Israeli data security firm Cyera has held early talks with investors about a new round at a $20bn valuation, according to The Information. For UK organisations buying tools to control what staff and AI agents can see, it shows how fast this market is consolidating and why vendor due diligence now matters as much as the features.
What happened
On 30 October 2026 The Information reported that Cyera had begun preliminary discussions with investors about raising fresh capital at a valuation of around $20bn. The report was picked up the same day by Calcalist’s English-language site Ctech and by Dealroom, which both attribute the figure to The Information. Cyera declined to comment, and none of the coverage names a lead investor, a round size or a timetable. Ctech says the talks are at an early stage and may not lead to a financing at all.
If a round does go ahead at that price, it would mark a sharp step up from the $12bn valuation Cyera achieved earlier this year in a $600m Series G led by Evolution Equity Partners, with Cyberstarts and Temasek also taking part. Reports differ on when that round was priced, so the timing is best treated as some point in the first half of 2026. Goldman Sachs Alternatives then put in a further $400m, which Dealroom dates to September. On the reported figures, that takes Cyera’s 2026 fundraising to roughly $1.4bn and its lifetime total to more than $2bn.
The valuation history, as Ctech tells it, is steep: about $3bn in 2024, $6bn in 2025 and $12bn in 2026. Co-founders Yotam Segev and Tamar Bar-Ilan started the company in 2021. According to Dealroom, Cyera also agreed in July to buy Oasis Security, a specialist in non-human identity, for $1bn.
The detail
Cyera works in data security posture management, usually shortened to DSPM. Its software connects to cloud storage, databases, SaaS platforms and email, finds and classifies sensitive records, and flags when that data is exposed or reachable by the wrong people. According to the coverage, it has been pushing that discovery engine towards controlling AI agents. Its September announcement with Goldman was framed around being a “trust layer” for what it calls the agentic enterprise.
The investment logic is easy to follow. An agent working for a user will open files, run database queries and hit APIs, often under broad service permissions. If a business cannot say which data an agent is allowed to touch, a single over-scoped token can expose far more than any one employee could.
What is missing from the reporting is just as important. No outlet has published revenue, profit or customer numbers for Cyera, which leaves the price impossible to check from outside. Dealroom, citing The Information, names Blue Cross Blue Shield, Paramount and Chipotle as customers, all US firms. The competitive field is crowded too: Wiz, Varonis, Securiti, BigID, Cyberhaven and Microsoft Purview all chase the same budget line.
The wider deal flow points the same way. Proofpoint’s agreed $6.3bn all-cash purchase of Varonis, announced on 15 October according to Infosecurity Magazine, suggests that the bigger platforms would rather buy data security capability than build it.
Why it matters for UK organisations
Data security tooling is turning into a market of a few heavily funded independents and a handful of suites, and that shapes contract terms, pricing and roadmaps.
Three things stand out for UK organisations. First, the regulatory driver is real. UK GDPR already requires appropriate technical measures to protect personal data, and the ICO expects organisations to know what personal data they hold and where it lives. Deploying Microsoft 365 Copilot or similar assistants on top of years of badly permissioned SharePoint and file shares makes that question harder, and DSPM tools are often sold as the fix.
Second, consolidation brings vendor risk. A start-up reportedly seeking a $20bn valuation on undisclosed revenue would face pressure to grow quickly, raise again or be acquired. Any of those can change pricing, support or product direction partway through a three-year contract. The Varonis deal is a live reminder that today’s independent vendor can belong to someone else within a year.
Third, these platforms need deep, privileged read access to your most sensitive stores. That makes the vendor itself a high-value supply chain target, and it puts data residency, sub-processors and the location of metadata indexes on the procurement checklist, particularly for public sector bodies and regulated financial services firms.
Expert view
In my experience, the organisations that get value from data discovery tools are the ones that already had a rough idea of where their crown jewels were. When we test environments, the problem is rarely a lack of tooling. It is usually inherited permissions: “everyone” groups on file shares, old project sites left open, and service accounts with rights nobody can explain. AI assistants do not create that mess, but they make it searchable in seconds.
A big valuation is a signal about where money is flowing, not about whether a product suits your estate. The questions that matter are duller ones. Can the tool see your actual data sources, including on-premises file servers and legacy databases? Does it work with the identity platform you already run? And can you get your classification metadata back out in a usable form if you leave?
The agent angle deserves serious attention. Non-human identities are now among the most common gaps we find: API keys in repositories, long-lived tokens and automation accounts with domain-wide rights. Whether or not you buy a DSPM product, tightening those identities is cheap and effective.
What to do now
- Fix access before buying tools. Review broad groups and inherited permissions on file shares, SharePoint and cloud storage. This maps directly to the Cyber Essentials user access control requirement.
- Inventory non-human identities. List service accounts, API keys and agent tokens, give each a named owner and an expiry date, and scope them to least privilege.
- Gate AI assistant rollouts on data hygiene. Pilot assistants against a cleaned, well-labelled data set before enabling tenant-wide access.
- Build vendor viability into procurement. Ask about change-of-control terms, data export formats, residency of indexes and sub-processors, and your exit plan if the supplier is bought.
- Check what you already own. Many Microsoft 365 E5 customers already have Purview licences. Compare those capabilities honestly before adding another platform.
- Treat the vendor as privileged access. Apply the same monitoring, logging and secure configuration controls to a DSPM connector as you would to an administrator account.
Bottom line
The reported $20bn talks are unconfirmed and may come to nothing, but they suggest how highly investors now value control over who and what can reach corporate data. For UK organisations the practical lesson has little to do with Cyera itself. Get permissions and machine identities under control, and buy data security tooling with consolidation in mind, because the supplier you sign with this year may have a new owner by the next renewal.
Sources
- Ctech by Calcalist: Cyber startup Cyera eyes $20 billion valuation in new funding talks
- Dealroom: Israel’s Cyera eyes $20B valuation, nearly double its June price
- Tech Insider: Cyera $20 billion valuation talks, up from $12B
- Infosecurity Magazine: Cybersecurity M&A Roundup: Proofpoint Agrees $6.3bn Varonis Acquisition
