exein expects to surpass two billion protected devices in production by Q1 2026 .

Securing the Largest—and Least Protected—Attack Surface

At the core of Exein’s growth is a clear architectural shift in cybersecurity. As connected devices proliferate across critical infrastructure, manufacturers are moving away from perimeter defenses toward protection embedded directly in firmware. This approach is increasingly essential as cyberattacks spill into the physical world and regulatory pressure for device-level security accelerates (including RED 3.3, EU Cyber Resilience Act, US Cyber Trust Mark) .

What this means: Product, M&A and Global Scale

The new capital will support three priorities: advancing next-generation runtime security, including protection for on-device AI and LLMs; executing a multi-deal M&A strategy in 2026 across Europe and the US; and accelerating international expansion, particularly in North America and APAC.

Why This Matters

As connected devices become the world’s largest and least protected attack surface, Exein is positioning itself as foundational infrastructure — a “digital immune system” for the modern economy. This Series C extension reflects both the urgency of the problem and Exein’s emergence as a category-defining leader in embedded cybersecurity.

33N Company Updates 🚀

• Hiring several positions, including Sales & Marketing, after Series A!

• Hiring several positions, including Sales & Marketing, after Series B!

• Released MCP Server for admins, allowing admins to manage and automate privileged access workflows, in natural language, through MCP-compatible tooling – Read more

• Featured in Gartner’s new Magic Quadrant™ for Metadata Management Solutions – Read more

• Hiring several positions, including Sales & Marketing, after Series A!

• Just raised the Series C extension mentioned above!

• CEO Gianni Cuozzo was awarded the Entrepreneur of the Year Award in the Scaleup category from EY Italy – Read more

• Named as a Representative Vendor in the 2025 Gartner Market Guide for Embedded Security for IoT Connectivity – Read more

• Achieved ISO/IEC 42001 certification, for responsible AI – Read more

• Released “Smart Match”, AI-powered auto-fill engine that transforms how evaluators and mitigators complete cyber risk questionnaires – Read more

• Nominated as a Top 5 finalist for SANS Institute Difference Makers Award in Innovation of the year category – Read more

Upcoming Events for 33N 🤝

• SuperReturn Saudi Arabia, Riyadh, 26-27 Jan — Carlos M.

• Cybertech Global, Tel-Aviv, 26-28 Jan — Guy Horowitz, Carlos A.

Reach out to meet us there!

We’re thrilled to announce that 33N Ventures is leading Equixly’s €10M Series A, joined by Alpha Intelligence Capital, with additional participation from existing investors 360 Capital, JME Ventures and Fondazione Cassa di Risparmio di Firenze.

Our thinking

Equixly bridges the gap between manual pen-testing and blunt scanners by using AI to automate nuanced offensive testing at scale.

At 33N we’ve been debating how AI can productise parts of cyber services – not to remove experts, but to capture the experience-driven judgement top offensive teams apply and make it repeatable, reliable and embedded in how engineers ship software. Penetration testing is the classic example: highly contextual work that has resisted scale because so much of it depends on tacit knowledge and edge cases. Manual tests are thorough but slow and costly – often taking weeks and still missing critical issues (research suggests about 30% go undetected). Scanners are fast but blunt: they rarely reason about business logic and miss attacks where hackers exploit workflows to steal data or hijack accounts. That gap – speed versus real security – is what we wanted to close. Equixly’s team lived this problem, then built the right data and models, and found a pragmatic way to automate the hardest parts of offensive testing without losing the nuance.

The size of the problem

APIs now dominate enterprise traffic and revenue, yet existing protections miss business-logic flaws and will struggle as AI accelerates software creation.

APIs now account for roughly 57% of global web traffic and enterprises commonly run hundreds to thousands of endpoints, with related losses already measured in the hundreds of billions of dollars. APIs are increasingly revenue pipes: companies sell data via APIs, tech firms monetize modular services and AI vendors charge for endpoints. Protecting APIs therefore protects income, not just systems. Current defenses split between runtime protections (WAF/WAAP) and AST tools not built for stateful, modern APIs. Neither reasons about business flows, state transitions and emergent behaviors. As AI-generated code speeds up development, poorly written or insufficiently tested software reaching production will only worsen.

Meet the autonomous AI hackers

Equixly deploys agentic AI that maps systems, understand workflows, and runs continuous logic-aware attack simulations developers can use.

Equixly’s answer is agentic AI “hackers” that both reason and act. The agents map an application’s API surface (including shadow endpoints), learn how systems are used, reconstruct business logic and run context-aware attack simulations that expose deep logic flaws scanners miss. By reducing noise and false positives and running in CI/CD, testing becomes continuous and usable for developers rather than episodic. The same graph-based, agentic reasoning extends beyond APIs to emerging AI-native surfaces such as Model Context Protocols and agent-to-agent systems, so the platform scales as new attack surfaces appear (blog).

What’s next

The round fuels product and team expansion as Equixly positions itself to become a global leader in next-generation application security.

The round is about continuing to build out the product and the team, while expanding internationally, starting with the UK. We backed Equixly because they attack a problem that is massive and getting worse, they do it with a different and extensible technical approach, and they’re led by people who have actually done the work. This team is set to lead the charge among Europe’s cybersecurity innovators and become a global category leader in the next generation of application security. We’re genuinely excited to join their mission: turning the hardest parts of offensive testing into software teams will run to protect their critical systems.

33N Company Updates 🚀

Acoru

• Hiring several positions, including Sales & Marketing, after Series A!

Apono

• Hiring several positions, including Sales & Marketing, after Series B!

• Released MCP Server for admins, allowing admins to manage and automate privileged access workflows, in natural language, through MCP-compatible tooling – Read more

DataGalaxy

• Featured in Gartner’s new Magic Quadrant™ for Metadata Management Solutions – Read more

• Featured in the new research by ISG Software Research, Analyst Perspective: DataGalaxy Addresses the Governance and Value of Data – Read more

Equixly

• Announced the Series A round, that we just told you about!

• Attending Black Hat Europe this week - reach out at booth SC02!

Exein

• CEO Gianni Cuozzo was awarded the Entrepreneur of the Year Award in the Scaleup category from EY Italy – Read more

• Named as a Representative Vendor in the 2025 Gartner Market Guide for Embedded Security for IoT Connectivity – Read more

Panorays

• Released “Smart Match”, AI-powered auto-fill engine that transforms how evaluators and mitigators complete cyber risk questionnaires – Read more

• Achieved ISO/IEC 42001 certification, for responsible AI – Read more

StrikeReady

• Nominated as a Top 5 finalist for SANS Institute Difference Makers Award in Innovation of the year category – Read more

Upcoming Events for 33N 🤝

• Black Hat Europe, London, 8-11 Dec — Gonçalo B., Gonçalo S.

• Cyberweek, Tel-Aviv, 8-11 Dec — Guy Horowitz

Reach out to meet us there!

At 33N, we focus on the infrastructure layers that quietly but decisively determine how enterprises run and defend themselves. As companies distribute workloads across cloud environments and embed AI throughout their operations, Identity and Access Management (IAM) sits at the center of this architecture.

Apono offers a fundamentally new approach here: a Zero Standing Privilege architecture that shifts permissioning from static configuration to real-time, contextual workflows.

Last month we celebrated the participation in Apono’s $34M Series B, led by U.S. Venture Partners and joined by Swisscom Ventures, Vertex Ventures and existing investors, reflecting our conviction in Apono’s approach.

A Market Under Structural Pressure

IAM is one of cybersecurity’s largest and most strained cyber segments. Incumbents like Okta, Sailpoint and Cyberark together add up to $50B in market cap. Cloud adoption, federated architectures, and AI-driven tooling have fragmented control and expanded the permission surface attackers target. Programs built around standing privileges struggle with overprovisioning, dormant access, and inconsistent enforcement. Meanwhile, regulators increasingly expect continuous verification, not periodic attestation. Apono sits squarely at this intersection—security, automation, and real-time auditability.

A Distinctive Zero Standing Privilege Approach

Rather than layering tools on legacy privilege models, Apono removes standing access altogether. The platform operationalizes Just-in-Time (JIT) and Just-Enough-Access (JEA) through policy-driven automation that integrates directly into engineering workflows. Access is granted only when needed and based on contextual signals such as incident severity or deployment stage. The system is built to support not just humans but the growing wave of bots, pipelines, and agentic systems that require rapid, precise permissions.

The Team Behind

Apono’s founders translate a bold architectural thesis into a developer-friendly system deployed quickly in complex environments. Customers consistently highlighted the platform’s ease of setup and balanced design—rare traits in privileged access tooling. The team’s forward-looking roadmap, unifying human and machine identities under one access engine, strengthens their long-term position.

Strong Product-Market Fit

Apono has quadrupled its customer base in the past year, winning trust from enterprises such as Intel, HPE, and Monday.com. These organizations require deterministic access controls that do not impede operations — a high bar that Apono meets. Adoption by leading cybersecurity vendors further validates the platform and its role within the broader security ecosystem.

Looking Ahead

Privileged access will be a foundational layer of the Agentic Era as AI systems assume more operational responsibility. Access decisions will occur more frequently, span more identities and require richer context. Apono is building the infrastructure to support this shift—securely and at scale. Our investment reflects conviction in the product, the team and the industry’s move toward dynamic, context-aware permissioning.

