AI in Cybersecurity: The Companies, the Money, and the Sameness Problem

Security has become one of the biggest markets for applied AI, and it may have the worst differentiation problem in enterprise software. AI cybersecurity companies range from startups that automate security operations, such as 7AI, Torq and TENEX.AI, each of which has raised a round of $130 million or more since December 2025, to incumbents such as Palo Alto Networks, CrowdStrike and SentinelOne, which have built AI into their platforms and bought AI security startups.

Gartner's September forecast puts spending on AI cybersecurity at $51.3 billion in 2026, nearly double the $25.9 billion of 2025, and $86 billion in 2027. The venture money has followed. Crunchbase counted $6.8 billion going into cybersecurity startups in the third quarter of 2026, up about 50% from the quarter before, and said AI startups took the overwhelming majority of it. At least 18 companies working at the intersection of AI and security raised $100 million or more in that one quarter.

Key takeaways

• Gartner forecasts spending on AI cybersecurity of $51.3 billion in 2026, nearly double 2025's $25.9 billion, and Crunchbase counted at least 18 companies at the intersection of AI and security raising rounds of $100 million or more in the third quarter of 2026 alone.
• Consolidation is moving fast: Palo Alto Networks closed its $21.1 billion purchase of CyberArk in February 2026, Google closed its purchase of Wiz, announced at $32 billion, in March, and Cyera agreed to buy Oasis Security for $1 billion about four months after its Series B.
• Cisco reported in March 2026 that 85% of the major enterprises it surveyed had AI agent pilots underway and 5% had moved those agents into production. The survey covers AI agents generally, not only security products.

Which AI cybersecurity companies are getting the money?

The large AI cybersecurity rounds and acquisitions of 2025 and 2026 fall into three categories: autonomous security operations, identity for non-human actors, and the incumbent platforms.

Autonomous security operations. The most crowded category. 7AI, founded by Cybereason's former CEO and CTO, raised a $130 million Series A in December 2025, at a valuation the Wall Street Journal put at $700 million. Torq raised $140 million at a $1.2 billion valuation in January. TENEX.AI, which pairs its AI platform with human analysts as a managed service, raised a $250 million Series B in March. Exaforce raised $125 million in May, at a $725 million valuation according to TechCrunch. Behind them, Dropzone AI raised $37 million led by Theory Ventures and Prophet Security $30 million led by Accel, both in July 2025, and Paris-based Qevlar AI raised $30 million in March.

The technical claim is broadly consistent across them: agents ingest alerts from SIEM and endpoint tools, correlate across sources, investigate root cause, and either resolve or escalate. The most ambitious say they handle Tier 1 and Tier 2 triage without a human.

Identity for non-human actors. This is the quieter and arguably more durable category, because autonomous agents acting inside enterprise systems make an existing problem, machine identities and what they can access, much bigger. The buyers agree. Oasis Security raised a $120 million Series B in March for non-human identity and agentic access governance; four months later Cyera agreed to buy it for $1 billion, and since the deal closed in September it has operated as Cyera Identity. Palo Alto Networks closed its $21.1 billion purchase of CyberArk in February and pitched it as securing every identity, "human, machine, and agentic."

The incumbents. CrowdStrike, SentinelOne, Palo Alto and Check Point have built AI into their platforms and bought what they didn't build. Palo Alto closed its acquisition of Protect AI in July 2025, SentinelOne closed Prompt Security and CrowdStrike closed Pangea in September 2025, and Check Point completed its purchase of Lakera in October 2025. Around RSAC 2026, CrowdStrike launched an agentic managed detection service, Cisco announced six AI agents for Splunk's security product, most of them still in prerelease, and Palo Alto added tools for securing AI agents. Every startup in the first category is competing with a feature as well as with each other.

Why do so many AI security startups sound the same?

Read the positioning across the AI security operations field and the claims converge almost completely. Agentic. Autonomous. Reduces analyst burnout. Handles Tier 1 triage. Cuts mean time to respond. Human in the loop where it matters.

When every company in a category makes the same claims, none of them differentiate, and buyers fall back on brand, incumbency, and whoever the analyst firms mention. That's a losing position for a startup, and in my view it's usually a communications failure rather than a product one: the products differ more than their positioning suggests.

It doesn't have to go that way. When TENEX announced its round, its CEO's post opened: "We just raised $250M to hire more humans. In the AI era. On purpose." Whatever you think of the bet, nobody will confuse that company with the other six.

Three things separate the companies that break out.

A number with a customer's name on it. Vendors in the category publish performance figures of their own. TENEX claims a reduction of more than 95% in false positives, and 7AI says its agents cut investigation times from hours to minutes. These are vendor-reported results, not independent tests, and in my experience buyers discount them accordingly. A named customer attached to the figure changes that. Torq's Series D announcement page carries a quote attributed to Carvana's chief information security officer, Dina Mathers, saying Torq's agents now handle 100% of Carvana's Tier 1 security alerts. The vendor hosts it, but it has a name a reporter can call. The figures a security operations lead actually checks are narrower: how many alerts closed without escalation, and how often an analyst overturned the agent's verdict.

A plain account of what the agent is allowed to do. A security buyer evaluating an agent asks what it can touch, what it can change without approval, and what record it leaves when it acts. At RSAC, Cisco president Jeetu Patel named trust as the main barrier to scaling up, and Cisco said 85% of major enterprises in a recent survey had AI agent pilots underway, while 5% had moved those agents into production. A company that publishes its autonomy limits and audit trail gives buyers evidence on that trust question before they have to ask.

