Company Formation and the Israeli Foundry Model
In 2025, an Israeli cybersecurity startup was funded roughly every three days — 130 companies raising a record $4.4B across the year, per YL Ventures' tenth annual State of the Cyber Nation report. (Broader tallies that fold in adjacent AI-security and infrastructure run higher, toward ~$8B; the gap is a definition difference, not a contradiction.) No other geography concentrates security supply like this: a country with under 0.3% of global population originates a disproportionate share of the world's net-new security companies — and, eventually, a disproportionate share of the targets that US strategics acquire. The Israeli pipeline is among the richest origination maps for future sell-side mandates in the market.
Why company formation is a distinct model
Most VCs allocate capital to founders who show up. A foundry (also called a company-builder or studio) does something structurally different: it forms the company — identifying a problem, recruiting the founding team (often from the same intelligence-unit alumni network), providing the first capital, and embedding go-to-market and design-partner access from day zero. The foundry takes more equity and more risk than a seed fund, but it compresses the two things that kill early security startups: time-to-team and time-to-trust.
This model is most powerful in Israel because of a unique input: Unit 8200 and related IDF intelligence units function as a national pre-seed accelerator. Conscripts spend their late teens and early twenties building offensive and defensive cyber tooling at nation-state scale, then muster out as a dense, pre-vetted, pre-networked talent pool. The foundry's edge is privileged access to that pipeline before the founders even know they want to start a company.
The named institutions
| Institution | Model | Scale / notes | Signature outcomes |
|---|---|---|---|
| Team8 | Foundry + fund; builds and spins out companies | Raised $500M new funds (2025), backers incl. Microsoft & Cisco; >$1B AUM; ~8 exits | Talon (→Palo Alto) + Dig Security (→Palo Alto) ~$1B combined; Claroty; Sygnia |
| Cyberstarts | Seed-stage, "Sunrise" CISO design-partner network | The most successful recent seed engine | Wiz (seed), Gem, Grip |
| YL Ventures | Israeli seed → lead, cyber-exclusive; sells positions early | Tel Aviv; publishes the annual State of the Cyber Nation | Orca, Axonius, Cyera, Hunters, Twistlock |
| Glilot Capital Partners | Early + "Glilot+" growth | Seeds a meaningful share of exited cyber co's | Hunters, Sentra, Cynet |
| DataTribe | US (Maryland) foundry — intelligence-community IP | NSA/Fort Meade-adjacent talent | Cyber/data spinouts (the US analogue of the model) |
YL Ventures' report makes the concentration explicit: YL, Cyberstarts, Team8, and Glilot together seeded ~25% of all exited Israeli cyber companies over the studied period — four institutions originating a quarter of an entire nation's security exits.
How the conveyor works
Two 2025 shifts changed the model's character. First, global capital overtook domestic at every stage and became the leading source of seed funding for Israeli cyber for the first time — meaning the best Israeli companies now get US growth capital earlier, accelerating the path to US strategic buyers. Second, a build-don't-flip generation emerged: a cohort of founders focused on building category-defining companies (Wiz, Cyera, Pentera, Cato) rather than the historical quick-flip-to-a-US-acquirer pattern. The proof is that Israeli scale-ups are now acquirers themselves — Check Point, Cato, Cyera, Pentera, and Orca bought ~12 domestic startups in 2025, the most ever, creating an intra-Israel M&A layer beneath the US-exit layer.
Relevance to M&A
The foundry pipeline feeds sell-side origination three ways:
- The graduating class is concentrated and legible. Because four institutions seed a quarter of exits, the next 24 months of sell-side candidates can be mapped from four portfolios — companies at $30–150M ARR, in consolidating sub-segments, whose foundry backers and growth investors will eventually need liquidity.
- Exits set the comps. Talon + Dig at ~$1B combined, Wiz at ~$32B, and each year's exit cohort calibrate the valuation benchmarks for cloud, data, and AI security niches.
The bear case
The foundry model is durable but not invincible. (1) Geopolitical and conscription risk. The entire conveyor depends on a stable supply of Unit 8200 talent and a functioning domestic funding market; sustained conflict, reserve-duty drain, or a talent exodus would throttle formation at the source. (2) The build-don't-flip generation may not pay off. Companies engineered to stay independent and reach IPO scale face the same reset and bundling risks as everyone else — and if the IPO window stays narrow, "build" reverts to "flip," compressing outcomes. (3) AI may relocate formation. If frontier-AI tooling lets small teams anywhere spin up security products without an elite-unit pedigree, the geographic concentration that is Israel's edge erodes. The thesis holds as long as elite human talent plus design-partner access remains the binding constraint on building a security company — the moment AI loosens that constraint, the foundry's privileged input matters less.
See also: Cyber-Specialist VCs · Generalist VCs in Cyber · Geographic & Regional Breakdown · Ecosystems & Talent · Sovereign & Government · Buy-Side Prospect Framework
Sources: YL Ventures State of the Cyber Nation — $4.4B / 130 rounds (SecurityWeek, Dec 2025); 130 startups / global capital surpasses domestic (PR Newswire, Dec 8 2025); One startup every three days (Jewish News); Team8 $500M / Talon+Dig ~$1B (Times of Israel).
Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.