Cyber-Specialist VCs
A small set of venture firms invest in cybersecurity exclusively and compete on domain expertise rather than capital scale. Evolution Equity Partners closed Evolution Technology Fund III at $1.1B in April 2024, the largest dedicated cybersecurity fund raised to that point. A generalist megafund has more dry powder than any cyber specialist; the specialist's edge is a partner who can assess quickly whether a detection-and-response startup is a feature a platform will bundle away or a durable platform, plus a network of CISO design partners who can validate a thesis.
Specialist funds are not monolithic; three archetypes carry different edges. Seed specialists (Cyberstarts, YL, the foundries) compete on problem selection and design-partner access, building trust before a product exists. Growth-stage specialists (ForgePoint, Ten Eleven, Evolution at its later end) compete on scaling a proven product's go-to-market and steering toward durable independence or IPO. Operator-investors (NightDragon under Dave DeWalt, and other ex-CEOs) compete on their own credibility, opening boardroom and design-partner doors a career financier cannot. Each archetype matches a different constraint a founder may face — first customers (seed), a repeatable go-to-market (growth), or buyer-grade credibility (operator).
What a cyber-specialist VC does
A specialist fund earns the same way any VC does: it buys equity early, helps the company compound, and returns capital to LPs through exits (M&A or IPO), keeping ~20% carried interest above a hurdle on a 2% management fee. The specialist twist is a concentration of edge in three places. Sourcing: specialists see security deals first because founders (often ex-operators or ex-Unit-8200) route to the firm whose name signals security expertise. Diligence: a security-native partner can separate a real architectural advantage from marketing, and can pressure-test go-to-market against the "time-to-trust" problem unique to security buyers. Value-add: the most valuable thing a cyber VC offers a seed-stage company is its first ten CISO conversations — design partners, reference customers, and channel introductions that compress the 12–18-month trust-building cycle that constrains under-capitalized security startups.
Because security exits cluster in strategic M&A rather than IPOs (the exit math favors selling into a platform), specialists tend to know which strategics are shopping in which sub-segment, and they position portfolio companies toward that buyer from Series A onward.
The named firms
| Firm | Model & stage | Capital scale | Signature portfolio | What differentiates it |
|---|---|---|---|---|
| Evolution Equity Partners | Early-growth cyber + AI; ~75% early-growth / 15% late / 10% seed | Fund III $1.1B (Apr 2024); >$2B AUM | Arctic Wolf, Snyk, Protect AI, Pentera, SecurityScorecard, Quantexa | Largest dedicated cyber fund; transatlantic (US + UK/EU); growth-stage check size rivals generalists |
| Forgepoint Capital | Early→growth cyber specialist | >$1B AUM, 40+ security companies | Huntress, Attivo (→SentinelOne), CyberGRX | One of the most specialized teams; deep operator + government network |
| Ten Eleven Ventures | Cyber-dedicated, multi-stage (seed → growth) | Multiple funds, ~$1B+ cumulative | Verkada, Cylance, KnowBe4, Twistlock | Stage-agnostic within cyber; will follow a winner from seed to growth |
| NightDragon | Growth/late-stage cyber, safety & privacy | Growth-scale checks | Active across late-stage scale-ups | Founded by Dave DeWalt (ex-McAfee/FireEye CEO); unmatched strategic-buyer and CISO network |
| AllegisCyber Capital | Early-stage infrastructure security & threat intel | Long-standing specialist | Co-founder of DataTribe foundry | Deep-infra and intelligence-community tilt |
| Paladin Capital Group | Cyber & resilience, dual-use / national-security | Multi-fund | Resilience, deep-tech security | Government and critical-infrastructure thesis; In-Q-Tel-adjacent network |
| SYN Ventures | Early-stage cyber, founder-led | Smaller, concentrated | Early cyber bets | Operator-founders investing in operator-founders |
| DataTribe | Cyber/data startup foundry (forms companies) | Foundry + fund | Maryland/NSA-adjacent spinouts | Builds companies from intelligence-community IP (see 07c) |
The Israeli specialists — YL Ventures, Team8, Cyberstarts, Glilot — are covered in depth on the foundry page (07c) because their company-formation model is structurally distinct from the capital-allocation model above.
Relevance to M&A
A specialist's portfolio is effectively a pipeline of future sell-side candidates. Companies that raised a large Series B/C from Evolution, Forgepoint, or Ten Eleven 2–4 years ago, in a consolidating sub-segment, with growth decelerating below the IPO bar (~$200M+ ARR, 30%+ growth), fit the profile that typically needs a sell-side advisor within 12–24 months. The specialist partner has usually already mapped the likely strategic buyer.
Two implications follow:
- A specialist's exits serve as comps: when Evolution or Ten Eleven exits a sub-segment, the multiple sets a benchmark for the next deal in that niche — see 11a methodology and 12b valuation-by-sub-segment.
The bear case
The specialist model is not unassailable. Three things could erode it. (1) Generalists are buying the diligence edge. a16z, Sequoia, and Lightspeed now staff security-native partners and operating teams; the specialist's information advantage narrows when a $20B fund hires the same ex-CISO. (2) The capital gap bites at growth stage. Once a winner needs a $100M+ round, the specialist either dilutes its conviction by syndicating with generalists or gets crowded out — so the specialist captures the early upside but cedes the largest checks. (3) Bundling kills categories the specialist backed. A specialist's whole portfolio can be exposed to a single platform move (Microsoft bundling email security or EDR), and domain expertise does not save a company whose category becomes a free feature. The specialist thesis holds only as long as security keeps spawning durable, independent categories faster than platforms absorb them — the same wager the platform-wars and bear-case pages test.
See also: Generalist VCs in Cyber · Company Formation & the Israeli Foundry · Ecosystems & Talent · Founder's Playbook · Buy-Side Prospect Framework
Sources: Evolution Equity Fund III $1.1B (TechCrunch, Apr 16 2024); Evolution $1.1B / EU push (PR Newswire, Apr 2024); Team8 $500M / >$1B AUM (Times of Israel). Firm AUM per public disclosures.
Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.