We’re excited to contribute actively to Apono’s success. The winds keep on blowing!

33N Company Updates 🚀

Acoru

• Hiring several positions, including Sales & Marketing, after Series A!

Apono

• Hiring several positions, including Sales & Marketing, after Series B!

• Released MCP Server for admins, allowing admins to manage and automate privileged access workflows, in natural language, through MCP-compatible tooling – Read more

• Attending AWS Re:invent at Booth #1228 – reach out!

DataGalaxy

• Featured in the new research by ISG Software Research, Analyst Perspective: DataGalaxy Addresses the Governance and Value of Data – Read more

Exein

• CEO Gianni Cuozzo was awarded the Entrepreneur of the Year Award in the Scaleup category from EY Italy – Read more

• Became a technical partner of Crossed Swords 2025, a cyber defence exercise conducted by the NATO – Read more

• Named as a Representative Vendor in the 2025 Gartner Market Guide for Embedded Security for IoT Connectivity – Read more

Panorays

• Released “Smart Match”, AI-powered auto-fill engine that transforms how evaluators and mitigators complete cyber risk questionnaires – Read more

• Achieved ISO/IEC 42001 certification, for responsible AI – Read more

StrikeReady

• Nominated as a Top 5 finalist for SANS Institute Difference Makers Award in Innovation of the year category – Read more

• Gathering key CISOs in Las Vegas – Register here!

Upcoming Events for 33N 🤝

• AWS Re:invent, 1-5Dec, Las Vegas — Guy Horowitz

• Black Hat Europe, London, 8-11 Dec — Gonçalo B., Gonçalo S.

• Cyberweek, Tel-Aviv, 8-11 Dec — Guy Horowitz

Reach out to meet us there!

After announcing the investment in Acoru in the last weeks, we took time to write on why we invested and find ourselves honoured to be supporting the Acoru team.

Acoru, a Madrid-based startup, is pioneering voluntary fraud detection and money mule prevention. In the last few years these threats have increased with the democratization of AI and thus this is a natural extension of our mission of looking for technologies that redefine how cybersecurity and infrastructure software address emerging threats.

Our relationship with Acoru began before it’s inception having known the founders from previous ventures. We followed Acoru from early on and since the early beginnings their vision has only strenghtened: to enable banks and financial institutions to detect and prevent fraud before any transaction occurs.

The Growing Threat of AI-Powered Fraud

Generative AI is transforming the fraud landscape. Deepfakes, voice cloning, and large-scale social engineering attacks are fueling a global fraud crisis — with losses near $500 billion annually.

Traditional fraud detection systems, designed a decade ago, are reactive and insufficient for today’s authorized push payment scams and AI-automated mule networks.

Regulatory Tailwinds Driving Adoption

With regulators in the EU and UK tightening fraud reimbursement and reporting obligations, the pressure on banks to act preemptively is stronger than ever. Acoru’s system enables customers to remain compliant while reducing financial and reputational risk.

It positions the company at the intersection of Cybersecurity, AI and Compliance — a juncture we believe will define the next era of digital trust infrastructure.

Distinctive technology proposition

Acoru’s Voluntary Fraud Prevention Platform continuously analyzes millions of data points across connected accounts to identify criminal intent before it manifests in a transaction.

Key capabilities include:

• Fraud Prediction: Predicts future scams, money mules, and compromised accounts using behavior and intent models.

• Cross-channel Intelligence: Monitors both target and related accounts to reveal complex patterns

• Consortium Model: Allows participating banks to share anonymized classifications through a secure, centralized network to build collective resilience.

This model provides real-time, AI-enhanced insight into fraud risk while supporting compliance with EU and UK mandates for shared scam reimbursement frameworks (e.g. PS23/4, PSD3).

Experienced leadership with global ambition

Acoru was founded in 2023 by Pablo de la Riva Ferrezuelo and David Morán, serial entrepreneurs behind Buguroo / Revelock (sold to Feedzai, 2021), who are recognized experts in cybersecurity and fraud prevention with proven industry credibility.

The team has grown to over 30 professionals across multiple regions in under two years. Its early success with major European and global financial institutions demonstrates both the urgency of the problem and the scalability of its solution.

As Carlos Moreira da Silva, Managing Partner at 33N, said:

“Voluntary fraud has become one of the most damaging and underestimated challenges in today’s financial system. What impressed us about Acoru is not just their vision, but the rare combination of deep domain expertise and execution excellence of the founding team. Only an exceptional team could design a platform this comprehensive, easy to deploy, and intelligent.”

This confidence on the team’s expertise and background was one of the strong pillars that motivated us to back Acoru.

Looking ahead

The rise of AI-assisted fraud requires AI-driven defense. Acoru is building the intelligence fabric that will allow institutions to outpace attackers by predicting and preventing the next scam — before it happens. Learn more at acoru.com.

Stay tuned for more updates. Let the winds keep blowing.

33N Company Updates 🚀

DataGalaxy

• Recognized in an ISG One research from Matt Aslett – Read more

• Spoke at AWS GenAI Loft at StationF

• Attended Big Data & AI Paris

• Attended Big Data London and hosted a session with Sportradar

• Spoke at Open Lakehouse + AI meetup at Forward Data Conference

Exein

• Attending Embedded World North America in California, 4-6 November

• Attended and spoke at Sifted Summit London

• Named as a Representative Vendor in the 2025 Gartner Market Guide for Embedded Security for IoT Connectivity

• Announced a partnership with Kontron Group

• Attended and spoke at Electronics & Applications 2025

• Invited to Bloomberg’s Daybreak Europe to discuss recent cyberattacks – watch here

• Attended Gartner Security & Risk management Summit 2025

Panorays

• Attending OptiveCon

• Attended ISF World Congress

• Attended Kodi Connect’s Cybersecurity Leadership event

• Attended BlackHat USA 2025 and hosted a CEO vs CISO basketball game

StrikeReady

• Attended GITEX Global and co-hosted exclusive dinner

• Nominated as a Top 5 finalist for SANS Institute Difference Makers Award in Innovation of the year category

• Attended FalCon 2025 by Crowdstrike

• Featured in Cyber Defense Magazine’s Innovator Spotlight – Read More

• Attended Blackhat USA 2025

Acoru

• Announced this Series A that we just told you about!

• Spoke at the II Congress of Cybersecurity and Fraud, organized by Madrid’s Custer of Cybersecurity

Upcoming Events for 33N 🤝

• Cyber Innovation Day, 4-6 Nov, Washington — Gonçalo B., Gonçalo S.

• Tech Tour AI & Digital Trust, 5-6 Nov, Lausanne — Christophe

• Websummit, 10-13 Nov, Lisbon — Carlos A., Carlos M., Margarida, Alina, Pedro

• Slush, 18-20Nov, Helsinki — Pedro, Lourenço

• Black Hat MEA, 2-4 Dec, Malham — Carlos A., Carlos M.

• Cyberweek, Tel-Aviv, 8-11 Dec — Eli

• Black Hat Europe, London, 8-11 Dec — Gonçalo B., Gonçalo S.

Reach out to meet us there!

33N hosted its first Connect Day last week, bringing together repeat founders, execs and investors to reflect on the trends in cyber and infra software. Great to see the energy, ambition and commitment in pushing the boundaries of knowledge around building in cyber and infra software.

Brian NeSmith, founder of Arctic wolf, took the stage to share insights on his early days at Arctic Wolf. Few insights shared:

• Meet customers where they are and align to their expectations - eg. in the first years Brian created pseudonyms for himself as a SalesRep, as customers didn’t expect to meet the CEO in a first call

• Recognise the signs of market pull - eg. the WannaCry attack in Nov-2017 which severely affected the NHS marked a turning point as the market came to Arctic Wolf in search for a security operating center

• The market always wins even against great teams and product - great teams iterate quickly and change market soon enough

JC Raby, Managing Director at JPMorgan, shared perspectives on the cyber market:

• The cyber market has historically outperformed NASDAQ and S&P

• Platformization is driving consolidation and there are patterns in M&A - eg. major emerging segments including CSPM, SIEM, DSPM often saw 2-4 early exits, only much later followed by larger exits by the surviving companies who were able to scale

• New themes are driving security innovation including:

  • Adoption of GenAI tools creating need for new security tools

  • Agentic AI driving automation in security

  • Convergence of data and identity security in the cloud

  • Greater need for robust non-human identity management practices

  • Hybrid work environment continues to introduce network security challenges

  • Increasing regulation and government directives for cyber incident reporting and security enhancement

Carlos A. Silva and Carlos M. Silva, Managing partners at 33N also shared their perspectives on the last decade in cybersecurity, highlighting that there has been a tremendous acceleration in growth of the developer community, economic value creation and time-to-market of AI.

In parallel, the costs of cyber crime grew more than 10x, leading to cybersecurity being a top concern. While some pundits expect budget pressure and vendor consolidation in the cybersecurity market, the total market opportunity in cybersecurity is still 10x larger than current market size.

Furthermore with the geo-political environment moving to increased protectionism and creation of economic trade clusters, there will be different drivers, trends and challenges. Today these represent different opportunities for commercial and investment opportunities that founders and investors alike should consider strategically.