We apply the same test to the AI tools we use inside our own agency: the answer has to be a control rather than a promise, so none of them can send email on our behalf.

An answer to the platform question. With the largest vendors shipping their own agents, every buyer and every reporter asks why they shouldn't wait for the platform they already pay for. Consolidation makes the question sharper: Google's purchase of Wiz, announced at $32 billion, closed in March, and Oasis went from a Series B to an agreed sale in about four months. Companies that say directly what they do that a bundled feature won't, and why that gap will last, get further than companies that pitch as if the incumbents weren't there.

Proof is a slower program than a launch announcement, and in a category this crowded it's the only thing that compounds.

Which reporters cover AI security?

Security has its own press corps, and it overlaps only partly with the AI beat.

The dedicated security trade writes for practitioners and tests vendor claims the way practitioners do. The business press engages on funding, breaches and market structure, and this year market structure has mostly meant acquisitions. The AI beat covers security occasionally, and usually when the story is about agent autonomy rather than about security itself.

Practically, an AI security company pitching only the AI beat is skipping the reporters who cover its buyers' work full time.

My rule for a pitch brief is to name the reporter's lens first, the through-line across what they write, and then make the story fit it.

Common questions

Which companies are active in AI cybersecurity? In autonomous security operations, startups including 7AI, Torq, TENEX.AI, Exaforce, Dropzone AI, Prophet Security and Qevlar AI. In identity for AI agents, Oasis Security, now part of Cyera, and CyberArk, now part of Palo Alto Networks. Incumbents including CrowdStrike, SentinelOne, Palo Alto, Check Point and Cisco have built AI agents into their existing platforms.

How big is the AI cybersecurity market? Gartner forecasts spending on AI cybersecurity of $51.3 billion in 2026, up from $25.9 billion in 2025, and $86 billion in 2027. On the venture side, Crunchbase counted $6.8 billion in cybersecurity startup funding in the third quarter of 2026, most of it going to AI companies.

What is an agentic SOC? A security operations model where AI agents ingest alerts, correlate events across data sources, investigate root causes, and resolve incidents or escalate them. The most ambitious systems claim to handle Tier 1 and Tier 2 triage without human involvement.

Why is it hard for AI security startups to stand out? Because their claims have converged on the same few words, and the largest security vendors now ship agents of their own. Customer proof and a clear reason the bundled feature falls short give buyers a basis for choosing a startup over the platform they already own.

Who covers AI security? The security trade press, which writes for practitioners; the business press, for funding, breaches and acquisitions; and the general AI beat occasionally, usually on agent autonomy. The security trade is the one that covers buyers' work full time.

Are big security vendors buying AI security startups? Yes. Palo Alto Networks closed its purchase of Protect AI in July 2025, SentinelOne closed Prompt Security and CrowdStrike closed Pangea in September 2025, and Check Point completed its purchase of Lakera in October 2025. Identity deals have been larger: Cyera closed its $1 billion purchase of Oasis Security in September 2026, and Palo Alto closed its $21.1 billion purchase of CyberArk in February 2026.

Sources

• Gartner, Gartner Forecasts Worldwide AI Spending to Grow 49.5% in 2026, September 16, 2026
• Joanna Glasner, Cybersecurity Investors Put $6.8B To Work In The Third Quarter, Mostly In Larger Rounds, Crunchbase News, October 15, 2026
• Meir Orbach, Cybereason founders' 7AI raises record $130 million Series A in breakneck rise, Calcalist, December 4, 2025
• Ofer Smadari, The Agentic SOC is Here: Torq Raises $140M Series D, Torq, January 12, 2026
• Eric Foster, Why We Raised $250M, and What We're Going to Do With It, TENEX.AI, March 31, 2026
• Agentic SOC startup Exaforce closes $125M round at reported $725M valuation, SiliconANGLE, May 12, 2026
• Dropzone AI, Dropzone AI Announces $37M Series B Funding Round for Global Expansion, July 28, 2025
• Prophet Security, Prophet Security Raises $30M Series A Led by Accel to Launch its Agentic AI SOC Platform, July 29, 2025
• Forgepoint Capital, Why We're Doubling Down on Qevlar AI, March 2026
• Oasis Security Raises $120 Million for Agentic Access Management, SecurityWeek, March 19, 2026
• Cyera, Cyera Completes Acquisition of Oasis Security, September 3, 2026
• Palo Alto Networks, Palo Alto Networks Completes Acquisition of CyberArk (Form 8-K exhibit), February 11, 2026, and Form 10-Q for the quarter ended April 30, 2026 (purchase consideration $21.1 billion)
• Palo Alto Networks, Palo Alto Networks Completes Acquisition of Protect AI, July 22, 2025
• SentinelOne, Form 10-Q for the quarter ended October 31, 2025 (Prompt Security acquisition completed September 5, 2025)
• CrowdStrike, Form 10-K for fiscal 2026 (Pangea acquisition completed September 26, 2025)
• Check Point, Interim financial statements, Form 6-K exhibit 99.2 (Lakera acquisition completed October 22, 2025)
• Jeetu Patel, Reimagining Security for the Agentic Workforce, Cisco, March 23, 2026
• Louis Columbus, CrowdStrike, Cisco and Palo Alto Networks all shipped agentic SOC tools at RSAC 2026, VentureBeat, April 1, 2026
• Cleary Gottlieb, Google Completes $32 Billion Acquisition of Wiz, March 2026

Salient PR works with AI infrastructure and AI-native companies across security, testing, payments and infrastructure. Funding, deal and market figures come from the public sources above and reflect each deal's status as of November 2026.