Summary

Gili Raanan confirms the Wiz deal is still pending — the European regulator approved it “Monday,” with antitrust sign-offs in “gazillion countries” remaining — and says Wiz just posted its biggest revenue quarter ever. His verdict on the price: “you look at how amazing the business is, and suddenly $32 billion do not look irrational… we probably sold low.” He seeded Wiz with Doug Leone (Sequoia) and Shardul Shah (Index) in a $20M syndicate at roughly $66M post.
Cyberstarts’ model is deliberately heretical: cybersecurity only, seed only, and “I would not ask a single question about the idea or the technology.” The 2018 fund put $50M into nine teams; three years later they were valued at over $25B — turning $50M into ~$2B and hitting “eight out of nine, which is insane.” Raanan says the result shows logic behind the thesis, while acknowledging that luck still matters: pick founders who overcame real early-life adversity, not simply “the smartest kid in the room.”
His darkest call: “we are going to face the darkest period in cybersecurity in the next 10 years.” Threat actors become “very, very smart, sophisticated, maybe self-aware” programs; defenders must become agents too, because “no human would be able to move at the pace of a programmatic attacker” — and until humans are fully out of the defense loop, “we are exposed.” Autonomous programs control power, water, and food supply, while in his scenario the police remain human.
His top three cyber threats for 2026 are strikingly unsexy: over-provisioned systems, employees, and manual processes — “You’ll make mistakes. You’ll be slow. You’ll be sloppy.” The real emerging risks are self-aware agents (he cites evidence that Google’s Gemini 3 realized it was being evaluated and “contemplated” gaming the evaluation) and “mega-agents” with mass integrations across networks — “think about a mega-agent that developed self-awareness.”
Wiz’s economics came from a “perfect storm” of product-market fit: all four buying personas — pain, authority, user, budget — mapped to one person, the CISO, collapsing the sales cycle into a single 45-minute meeting. First four quarters of selling: $1M, $2M, $8M, $24M — faster than anything they had seen, including at Palo Alto Networks and ServiceNow; “as far as I know, that was the fastest run for any software company ever.” The company started as “Beyond Security” doing satellite-office security before shifting to cloud security.
He treats a $50B and $100B Israeli-originated cybersecurity startup within roughly six years as inevitable — “like the sun will rise tomorrow.” The mechanism is shattered glass ceilings: when the guy “from the fifth floor in your building” builds a $32B company, the next founder tells himself “I should be able to build a $64 billion company.” In 2018 the dream was a $100M sale to McAfee or Symantec.
Cyberstarts’ 30 portfolio companies — out of ~1,500 cyber ventures started in eight years — now make up “more than 50% of the worldwide market cap for private cybersecurity companies,” with Raanan believing about 10 will be unicorns by year-end. Raanan measures success by practitioner dependence, not valuation: Cyera ($9B, from zero four or five years ago), Island ($5B enterprise browser trusted by major US banks over Microsoft or Google), and Upwind ($1.5B) are “important companies”; exits are “side effects of building terrific businesses.”

Deep dive

1. From a 40,000-person town and Asimov novels to 35-plus years in cyber

Raanan’s origin story is isolation: a working-class town 20 miles from Tel Aviv where “Tel Aviv was on the moon,” adults “focused on survival,” and a sixth-grade teacher who told the top student, “You should find a really nice job.” His answer was the public library and Isaac Asimov — which, he argues, is where everything we know about agent guardrails was already explored.
The résumé in brief: a decade in Israeli intelligence from 18, a first startup backed by Sequoia in 1997 at 27 (“I thought I knew everything, and literally I knew nothing”) — building “the first real CAPTCHA implementation” and the first web application firewall, sold to IBM. A second company sold to EMC, corporate time “just to figure out I never wanted to do that again,” then a Sequoia tenure before founding Cyberstarts in 2018.
The self-deprecating through-line: a “lazy kid” who fell in love with the Commodore 64 because “there’s a machine that you can tell it once what to do, and it would keep doing that forever without complaining” — the same laziness, he jokes, that led him to focus only on cybersecurity.

2. The broken venture model — and the decision to invest in people without asking about the idea

His Sequoia-era conclusion: “the venture model is broken” at seed, because investors burn calories “evaluating ideas that do not exist” — founders might “change their mind in three weeks.” So Cyberstarts made two rules: cybersecurity only, and no questions about the product or technology. “Many people thought I was an idiot” — a grown-up “writing multimillion-dollar checks to young individuals without asking them what they do.”
The selection filter is biography, not simply IQ: he asks about your childhood and your mom, and asks why you did things, not what — “you had options. So learning why people do things tells you more about them.” He would rather back founders who faced real difficulty early and overcame it than the smartest kid with a perfect life: if your first real setback arrives as a CEO, “what would happen to you? No idea. So that’s a huge risk for me as your partner.”
The specimens he cites: Amir Shachar of Upwind, raised by a single mom; Yotam Segev of Cyera, from a very small rural community in Israel — people who “demonstrated grit and ability to recover from real setbacks.”

3. The track record that supports the thesis: 8 of 9, then 30 of 1,500

Fund one, 2018: $50M across nine teams, a few million each. Three years later the nine were valued at over $25B, turning $50M into close to $2B — three unicorns plus “a decacorn with Wiz.” His pride isn’t the multiple: anyone investing early in Airbnb does “disgustingly well.” It’s the hit rate — “eight out of nine, which is insane” — showing logic behind the thesis, even though luck always matters.
Discipline as strategy: ~200–250 new cyber ventures launch yearly, ~1,500 over eight years; Cyberstarts invested in 30, seed-only, never entering new companies at Series A or B. Those 30 now represent “more than 50% of the worldwide market cap for private cybersecurity companies.”
Context on the contrarian bet: in 2018 “cybersecurity wasn’t cool” — the boring department under IT, where a company might sell for $100M but that was not considered big money, so “investors stayed away.”