At 33N we’re on a mission and we’ve only just started: if you’re building, investing or actively interested in Cybersecurity, AI, Data & DevOps, please reach-out.

33N Company Updates 🚀

DataGalaxy

• Launched a new brand and platform version, highlighting the positioning as the first-ever value governance platform for Data & AI 👉 Read more

• Recognized as leader in G2 Spring 2025 across several categories 👉 Read more

• Attending Snowflake Summit 2-5 Jun in San Francisco 👉 Read more

Exein

• Recognized at Viva Tech Top 100 Rising European Startups for 2025 👉 Read more

• Attended RSA 28 Apr - 1 May in San Francisco 👉 Read more

Panorays

• Recognized as leader in G2 Spring 2025 across several categories 👉 Read more

• CTO & co-founder was interviewed by Forbes on AI in cybersecurity 👉 Read more

• Attended RSA 28 Apr - 1 May in San Francisco 👉 Read more

• Attending Infosec Europe 3-5 Jun in London 👉 Read more

StrikeReady

• Launched its new platform version 👉 Read more

• Attended RSA 28 Apr - 1 May in San Francisco 👉 Read more

Upcoming Events for 33N 🤝

• Infosecurity Europe, 3-5 June, London

• South Summit, 5-7 June, Madrid

• CyberSec, 11-12 June, Krakow

• C-days, 24-26 June, Estoril

• Black Hat USA, 2-7 August, Las Vegas

• Tech BBQ, 2-7 August, Copenhagen

Enterprises are feeling the pull of generative AI and agents—but few are confidently riding the wave. In our latest round-table with data and AI practitioners, we heard a familiar refrain: excitement tempered by the real-world friction of implementation. The dream of autonomous AI agents reshaping business processes is alive—but for now, it’s mostly a vision waiting for its moment.

Here’s where things stand, and where they’re headed.

📈 The Generative AI Maturity Curve

From basic “chat with a PDF” prototypes to sophisticated AI-first products, enterprises are moving at widely different speeds. Some are still kicking the tires. Others are laying foundations for agent-led transformations.

But across the board, adoption of AI agents remains nascent. Interest is high, experimentation is happening—but true deployment is rare. There’s a gap between POC and production, often driven by the unresolved tension between AI’s probabilistic nature and the deterministic demands of compliance and trust. For the very few that are leading adoption, they are likely to have to build their own stack internally.

⚙️ A Patchwork of Tools, Shaped by Maturity

AI adoption today is anything but monolithic. Enterprises are stitching together a mix of low-code platforms, vertical solutions, open-source models and enterprise-grade software to match the task at hand. The choice of tools isn’t just about functionality —it’s a reflection of where a company is on its AI journey and how mission-critical the use case is.

Vertical platforms are often used for retrieval-augmented generation (RAG) and chatbot enhancements, while deeper innovation—like reimagining a business model —leans on developer-first tools. This patchwork is intentional: AI tools are being matched to both the complexity of the task and the organization’s ability to absorb change.

🧠 It’s Not (Just) a Tech Problem

The blockers aren’t mostly technical. They’re human.

Resistance to change, fear of displacement and lack of trust in models’ outcomes are common hurdles. Even where technical capacity exists, many enterprises are wrestling with legacy systems and fragmented data environments. AI may be sexy, but the unglamorous work of data engineering and infrastructure readiness is still the prerequisite.

Enterprises are building multi-layered evaluation pipelines—automated testing, human-in-the-loop safeguards, and AI-based validation—to make probabilistic models feel deterministic. Integrating AI into existing SDLCs is no longer optional. It’s the only way to scale responsibly.

💸 Show Me the ROI - Enterprise vs Mid-martket

Economic caution is shaping AI adoption.

Budgets are tight, and the bar for “proof of value” is high. While consultancies and integrators are leading many enterprise AI efforts, a common complaint is that projects stall in the POC stage. The few that break through are often big-ticket, cost-saving deployments with a narrow focus on efficiency rather than innovation.

Case in point: a leading European sports commerce company estimated 1m€ real savings using AI to automate customs clearance in a few days of development —but scaling that success across the org is a different challenge. Another global FMCG leader is stuck in setting the right governance, despite clear top-line growth opportunities.

Startups are telling a different story. Without the weight of legacy systems—or legacy thinking—they’re moving fast. They’re embedding agents into user workflows, experimenting openly, and learning in real time. The difference? Alignment, agility, and a higher tolerance for risk.

🔮 Looking Ahead

The enterprise agent revolution isn’t coming tomorrow—but it’s coming.

Practitioners see the next 18–24 months as foundational. The focus now is on stabilizing data infrastructure, embedding governance, and laying the groundwork for agents to thrive. Cross-functional collaboration is emerging as a key success factor—tech, legal, ops, and product leaders must align to make AI adoption sustainable.

33N Company Updates 🚀

DataGalaxy

• Recognized in the 2025 BARC Data Intelligence Platform Report 👉 Read more

Exein

• Partners with Supermicro to secure their industry-leading hardware 👉 Read more

• Partners with Integral Systems for France 👉 Read more

• Partners with AAEON for industrial edge devices 👉 Read more

Panorays

• Recognized as a Best Governance, Risk & Compliance (GRC) Product for 2025 by G2 👉 Read more

• Releases 2025 CISO Survey on Third-Party Cyber Risk Priorities 👉 Read more

StrikeReady

• Announced a collaboration with Outliers for Middle East and Africa's 👉 Read more

• Participated and led an exclusive event at IntelliC0N 👉 Read more

Upcoming Events for 33N 🤝

• RSA, 28Apr-1May, San Francisco – we’ll host a side event; reach out and join us!

• SIM conference, 8-9May, Porto

• Gartner Data & Analytics Summit, 12-14May, London

• ECSO Startup Awards Finals​, 21-22May, The Hague

• Latitude59, 21-23May, Tallinn

• OWASP Global Appsec, 26-30May, Barcelona

• 33N Connect Day, 29May, Porto

• Infosecurity Europe, 3-5Jun, London

• South Summit, 5-7Jun, Madrid

Team updates at 33N 👨‍💻👩‍💻🧑‍💻

Please join us welcoming 33N’s new members:

• Ayman Hammoudeh as Venture Advisor, bringing experience as startup advisor and security practitioner, currently Field CISO at IBM in the Middle East

• Flávio Carvalho as Advisory Board member, currently CISO Iberia at Crédit Agricole

There’s a common saying in cybersecurity: “It's not a matter of if you'll be hacked, but when”. For some time this seemed to apply to AI systems as well.

Fast forward since 2022, there haven’t been a surge in attacks to AI; let alone any nation state attacks. Several reasons seem to justify this. With AI moving at break-neck speed it is as much of a challenge for attackers to cope with it as it is for the rest of us. Furthermore, low enterprise adoption reduce the incentive for sophisticated attacks to AI infra.

So will AI security take-off? If so when?

We took the topic for discussion with CISOs, security and AI practitioners, 6 months after we first covered the topic (here). The conclusion? The verdict is still out.

The Threats in AI Security

In the discussion, we bucketed threats around three primary categories of attacks:

1. Manual Prompt Attacks: Low-hanging fruits for attackers. Just sending a high volume of diverse prompts already creates a Denial of Wallet attack (ie. a surge in inference costs). The dynamic nature of such attacks, often generated algorithmically, creates a continuous "cat and mouse" game. This supports the boom in AI red-teaming/pen-testing startups, with new ones every month.

2. Operational Attacks: Complex but systemic. Look to compromise the operational aspects of AI models, drawing parallels to conventional software supply chain attacks. Frameworks such as Databricks DASF 2.0, Google's SAIF or MITRE Atlas, try to get a lay the land. As pre-trained LLMs become better and easily consumable via APIs, the opportunity for these attacks is for now brink.

3. Agentic Warfare: Exponentially impactful. This involves deploying AI agents with specific objectives, utilizing models as their core intelligence and equipping them with tools to execute tasks. The extensive control these agents can exert over software systems amplifies their potential impact, including the risk of large-scale disruptions. This extends far beyond the 'AI security' realm.

While prompt attacks are seen as the immediate threat for now, some practitioners see long-term benefits of adding additional protections to the same single platform vs different end-point solutions for AI security. When will the remaining security layers become key to add-on?

The Challenge of AI Quality

Hallucinations/bias/toxicity have more to do with quality than security. This is a grey area, so tighter layers of testing seem to be the way to address it:

1. Scenario-Level Granular Testing: Evaluate diverse scenarios to test edge cases.

2. Statistically Balanced Test Cases: Develop test cases that accurately represent various real-world situations preventing skewed performance metrics and ensuring the AI system's robustness.

3. Thorough Regression Testing: Regularly test AI systems after updates or modifications.

4. End-to-End Pipeline Assurance: Validating each component of the AI pipeline, from data ingestion to output generation.

5. Transparent and Standardized Quality Standards: Establish clear quality benchmarks fosters alignment among developers, stakeholders and end-users.

Quality is however much more enterprise and use case specific. The ultimate “quality metric” is the ROI of the business case. This is good news to vertical AI vendors or system integrators delivering custom use cases, but generally not for horizontal AI quality/observability/explainability vendors (and there’s already many out there). Will there be an opportunity for new vendors in AI quality?

