A cybersecurity startup developing its first product just raised $245 million. That alone might raise eyebrows in a market where funding has grown scarce, but Cylake's pitch involves two powerful forces reshaping enterprise security: artificial intelligence and data sovereignty.
The Sunnyvale, California-based company announced on September 8 that it closed the round via a convertible note led by Lightspeed Venture Partners, with Picture Capital and Redpoint Ventures joining. The financing brings Cylake's total raised to $290 million since its founding earlier this year. The company expects to ship a beta version of its platform by the end of 2026, with general availability following in 2027.
Cylake is building what it describes as an AI-native security platform designed to run entirely on customer-owned infrastructure, not in the cloud. The target customers are government agencies, defense contractors, critical infrastructure operators, and financial institutions bound by data sovereignty rules that prohibit sending security telemetry to third-party cloud providers. It's a narrow market, but one where incumbents have struggled to offer AI-powered tools without requiring cloud connectivity.
A Pedigree That Opens Doors
The founding team carries weight in security circles. Nir Zuk created Palo Alto Networks in 2005 and spent years as its chief technology officer, helping build what became a $100 billion public company. He's joined by Wilson Xu, who led engineering at Palo Alto Networks, and Ehud (Udi) Shamir, a co-founder of SentinelOne. According to a September press release, the company had grown to more than 40 employees by that point.
The board reflects similar credentials. Mark McLaughlin, former CEO and chairman of Palo Alto Networks, sits alongside Greylock partners Jim Goetz and Asheem Chandna. With the new funding, Lightspeed's Ravi Mhatre joined the board, while Picture Capital's Rakesh Loonkar became a board observer.
Cylake also secured an undisclosed investment from In-Q-Tel, the CIA's venture arm, back in April. That followed a $45 million seed round led by Greylock in March. The involvement of In-Q-Tel signals interest from intelligence agencies that face especially strict constraints on where their data can live.
The On-Premises AI Bet
Cylake's approach consolidates security data from endpoints, browsers, cloud services, SaaS applications, storage systems, operational technology, IoT devices, and AI workloads into what the company calls a unified data lake. The infrastructure runs on customer-owned appliances installed in their own data centers or managed service provider facilities. Machine learning models analyze the data stream in real time, while large language models investigate threats, explain findings, and propose remediation steps, according to Lightspeed's announcement.
"We are building Cylake for organizations that cannot compromise between adopting advanced cybersecurity technology and maintaining control of their data and infrastructure," Zuk said in the press release.
The architecture sidesteps public cloud dependencies entirely. For organizations prohibited from sending security data outside their perimeters, that matters. SecurityWeek reported in March that Cylake is designed specifically for entities "barred from cloud" services.
Mhatre, the Lightspeed partner, argued in the firm's announcement that running security AI on customer-owned appliances means "the marginal cost of intelligence is close to zero" compared to per-token pricing models common in cloud-based systems. "Most of the market has been slow to realize how AI and SaaS shifted the goalposts for enterprise cybersecurity," he said.
Pre-Product, Post-Hype
The $245 million raise is structured as a convertible note rather than priced equity, leaving the company's valuation undisclosed. Cylake declined to share that figure. Convertible notes have become more common at early stages, allowing founders to delay valuation negotiations while still securing capital.
Large funding rounds for pre-product companies have drawn scrutiny, but they haven't disappeared. Industry data suggests seed and pre-seed deals exceeding $100 million, while still rare, have ticked upward. Cybersecurity deals involving AI-enabled companies have dominated recent investor activity, according to financial services data.
Cylake is working with unnamed design partners but has not publicly identified any customers. Loonkar of Picture Capital said in the release that "Cylake is already partnering with some of the top organizations across industries on product development." How many, and in what capacity, remains unclear.
Zuk published a blog post in March titled "Sovereignty is the Next Firewall," framing data and infrastructure control as the emerging security perimeter in an AI-dominated era. The thesis resonates with governments and regulators increasingly wary of data exposure, though whether it translates into a large enough market to justify the valuation Cylake will eventually need remains an open question.
The company operates out of 525 Almanor Avenue in Sunnyvale and plans to use the new capital for product development and hiring. The timeline is aggressive: beta by late 2026, general availability in 2027. In a market where security buyers have grown cautious and sales cycles have stretched, Cylake will need to prove that on-premises AI can compete with the cloud-native tools that have dominated the past decade.