Conclusion – we’re just beginning

Accelerated AI adoption will kick start the ‘cat-and-mouse’ flywheel of improved quality/security in a market that currently looks very nascent. At 33N we’re strategic partners and long term believers in the sector and always open to connect with disruptive thinkers, practitioners and founders in the space – don’t hesitate to reach-out at info@33n.vc!

33N Company Updates 🚀

DataGalaxy

• Recognized in the 2025 Gartner Magic Quadrant for Data & Analytics Governance Platforms 👉 Read more

• Recognized as a Data Governance leader on G2 👉 Read more

• Acquired YOOI, a small French operation, to enhance product capabilities in managing Data & AI use cases and products

Exein

• Secures partnership with chipmaker MediaTek 👉 Read more

• Recognized among Europe’s Top 250 Startups by Sifted 👉 Read more

Panorays

• Releases 2025 CISO Survey on Third-Party Cyber Risk Priorities 👉 Read more

• Managing third-party cybersecurity risks listed as a Top Trend in Cybersecurity by Gartner 👉 Read more

StrikeReady

• Yasir Khalid, StrikeReady’s CEO and Founder, earned a spot as one of Senior Executive’s Top Cybersecurity Founders to watch in 2025 by Forbes 👉 Read more

• Present at Black Hat MEA 👉 Read more

Upcoming Events for 33N 🤝

• Websummit Qatar, 23-26 Feb, Qatar — Carlos & Carlos

• MWC/4YFN, 3-6 Mar, Barcelona – Margarida & Pedro

• Embedded World, 11-13 Mar, Nuremberg – Carlos A.

• NVIDIA GTC, 17-21Mar, San Jose – Guy & Pedro

• Cybertech, 24-26 Mar, Tel-Aviv – Eli

• CMIP/Google, 27 Mar, Warsaw – Carlos & Carlos

• FIC Europe, 1-3 Apr, Lille – Gonçalo & Christophe

• Kubecon + CloudNativeCon, 1-4 Apr, London – Pedro

• RSA, 28Apr-1May, San Francisco – 33N team

Team updates at 33N 👨‍💻👩‍💻🧑‍💻

Please join us welcoming 33N’s new members:

• Guy Horowitz as Venture partner (in action below hosting an event for 33N)

• Beatriz Gonçalves and Lourenço Teodoro as Analysts (already active at the office below)

• Cássio Sampaio as Advisory Board member, ex-CPO at Okta/Auth0

  

As we come close to wrapping up a transformational year for Generative AI adoption, we took the chance to reflect on our recent investment in DataGalaxy, a must-have data platform for organisations embracing AI or unlocking data's full value for smarter business decision. Let’s start!

The Role of Data Governance platforms as the Backbone of AI and Analytics

As organisations evolve towards becoming AI and data-driven, they often find themselves grappling with the complexities of data management. Data governance platforms provide an essential solution by organising, centralising, and making data assets accessible across the enterprise. These platforms streamline data discovery, ensure data consistency, and enable analysts, data scientists, and business users to efficiently access reliable data. By enriching metadata and improving search-ability, these platforms empower teams with deeper insights into data lineage, quality and usage.

In AI projects, where data quality directly influences outcomes, having a reliable metadata repository helps teams build models that are more accurate, more explainable and maintainable over time. Effective governance practices prevent issues like data bias, quality lapses and security vulnerabilities that could compromise AI model integrity. According to recent reports, structured data quality/cleaning and governance practices are among the top that organisations are working on and are the main challenges to scaling up Gen AI, addressing risk concerns, regulatory requirements and building trustworthy models that stakeholders can rely on.

Data Catalogs: A Pillar of Modern Data Architectures

As organisations adopt modern data infrastructures, such as Data Mesh and Data Fabrics, the role of data catalogs becomes increasingly pivotal. As these modern infrastructures thrive on decentralisation and interconnectedness, they require seamless metadata management and governance to ensure data consistency and usability across distributed systems. Without a unified approach to managing metadata, organisations risk facing data silos, inefficiencies, and governance challenges. The data catalog acts as the cornerstone of these architectures, enabling comprehensive metadata curation, lineage tracking and discoverability. It creates a shared understanding of data assets, fostering trust and transparency.

DataGalaxy — Enabling Collaboration and Future-Ready Data Governance

Platforms like DataGalaxy provide governance frameworks that emphasise data stewardship, access control and policy adherence, which are essential in managing sensitive information and ensuring data accuracy.

In collaborative environments, data accessibility and usability across departments are key for generating insights and achieving AI project milestones. DataGalaxy supports cross-functional data sharing by fostering a culture of collaboration and by breaking down team silos. The platform’s intuitive cataloging interface encourages teams to document and share their findings, reducing redundant work and accelerating project timelines. As AI systems increasingly rely on diverse data sources, platforms that promote collaborative governance and transparency become essential. Moving forward, data catalog solutions that emphasize real-time data collaboration and governance will continue to play a pivotal role in shaping AI’s future within organisations, bridging the gap between technical and non-technical teams to drive more comprehensive insights and innovation.

Amongst competitors, DataGalaxy distinguished itself by providing a collaborative, user-friendly experience, which has helped it carve a unique space in a crowded field. Looking ahead, DataGalaxy aims to expand its capabilities to meet the evolving needs of data governance, providing a scalable solution that grows alongside an organisation’s data demands.

At 33N, we see data governance as the linchpin of AI-driven transformation. Our investment in DataGalaxy reflects our conviction that platforms like this are crucial for unlocking the potential of data in today’s rapidly evolving landscape.

We are excited to support DataGalaxy’s mission to redefine how organisations manage and govern their data, creating a more connected, collaborative and innovative future.

If you’re interested to know more, please check datagalaxy.com. 

33N Company Updates 🚀

DataGalaxy

• Organized “DataGalaxy Tech Summit NYC”, including a CDO Masterclass with insights from leading brands like Airbus and LVMH and a “Data on the Rocks” side-event  👉 Read more

• Participated in the Big Data & AI Paris, engaging with industry leaders and showcasing their latest solutions  👉 Read more

• Published articles "5 things that keep data management leaders up at night," and "6 tips for driving data literacy in your teams" 👉 Read more here and here

Exein

• Reinforced its position of ensuring compliance with the Cyber Resilience Act, as the publication of the CRA in the Official Journal of the EU occured 👉 Read more

• Published article on the “The Role of Open-Source in IoT Security”  👉 Read more

• CEO Gianni Cuozzo interviewed about the Cyber Resilience Act  👉 Read more

• CEO Gianni Cuozzo attended Cybertech Europe 2024 in Rome

Panorays

• Attended Information Security Forum in Orlando 👉 Read more

• Attended SecureWorld in NYC  👉 Read more

• Published customer case study with Perion  👉 Read more

• Attending Forrester Security & Risk Summit in Baltimore  👉 Read more

StrikeReady

• Recognised by Gartner as a key player in the TDIR (Threat Detection, Investigation, and Response) segment 👉 Read more

• Added Adil Mufti as our new Global CISO, with previous experience at  Allstate, CNA Financial, and top cybersecurity firms  👉 Read more

• Added Lee Weyers as VP of Sales, bringing a wealth of experience from Gartner, Oracle, and SAP  👉 Read more

Upcoming Events for 33N 🤝

• Black Hat Europe, 9-12 Dec, London — Carlos A. & Gonçalo

• Road to the Polish Presidency, 13Dec, Krakow — Carlos M.

This is a second part of our Summer reflection on the main trends in cyber and infra software, now covering infra software at seed and series A stages.

Overall, just like cyber, infrastructure software hasn’t been totally immune to the global decrease in VC funding, with a decrease in both deal volume and value in 2023. For 2024 however, investment in year to date (until August) already showed promising signs of an upward trend. Geographically, North America takes the lion share with 70-80% of deal count and value, Europe 20-25% and Israel the remaining. This data doesn’t consider unannounced extension rounds (often in the form of convertible note or SAFE) which volume is unknown and could easily correct the downward trend (our perception is that 2023 saw a lot of extensions).

On a per country perspective, while the UK continues to be the leading market in deal count, France is actually the leader in deal value, while Germany stands as the third country. Going a level below into the representative deals, it becomes clear that France’s leadership is really driven by Software development tools (think Poolside building an AI software developer) as well as AI development tools (think Mistral, Hugging Face, H company).

Looking into the activity of selected infrastructure software VC funds at seed, series A and B stages, deal count and value in 2024 YTD is already close to the levels of the whole year of 2023, suggesting a strong year of 2024 for specialized funds. 

From a market segment perspective, c. 50% of investment volume went to AI/ML development tools, followed by App software (33%) and DevOps/Cloud infra (18%). In a sub-segment perspective:

• In AI/ML, the leading category was AI security, compliance and quality, though a category with still early enterprise adoption from our perspective

• In Software development tools, Continuous Delivery/Deployment (CD) and code review/co-pilots were the top categories, unsurprisingly given the significant adoption of code co-pilots and next gen PaaS/IaaS platforms.

• DevOps/Cloud Infra saw overall the lowest investment, formed by broad but well established such as orchestration&management, monitoring&observability or FinOps

These trends are consistent with recent reports on Enterprise tech spending (eg. Battery’s state of enterprise tech 2Q2024); while Cloud infrastructure, GenAI/LLMs and Enterprise security are expected to take the largest share of budget in the next 12 months, the fastest growing categories are AI/ML, Data and Security, with Dev tools falling back to the 4^th place.

Overall GenAI/ML continues to be the elephant in the room for early stage seed to Series B stages. While 2Q2024 saw investor concerns across public markets on an AI spending bubble, yet to be fully disproved, enterprise budget outlooks support increased enterprise demand (eg. Battery’s state of enterprise tech 2Q2024). Looking forward to seeing the next phase of enterprise adoption and increased maturity of vendors as they move to growth stage.

If you’re building in these spaces, don’t hesitate to reach-out!

33N Company Updates 🚀

• Launches guide on CRA adoption, ahead of CRA’s final approval in November 2024 👉 Read more

• Launches guide on security for IoT-enabled Vehicles  👉 Read more

• CEO Gianni Cuozzo attending Cybertech Europe in Rome 8-9^th October 2024

• Partners with Onda to transform the future of cyber insurance 👉 Read more

• Attending Innovate Cybersecurity’s summit in Scottsdale 6-8^th October 2024 👉 Read more

Upcoming Events for 33N 🤝

• European Cybersecurity Challenge, 8 Oct, Turin — Pedro

• Gitex, 14-18 Oct, Dubai — Carlos & Carlos

• Big Data & AI Paris, 15-16 Oct, Paris — Margarida

• AWS Cloud Experience, 16 Oct, Lisbon — Pedro

• ENISE, 21-23 Oct, León — Margarida & Carlos M.

• IT-SA, 22-24 Oct, Nuremberg — Gonçalo

While the market never stops, at 33N we took some time during the low season to reflect on the main trends of the cyber funding landscape at seed and series A stages, both in Europe as well as internationally. Some interesting conclusions!

Overall cybersecurity hasn’t been totally immune to the global decrease in VC funding, with a decrease in both deal volume and value in 2023 and expected to continue into 2024. While Europe secured a 20-25% share in deal value and volume in 2022-23, respectively, its share reduced to below 20% in 2024 so far. This data doesn’t consider unannounced extension rounds (often in the form of convertible note or SAFE) which volume is unknown and could easily correct the downward trend (our perception is that 2023 saw a lot of extensions).

On a per country perspective, while the UK continues to be the leading market in deal volume and value, it is now closely followed by France. While the French ecosystem has seen increased maturity in the launch of AI startups (think Mistral, Hugging Face, H company), France seems to be also becoming a reference market in Europe for cybersecurity.

Looking into the activity of selected cybersecurity-focused VC funds at seed, series A and B stages, deal value and volume of 2024 to date is on-par with the levels of 2023, suggesting healthy opportunities (again, excluding unannounced extension rounds).

From a market segment perspective, 4 segments concentrated 68% of investment volume: Security Operations (29%), Cloud (17%), Identity (12%) and AI security (10%). Within those, Vulnerability management in SecOps and CNAPP continue to be the leading sub-segments. While the first 3 categories are not unexpected and align well with the areas of interest by enterprise CISOs, AI security is the new category riding on the emerging adoption of GenAI use cases. Considering the still early adoption of these in enterprise, it’s impressive to already see significant deal volume at Seed, Series A and B.

If we look to earlier stage, to acceleration and pre-seed stages, we see similar (or even more expressive) trend. Considering some the reference cyber accelerators (inc. AWS&Crowdstrike, Google cyber growth – with whom 33N is closely involved) the main segments include SecOps (24%), Cloud security (19%) and AI security (15%), the latter becoming the 3^rd most relevant category. While AI security can cover different topics, the 2 largest categories include Application (think AI firewalls, detection&response, red teaming, model scanning/monitoring, etc) and Data (data leakage protection, PII identification, etc) reflecting emerging categories of security concerns.

Overall, these trends reflect increased market interest in maturing but yet fragmented segments (SecOps, Cloud security, Identity) but strong emerging ones (AI security) which should continue to lock the interest of investors, executives and founders alike. At 33N we’ve deeply researched these and found unique approaches and best practices that we’d be glad to continue sharing.

If you’re building in these spaces, don’t hesitate to reach-out!

33N Company Updates 🚀

Starting with this newsletter edition, we’re inaugurating a new section covering interesting updates from supported portfolio companies – if you’re interested to learn more please reach-out.

• Partners with Logic Technology B.V. to Strengthen IoT Security 👉 Read more

• Publishes CRA Guide and Requirements 👉 Read more

• Publishes “Ensuring Security for IoT-Enabled Vehicles”: 👉 Read more

• Releases new customer story with ClearBank 👉 Read more

• Recognized as leader The Forrester Wave™: Cybersecurity Risk Rating Platforms, Q2 2024 👉 Read more

• Partners with The Instillery to bring AI-powered security to New Zealand 👉 Read more

• Releases webinar on “Debunking AI Myths: Why SOC Leaders Need to Know About AI in Cybersecurity” 👉 Read more

Upcoming Events for 33N 🤝

Please reach-out if you’re around!

• Big Data LDN, 18-19 Sep, London — Margarida & Pedro

• Bits & Pretzels, 29 Sep - 1Oct, Munich — Pedro

• One conference, 1-2Oct, The Hague — Gonçalo

• ECSO Cyber Investor Days, 3 Oct, The Hague — Gonçalo

• Gitex, 14-18Oct, Dubai — Carlos & Carlos

• ENISE, 21-23 Oct, León — Margarida & Carlos M.

• IT-SA, 22-24 Oct, Nuremberg — Gonçalo

At 33N, we’re always on the lookout for transformative technologies that can reshape the cybersecurity and infrastructure software markets and create new paradigms. Our latest investment in Exein is a testament to this vision.

Believe it or not, our first interaction with Exein started more than 3 years ago. Since then, the opportunity of investing in the company has always excited us given its addressable market, product, leadership, and investor support. Well, in 2023 everything came full circle with an extraordinary market validation and sales execution. On the back of this long relationship with Gianni (Founder & CEO), coupled with our common vision on the most unexplored and promising segments within the IoT/OT security market, 33N was fortunate to lead their financing round, joined by Partech, and continued supported from United Ventures, eCapital, and Future Industry Ventures.

The Growing Threat Landscape

The Internet of Things (IoT) and Operational Technology (OT) sectors present a growing threat to enterprises as industrial devices integrate with IT networks, the volume of software embedded on devices increases, as well as the transfer of data from previously isolated appliances. In 2022, IoT-target cyber attacks surged by 116% YoY, with Europe bearing the brunt. In the first two months of 2023, these attacks were already 41% higher compared to 2022, reflecting an obvious acceleration of the problem (source). Pushed by these forces, the IoT/OT security space developed into a standalone market within infosec estimated at $6.8bn in 2023 and expecting a 21% CAGR for the next 3 years (as per Pitchbook) . The security segment is estimated conservatively at <1% of the total market opportunity for IoT startups that reached $645bn in 2022, excluding services startups (according to Pitchbook).

Distinctive Technology Proposition

Exein stands out with its comprehensive, software-focused approach to embedded security. Unlike traditional methods that rely heavily on hardware-based appliances, costly specialized consultancy, network-centric solutions or vulnerability assessments, Exein offers a scalable and flexible platform that provides real-time threat detection and response capabilities at the device level. This approach is crucial for environments with connectivity constraints, enabling effective security without the need for constant network access.

Key features:

●      Runtime Security: Exein’s agent monitors device security in real time, providing immediate threat detection and mitigation.

●      Analyzer Platform: Automates cybersecurity assessments, identifying vulnerabilities in firmware without requiring source code access.

●      Edge AI: Utilizes machine learning for anomaly detection, ensuring each process on a device is secure.

Global Partnerships & European Leadership

Exein adopted a strategy to provide linear integration in CNCF open-source Linux embedded systems such as Yocto and Buildroot. The company is the only startup and European entity as a Platinum Member of the Yocto Project, the standard de facto of Linux embedded systems running on 1.4bn devices per year, a significant portion of the embedded IoT market.

The long-term commercial agreements with relevant GTM partners, OEMs, and chipset manufacturers globally built by Exein throughout the last years is remarkable and a relevant barrier for new market entrants.

Pressing Regulatory Environment

IoT security adoption is benefiting from regulatory tailwinds and is now a legislative priority. Few years ago, the US Government passed the IoT Cybersecurity Improvement Act, which created security standards for connected devices procured by the federal government. Further, recent US Executive Orders, the Cyber Trust Mark (CTM), or in the EU, the Cyber Resilience Act (CRA) and the NIS2 Directive, bolstered measures to ensure more secure hardware and software products to be implemented until 2025-26. Considering general device production life cycles of 1-2 years, organizations need to start complying with the latest regulations right now. Each of these directives should play a crucial influence on broader IoT security adoption, and Exein can play a pivotal role in helping manufacturers act in accordance with the upcoming regulatory framework. The latter comes reinforced if we consider the EU's dominance on the global production of industrial devices and its position at the forefront of the work done to regulate this space.

In case you’re interested to know more, please check https://www.exein.io/. Stay tuned for more updates very soon! Let the winds keep blowing.

As Generative AI continues to accelerate in maturity and adoption, key security challenges are still being thought through by enterprise CISOs. What are the key risks? Where are CISOs starting and what are key learnings from the journey so far? How is AI security being prioritised? What are the key pieces of the stack being adopted? At 33N, we recently discussed the topic at our CISO circle, looking to collaboratively shed some light on a few of these questions. Let's dive in!

Adoption trends

To put everyone on the same page, despite its potential, the adoption of GenAI across organizations remains relatively modest, with only 9% of enterprises integrating it comprehensively within their operations.

Code co-pilot is the top use case driving the IT department to be the front-runner in GenAI adoption. While the application of GenAI in co-pilot security is frequent, CISOs recognize it comes with notable concerns (mostly yet unsolved).

In marketing, sales, and customer support, key use cases include content creation, knowledge search, summarization, and recommendations. While content creation raises lower concerns of data leakage or hallucinations, others not so much.

The cautious approach to widespread adoption highlights the need for robust data management and cybersecurity frameworks to mitigate associated risks. Enterprises have increased investment in these as building blocks for Gen AI adoption.

Vulnerabilities in ML

Past implementation of machine learning (ML) has introduced several types of attacks, including inference attacks, poisoning training data, data leakage and model stealing. These vulnerabilities underscore the critical nature of securing ML models, as failures can lead to catastrophic consequences. Unlike implementation issues, the problems in ML are deeply rooted in mathematical foundations, making them particularly challenging to address.

Adversarial ML is especially concerning due to the near-infinite and unpredictable adversarial space. Attacks on one model often transfer to others, complicating the security landscape. This lack of predictability and the absence of an easy fix further accentuate the necessity for advanced security measures.

Vulnerabilities in LLMs

Large Language Models present a different set of challenges.

First, these models process sequential inputs where English words are broken into tokens, and predict the next token based on previous ones. Trained on vast amounts of language and code data, LLMs build a conditional probability of the next token. In short, these models function less as a 'genie co-worker' but more like a 'parrot', presenting an intrinsic risk for its users.

Then every stage of the LLM process is susceptible to attacks. These include poisoning training data, stealing training data, confusing the model to follow malicious instructions, and forcing the model to produce adversarial outputs or hallucinate. Furthermore, the model's 'constitution' can be compromised, exacerbating the security challenges.

Securing Models: The Complex Task

Securing AI models is a complex endeavor with no 'silver bullet' solution. From the get-go, security is different for different models and configurations (eg. one might set up high temperature for a content creation use case versus low temperature for enterprise knowledge search use case).

Then different approaches have also different limitations:

• Red-teaming, while essential, cannot cover all potential attack paths,

• Safety fine-tuning and Reinforcement Learning from Human Feedback (RLHF) doesn't cover all options as models have a probabilistic behavior and can lead to regression in other model behaviors,

• Dual-LLMs or guard LLMs require optimizing security across multiple models,

• Retrieval-Augmented Generation (RAG) can enhance fine-tuning and security measures. However, RAGs are not foolproof, with vulnerabilities in access controls, data poisoning in vector databases, insecure embeddings, and prompt injections that can steal context.

Early Building Blocks in GenAI Security

From collective insights shared by CISOs and experts, a common set of solutions is being implemented as a first approach:

1. Securing access to Data: Implementing Role-Based Access Control (RBAC), Data Loss Prevention (DLP) and/or vector databases that support Access Control Lists (ACL) enable to manage data securely and mitigate risks around data leakage,

2. Retrieval augmented generation (RAG): Used primarily for fine-tuning, RAGs provide some security enhancements,

3. AI Firewalls: Preventing data leakage on both input and output, as well as enabling tracking/monitoring of usage patterns.

Despite these measures, several CISOs reckon their practices are not yet mature enough to allocate sufficient budget for comprehensive AI security. 

To their advantage, while several anecdotal examples of attacks have garnered attention over the last few years (eg. Chevrolet dealership chatbot that was played around back in Dec23), current attacks are mostly due to misconfigurations rather than sophisticated cyber threats.

As the industry matures, key regulations help enterprises to guide their initial approaches.  Regulatory frameworks and guidelines such as MITRE ATLAS, ISO 42001 and FS-ISAC's Guidance on AI Risks have been commonly referred in shaping AI security practices. 

In conclusion, while the adoption of GenAI offers immense potential, it comes with significant security challenges that require a multifaceted and proactive approach. Organisations must invest in robust security frameworks, continuous monitoring, and adaptive strategies to safeguard their AI systems against evolving threats.

If you are building or assessing solutions in ML/GenAI security, please don't hesitate to reach out - we'd be glad to exchange perspectives.

The investment comes on a fundamental belief in StrikeReady’s tech edge. In very short terms, StrikeReady's ontology and processing engines form the logic backbone for attack and knowledge harvesting, data analysis, and contextualisation, creating customer-specific threat modeling. On top of this backbone, StrikeReady then leverages its integrations with hundreds of security tools and intelligence feeds to support diverse use cases such as alert management,  security analytics, and threat intelligence, and can operate in self-assist, semi-assist, or fully autonomous modes. 

Marketing buzz aside, we believe in true tech. But let’s jump right in to understand more. 

First-row seat to the Problem

Our team has had its fair share of investment and operational experience across the MDR and MSSP segments having backed successful firms such as Arctic Wolf, European S21sec or Excellium. After 10+ years of deploying, managing and testing a myriad of SOC vendors across Europe and the US, we’ve seen first-hand  the challenges that security teams face in terms of response efficacy, scalability, cost management and operational resiliency. From SIEM to SOAR or TIP, we’ve closely followed the waves of innovation that have attempted to address these challenges; yet, despite some great tech advancements, the same concerns remain top-of-mind for CISOs year in and year out.

We’ll focus here on how the emerging developments in SOC automation can help address these challenges of efficiency, effectiveness and scale. For a broader view of all moving pieces around modern SOC platforms, we encourage you to read this post (from which we pulled the graphic below).  

The evolution of SOC automation

As the post above depicts, from bespoke automation scripts, to SOAR platforms, to no/low-code workflow management tools, “SOC teams have been approaching automation in different ways depending on budget, technical talent and team size.”  

SOAR tools were the first to burst into the scene to address the need for better SOC automation and were positioned as extensions of traditional SIEMs. This was a first attempt to bring automation into incident handling and the early pioneers were rewarded with high acquisition prices, if not market penetration (see Palo Alto/Demisto, Sumo Logic/DF Labs, Google/Siemplify, for example). These SOAR platforms suffered from the same pains of their counterparts (SIEMs or even UEBA tools), namely of being too complex and costly to deploy and maintain and, most challenging of all, require a senior analyst to operate them. TCO quickly becomes prohibitive especially if we factor in-house engineering talent and professional services needed to implement and operate such tools. We had first-hand experience with SOAR tools having implemented them across our former MSSP Group so could quickly relate to the pain of onboarding these tools.

Low-code workflow management tools (or hyperautomation) came to market recently with the aim to removing the complexity of SOAR by providing an intuitive, drag-and-drop interface for workflow automation, while still allowing the most talented analysts to customise pipelines at the command line. These tools have experienced a lot of market hype recently, but some questions still remain as to how effectively these tools will scale to handle increasingly more complex attack vectors, use cases, and technology integrations. On the flip side, these vendors can be applicable to use cases beyond security, for instance into IT, fraud, or application development. 

More recently, vendors have been researching ways to leverage AI/GenAI advancements, and ultimately continue the trajectory of higher automation and better analyst experience. Microsoft Security Copilot and Crowdstrike Charlotte AI are some attempts to create analyst’s virtual assistants. By taking advantage of massive data lakes and recent partnerships with foundational models, cloud providers are using LLMs to understand log data and query it based on security professional’s prompts. Although facing initial experiments, this technology is expected to have a significant impact on a multi-billion-dollar category.  

Why StrikeReady 

Understanding some of the low-touch AI applications that evaded the market, we have tried during our assessment of various SOC platform technologies to separate the conversational assistant from the core back-end stack. During our interactions with StrikeReady, it became evident that the company had developed a balanced vision centralising and integrating essential security operational domains into a unified, integrated one-stop-shop solution. 

Throughout our assessment, the technology rated superior across several themes. Its ontology and processing engines create the logic backbone for attack and knowledge harvesting, action invocation, as well as data retrieval, analysis, and contextualization. Its systems organize all data ingested from customer’s existing stack, creating relationships between identities, assets, vulnerabilities, incidents, and threats, to ultimately build a specific threat model per customer. By having hundreds of bi-directional integrations, not only pulling data, but owning workflows, triggers, and pushing actions, the platform is set to cover a multitude of use cases such as alert and case management, security analytics, threat intel operationalisation, red team exercises, vulnerability prioritisation, among others. Ultimately, response to users can be triggered using different operation modes: self-assist, semi-assist or full autonomous. 

On top of a great product, there was the team’s vision and passion to accomplish something meaningful in this space. Yasir’s leadership and track record of leading multiple R&D initiatives around FireEye’s multi-product portfolio and team’s long-standing relationship reinforced our confidence and sealed the deal.  

Onwards and upwards

It’s been a pleasure working with this team and we can’t wait to see how we can contribute to the industry’s pursuit of increased analyst productivity and wellbeing.

In case you’re interested to know more, please check www.strikeready.com. 

In the wake of a transformative year in 2023, where the promise of GenAI captured the world's imagination, 2024 dawned as the year to bring these lofty ideals into tangible reality. However, three months into this pivotal year, critical voices are now raising concerns about the balance between the benefits and the risks associated with adopting GenAI use cases.

What are the real impediments in the path of widespread adoption? Beyond the challenges of prioritising use cases, hiring/retaining the right technical talent, designing & building the tech stack, among others, there are still substantial technological hurdles yet to be solved (and enough space to build!).

Nascent Adoption of Large Language Models (LLMs)

Enterprises, while enthusiastic about the potential of LLMs, remain in the experimental phase, hesitating to transition from exploration to production. GSI Accenture announced bookings of a whooping $600 million in AI revenue, underscoring the significant investments being made in this arena.

According to Gartner, the initial response from enterprises was one of caution, actively blocking usage of public LLM’s by its staff to avoid issues such as data leakage or IP protection, focusing on damage control measures. Notably, emerging security vendors like Prompt Security, among others, stepped up to address these concerns by offering ‘Shadow AI detection’ tools to monitor the usage of GenAI as well as LLM firewalls to protect for data leakage to outside the organisation.

Medium to long-term, however, enterprises have started to embrace LLMs, initially for internal use cases which provide higher risk control, while building confidence for future external ones. At present, as a recent report from a16z shows, the primary use cases for LLMs are predominantly internal-facing, reflecting a cautious approach to deployment.

Persistent Challenges in LLM Security

Security remains a paramount concern in the adoption of LLMs, with issues such as bias, hallucinations, and vulnerabilities yet to be fully resolved. The Open Web Application Security Project (OWASP) has identified the top 10 threats posed by LLMs, with proactive measures being advocated to mitigate risks. Caleb Sima, Chair of the CSA AI Safety Initiative, provides detailed insights into the top-3 threats for LLMs today and the most mature solution types the industry has so far found:

• Prompt Injection: Manipulating the prompts provided to the LLM to induce unintended behaviour. Most promising solutions so far include prompt vulnerability scanners (pre-production) as well as LLM firewalls, dual LLM approaches (as suggested by Simon Willison) or ChatML model (in production).

• Data Poisoning: Attackers injecting malicious data into the training datasets, leading to skewed model outputs. Most considered solutions are still evolving but mainly rely on pre-GenAI tools for data verification, outlier detection and trusted domain enforcement.

• Data Leakage: Unauthorised access to model outputs or training data poses a significant risk. Access control mechanisms (built into the application architecture design) as well as LLM firewalls are essential for mitigating this threat.

Several players have emerged to cover these issues (mapped in the several market maps, eg. Menlo ventures’ map) but the landscape is yet made up of very nascent players, while ‘traditional ML’ security players (eg. Robust Intelligence, Protect AI, HiddenLayer or CalypsoAI with different scopes across the ML dev pipeline) quickly evolved their offering or acquired smaller vendors to cover LLM security.

Navigating LLM Compliance Amid Regulatory Shifts

The regulatory landscape surrounding LLMs is evolving rapidly, with recent legislative developments demanding compliance from stakeholders. The European Union's AI Act, one of the most comprehensive regulatory frameworks, is set to have a profound impact on the adoption and deployment of AI technologies (ML and LLM broadly). Most importantly the act sets key references in terms of risks for AI systems and different timelines for application of the legislation for each risk level:

• Timeline Overview: The act outlines a phased timeline for implementation, but generally becomes fully applicable 24 months after its entry into force (with some exceptions, including obligations for high-risk systems which will apply 36 months after enter into force).

• Risk Overview: While this depends per use case, certain industries such as insurance and financial services, are poised to be among the first to feel the impact of these regulatory changes (eg. credit scoring used for loans were deemed as high risk) - industry leaders like Allianz recently highlighted the need for proactive measures to ensure compliance with the EU AI Act.

As stakeholders grapple with the complexities of compliance, collaboration and knowledge sharing will be essential in navigating the regulatory landscape effectively.

Unlocking the Potential

Despite the formidable challenges on the horizon, the journey towards widespread LLM adoption presents a unique opportunity to unlock unprecedented productivity gains.

At 33N, we remain optimistic in the cyber ecosystem's ability to address the security and compliance hurdles on the horizon. We also continue deeply grounded on the tech stack needed to overcome these hurdles and would enjoy to connect with any practitioners paving the way in the ecosystem, as a vendor, end-customer enterprise or integration partner. As the industry navigates through these challenges, the potential for transformative advancements in GenAI adoption remains very promising.

If you want to reach-out, connect at info@33n.vc or find us at any key industry events, in the next few weeks at:

• CyberTech in Tel-Aviv, Israel, 8th to 10th April 2024

• EIC Scaling Club Ignition Forum in Brussels, Belgium, 9th and 10th April 2024

• RSA in San Francisco, USA, 6th to 9th May 2024

Let the winds keep blowing!

Given these trends, at 33N we’re recently taken the topic to discussion at our CISO circle, jointly reflecting on adoption trends, market drivers, pain-points yet unaddressed and areas of innovation in TPRM. Despite the increased tailwinds, the topic still presents challenges at several organisations. Let’s start.

Adoption trends and Market Drivers: Why TPRM Matters

The global Integrated Risk Management market was valued at 5.0bn$ in 2022 and is expected to grow at 15% yoy to 19.7bn$ in 2032, representing a resilient opportunity, with key drivers underpinning it.

1. Escalation of high profile (and large impact) data breaches

Publicised incidents (no need to highlight examples anymore!) have continued to highlight the risk of 3^rd party supply chain compromises. Organisations must extend their security perimeter beyond their own walls to include third-party vendors. Enterprises now recognise that their security posture is only as strong as their weakest link, which often lies in their vendor ecosystem.

2. Stringent Compliance Mandates

The TPRM market has witnessed remarkable growth, fueled by stringent regulatory compliance requirements for cybersecurity and data protection. While recent SEC regulations mandate disclosure of critical cybersecurity incidents and risk management strategies (including TPRM) starting 2024 in the US, recent NIS2 and DORA regulations in Europe have set clear guidelines for TPRM practices specifically. These regulations underscore the importance of due diligence, risk assessment, and continuous monitoring of third-party vendors.

3. Business Continuity in global distributed enterprises

Supply chain disruptions, remote work arrangements and increased reliance on digital services underscore the need for robust TPRM practices. Ensuring business continuity (think of a tier-1 bank having been its systems compromised and looking to restore its systems) requires extending TPRM into creating third-party-specific incident playbooks, conduct tabletop exercises and define a clear offboarding strategy for data access.

4. Organisational need to bring together security, risk management and procurement

While the selection of TPRM vendors could be often seen falling under the CISO, this is not always the case. Most often than not, the Chief Risk Office will be called to view cybersecurity risks within a more comprehensive view of business risks and business continuity, while Procurement teams will be paramount in considering TPRM in their vendor selection, onboarding and management process.

5. Cyber Insurance

Very much tied to business continuity, cyber insurance continues to mature as a practice, highlighted by incidents such as Merck’s 1.4bn$ insurance claim settlement, organisations have the need to demonstrate effective 3^rd party cyber risk management for coverage.

While TPRM is pervasive across industry sectors, critical infrastructure and industrial verticals are emerging sectors for TPRM and currently facing a period of heightened malicious activity. These segments bring on a complex ecosystem that relies heavily on partnerships with suppliers, vendors, and other service providers, introducing a higher number of attack vectors. A recent illustrative example includes German company PSI Software, which supplies software specialised for energy providers and other industrial processes. PSI said last week it had been the victim of a cyberattack, specified on Monday that it had been hit by ransomware, and took its systems offline to prevent further intrusions.

TPRM 2.0: Automation, Integration and (inevitably) AI

At our recent CISO circle, participants had wide knowledge and adoption of traditional 1^st gen players like Bitsight and SecurityScorecard (with exceptions of organizations who de-prioritize TPRM in favor of their own pen-testing & breach simulation capabilities). New needs and pain-points were however outlined as emerging ones:

• Increased integration with cybersecurity assets to provide not only an outside in view, but also  accelerate incident response and remediation are desired

• Response for business continuity; new approaches are emerging on how to launch a minimum viable company to ensure business continuity

• Increased automation and productivity for security departments in onboarding new suppliers instead of pen-testing themselves

New vendors, such as 33N’s portfolio company Panorays, among others, are providing automation (eg. in vendor questionnaires), visibility (eg. uncovering the entire vendor ecosystem and avoiding shadow IT) and integrations (eg. with threat intelligence), simplifying the risk assessment process and visibility as well as drawing lines towards incident remediation.

In an inside-out perspective, Panorays can identify the associated risks across third parties, while its AI capabilities benefit third-party risk managers with AI-assisted responses to security questionnaires based on users’ previous answers, reducing friction for third parties and enabling quicker and more accurate answers. Panorays also uses AI to parse new data, in an outside-in perspective, to stay on top of the latest data breaches so that your organisation can mitigate risks proactively, rather than responding to any security incident once it’s too late.

As per the profile of the early adopters of these next-gen solutions, emerging medium-sized organisations will likely continue to be prime consumers, not being bound by organisational inertia replacing 1st-gen vendors and being much more permeable to automation and integration with their cybersecurity stack. Similarly, emerging segments such as critical infrastructure and industrial verticals, as mentioned, have witnessed increased interest and leap-frog the use of more traditional solutions (though not only).

As we look to the horizon, the convergence of TPRM and AI/automation, the extension of TPRM’s scope to incident response and remediation and the enabler integration with the existing cyber assets, holds immense promise for bolstering cyber resilience and fostering a culture of proactive risk management. By embracing AI-driven solutions and staying abreast of regulatory developments, organisations can navigate the turbulent waters and changing winds of third-party risks with confidence and foresight.

Let the tailwinds keep blowing!

At 33N, as the year starts, we also took time to review our mission and the winds pushing our boat. The result? More than ever, we are optimistic about our mission. It require an ecosystem play, committed investors and a new breed of exceptional founders to make a dent in the cyber ecosystem in Europe, but the opportunity is up for grabs. Let's start!

The European Cybersecurity opportunity

A burgeoning market

As the cyber threat landscape continues to evolve and expand, only further accelerated by the threats of the ongoing war in Eastern Europe and Middle East, the demand for robust cybersecurity solutions has never been greater.

In particular in Europe, total spending in cybersecurity is expected to grow at 13.4% year-on-year, faster than North America or any other region, expecting to settle at c. 1/3 of total global spending. 

This growth is fuelled by key attractive characteristics of the European market (among others):

• Public defense and security spending has hit all time highs, and is expected to continue accelerating (among others, supported by strong threat activity driven by the conflict in Eastern Europe)

• The European Union has historically been among the fastest to respond to the growing threats and emerging technologies by enforcing EU-wide public strategies (the case in point is the EU directive about AI)

• The European Union combined employs more software developers than the United States, representing a huge addressable market

Generally, Europe was coming from a lower base of spending versus more advanced markets such as the US or Israel, and, coming from a lower base, is now catching-up at increased speed.

A breeding ground for cyber leaders

Europe is also emerging as a thriving breeding ground for cybersecurity start-ups. There are several factors driving this:

• Abundant talent: Europe has a skilled workforce in computer science and cybersecurity, thanks to its top universities and research institutions

• Strong data protection regulations: The GDPR and similar regulations promote data security and privacy, driving demand for cybersecurity solutions

• Diverse market: Europe's interconnected markets expose start-ups to a variety of cyber threats, making it an ideal testing ground for innovative security technologies

• Supportive ecosystems: European cities offer incubators, accelerators, and funding opportunities, fostering the growth of cybersecurity start-ups through mentorship and access to capital at pre-seed and seed stages

A testament to the volume and quality of European innovative cybersecurity vendors, Europe has been gathering a larger share of the cybersecurity funding market.

While the absolute funding contraction is relevant, Europe was able to increase its share of Cyber VC investment to 21%. Considering also that the European VC ecosystem is richer in early stage (ie, seed) versus regions such as the US, reaching 21% share in 2023 is quite relevant and likely even more relevant in deal volume.

An opportunity, with a flipside

Opportunities don’t come without its challenges. Today, there are still key factors that hinder Europe from becoming a cybersecurity powerhouse:

• Heterogenous market across different EU countries, with varying languages, laws and culture (although on the surface acting as a single market made)

• Funding gap at post seed stage, especially from specialised and supportive investors

• Lack of innovation-savvy sales and go-to-market partners, that are glad to support and work with innovative vendors

• Still early pool of 2^nd or 3^rd time founders and management teams, a by-product of being an emerging market that only started a few years later than the US or Israel

Mindful of these challenges, at 33N we've leveraged our foundations as a team to address these precise challenges.

Having seen from the trenches the evolution of professional and managed services markets across Europe for more than a decade, we strongly believe that enterprises will increasing follow a 'managed security' approach. Managed Security Service Providers (MSSPs) and Value Added Resellers (VARs), among others, will then be the prescribers of cybersecurity technologies to enterprises and hold the key to a centralised access to the heterogenous European market.

At 33N, we look to leverage our extensive network of MSSPs/VARs as well as MDRs to bring strong awareness to disruptive cybersecurity vendors and drive adoption across Europe. We’ll look, together with founders, to tap on a network of top CISOs/CTOs at top flagship enterprises, but wide adoption will require a true ecosystem play.

Secondly, we've seen Series A/B as the stage in which there is larger gap in funding in Europe. Simultaneously, at these stages when typically Product Market Fit (PMF) has been achieved, is when sales acceleration will mean building relationships with flagship enterprises as well as building channel partnerships to support international expansion, both in direct and indirect sales motions.

Thirdly, and despite having been operators ourselves, we’ve built a network of successful serial entrepreneurs and founders, on which to tap to support our founders in growing their maturity. In addition, keeping connections to more advanced markets such as the U.S. and Israel, particularly in cyber, helping to keep clear perspective on the experience of founding teams and the competitive market landscape. If European cyber start-ups are to build solid differentiation and tap into emerging and less crowded market segments, it’s paramount to keep an ear on the ground.

Finally, in our opinion, it’s clear that Europe won’t grow to a cybersecurity powerhouse overnight and a multi-stakeholder effort is needed. We for sure expect the European defence, security and in particular, cybersecurity, to catch-up quickly with the maturity of more advanced ecosystems. The answer will lie in making the most of the existing strengths while benefiting from the right ties to advanced markets such as the US and Israel. 33N is certainly committed to heavily contributing to it.

We’re on a mission; if you’re a founder, tech executive or investor and want to take part, feel free to reach out.

We’re back on track post-Summer, just to witness the same M&A consolidation trends of the 1st half of 2023, however with hope coming from the IPO and VC markets. Given the relative shorter activity during Summer, the current letter covers the quarter (Jul-Sep) but from now on we’ll get back to monthly editions.

In public markets, the last few months have shown several key trends:

• The tech IPO market is re-opening after 1.5years of inactivity (one of the longest IPO dry spells in history); specifically, in recent weeks ARM, Instacart and Klaviyo priced their IPOs, which is providing an early gauge for investors on the viability of going public right now. Databricks also released key quarterly figures similar to a public company reporting (maybe a teaser for a IPO prospectus coming soon)

• Significant industry consolidation in the cybersecurity market (eg. Splunk’s acquisition by Cisco, Wiz's bid for SentinelOne)

• Valuation multiples corrected (see table A below, with reductions of -3% to -6% in multiples vs Aug-23) further down across the Board at the end of September (see below), driven by macro factors (eg. interest hikes, tougher enterprise sales)

A lot has been written about the rationale of the Splunk acquisition by Cisco. Frank Wang points how Splunk turns Cisco into a cyber player, Tyler Shields reckons this could be Cisco’s first step towards a broad, continuously updating contextual data set overlaid with modern AI-style query engines, giving unprecedented access to “context” around security problems.

In complement to our views, this edition inaugurates a new section where we get direct insights from tech executives and operators, this time featuring Bruno Mota and Rui Shantilal from Devoteam:

• What are the main spending/concerning trends you are seeing currently across the cybersecurity and infra software market?

The continuous investment on Cloud Security; AI and Security combined efforts

• What does this mean to you or your firm?

It means an opportunity as due to our multidisciplinary offers, we are able to help and support our customers on both these journeys to security and to cloud.

• What is you view on the impact the Splunk acquisition by Cisco will have on the market?

It reinforces the idea that Security keeps being one of the biggest topics in the agenda and will throw other players to invest on AI enabled security.

• What emerging topic are you or your firm are excited about?

AI/Gen AI

On private fundraising, large rounds were dominated by AI/ML leaders in hot segments. A relatively intense activity shows some signs of interest from VCs to return to market, where flat and downrounds still abound (anecdotal examples include Cybereason’s -88% drop in valuation or Cohere’s -65% drop). Notable round announcements:

• Anthropic raises 4b$ from Amazon, heating up the race against OpenAI, while it is allegedly in talks to raise an additional 2b$ from Google and other investors

• Databricks raises 500m$ at 43b$ valuation (c. 29x ARR), as they potentially show signs of preparing IPO (interesting perspective from Tom Tunguz on how they compare with Snowflake at same size)

• Hugging face raises 235m$ to “double down” on its supportive efforts in many domains, including research, enterprise and startups

• Aleph Alpha raises 100m$ with ambition to be the “European LLM provider”

• Poolside raised 126m$ seed that will allow to start building its General AI code writing solution

• HiddenLayer raises 50m$ and Protect AI raises 35m$, the two emerging front-runners in the AI security race

Finally on the M&A side, intense (shark) activity, both of sizeable as well as bolt-on acquisitions by consolidators (eg. Cisco, Checkpoint) is taking advantage of the limited money supply in the funding market. Key deals:

• (Yet again) the Splunk acquisition by Cisco by 28b$ (c. 7x ARR), the single largest cybersecurity acquisition in history!

• Imperva was acquired by Thales by 3.6b$, as the service provider builds its own software portfolio

• Perimeter81 was acquired by Checkpoint at 453m$

As October started and expectations settle in for the Q4 of 2023 (as well as renewed expectations for the cyber&infra software budgets in 2024) a new armed conflict started between Israel and Palestine. We wish peace returns quickly and our thoughts are with the victims of these terrible events. The conflict is however likely to escalate to have repercussions in the geopolitical and macro-economic environment and particularly in the cybersecurity landscape. Let’s adjust sails again!