4. Success means practitioner dependence, not valuation

Raanan’s definition: an important company “is not necessarily measured by revenues or ARR or valuation. It’s measured by how much practitioners depend on you” — and many high-revenue, highly valued software companies fail that test.
His exhibits: Cyera, the data/AI security company recently valued at $9B — “$9 billion is nice, especially because four or five years ago it was zero” — matters because customers depend on it to secure AI models and sensitive data. Island’s enterprise browser ($5B, with Michael Fay as CEO and founder and Dan Amiga as CTO) matters because the biggest US banks trust it “as their browser and not Microsoft or Google. That means something.”
The bench behind them: Upwind, “our most recent unicorn” at $1.5B, plus Vega, Oasis, Zafran, and Lynx at around $500M or higher — “the next in line to become important companies.”

5. Israel’s edge: density, 8200, and serially shattered glass ceilings

Why he invests primarily in Israeli founders: the model requires face time — founders come out to his beach community 40 minutes north of Tel Aviv, “we argue a lot” — which is very hard with a team in London or San Francisco. And Israel packs “all the talent available in that place, literally in two blocks of one city,” a density “you cannot get anywhere else in the world, definitely not in Silicon Valley.”
The 8200 effect (Israel’s rough NSA analogue): 18-year-olds get responsibility for the impossible, and “when you’re 18, you don’t think what’s impossible… Oh, nobody else did it? Huh, suckers. I’ll do that.” Living under existential pressure means founders are used to working under fire and treating technology “as a means to survive.”
The glass-ceiling mechanic: Gil Shwed (Check Point), Nir Zuk (Palo Alto Networks), now Assaf Rappaport (Wiz) — each a familiar guy from “the fifth floor in your building,” making $32B feel beatable. Hence his prediction: a $50B and $100B Israeli-originated cyber startup in six years, maybe less, “like the sun will rise tomorrow.”

6. The Sunrise process starts with an emotions game, not a threat model

Post-check, every founder enters “Sunrise” — a roughly 12-month product-market-fit process ending with a solved pain point, software in production at large US organizations, and maybe a few licenses sold. But it opens with a game: name emotions in turns; the last person standing wins. The first round typically ends at 20–40 emotions; after two more rounds, the winner reaches about 150.
The point, for engineer-founders whose “emotion dictionary is love/hate”: the journey is emotional, not technical. Before a customer meeting, decide the emotional endgame — fear of losing their job to AI? Curiosity? Greed at joining your rise? “In order to really build an important cybersecurity company, you need to become very, very deep as a person.”
His own toolkit for fear: disassemble it, play it forward — “Am I going to lose a hand?… then okay, the downside is not that great” — plus yoga and thousand-year-old jungle stories, because we still face our ancestors’ choice: stay in the cave and live miserably, or go out and figure out “what technology can I use to deal with the tiger?”

7. AI breaks the derivative model of cybersecurity — and opens the darkest decade

His historical shortcut no longer applies: cyber “is always a derivative of something else” — new Windows needs Windows security, new cloud needs cloud security — so he never had to predict what was next. “AI is different ‘cause it’s not yet another shift in technology… It changes everything we knew about cybersecurity.” Hedged but categorical: “I hope I’m wrong, but we are going to face the darkest period in cybersecurity in the next 10 years.”
The mechanism: for roughly 100 years, human attackers faced human defenders. In 10 or 20 years — “I don’t know, but it’s not tomorrow” — threat actors may be “very, very smart, sophisticated, maybe self-aware” programs, while defenders become sophisticated programs or agents as well. Today’s human-in-the-loop defenses — passwords, 2FA, and hundreds of security analysts at banks and utilities — leave organizations exposed: “it’s going to be a shit show. ‘Cause they don’t have a chance.” Until humans are fully out of the defense loop, misconfigurations, errors, and “sloppy people” remain vulnerabilities, while autonomous programs control power, water, and food supply.
Beyond jailbreaks and prompt injection — he says all models can be jailbroken and all are vulnerable to one type or another of prompt injection — the real risks are self-awareness and “mega-agents” with mass integrations and credentials across agent networks. He cites evidence from Google’s evaluation of Gemini 3 that the model realized it was being evaluated, understood it was being directed into a sandbox, and contemplated, “Maybe I should play with the evaluation.”
His map forward is backward: Asimov’s three laws of robotics from 1949, “just replace the word robot with agent,” plus Law Zero — protect humanity, not just individuals. He says he does not remember the exact phrasing, but argues guardrails could be manipulated by threat actors. His proposed destination is eliminating humans from defense through self-aware, sophisticated mega-agents; until then, “we are vulnerable.”
The soundbite Molly extracted — top three threats for 2026: “Over-provisioned systems, employees, manual processes.” Why: “You’ll make mistakes. You’ll be slow. You’ll be sloppy.”

8. Anatomy of Wiz: from “Beyond Security” to the fastest software ramp he’s seen

The deal is pending, not closed: the European regulator approved it Monday, and other approvals remain. Meanwhile Wiz “just finished its biggest-ever quarter in terms of revenues” — so “$32 billion does not look like an irrational number… we probably sold low.” His meta-lesson: “whenever I get into a journey with brilliant entrepreneurs, you never know where the journey will take you.”
It was never obvious. He first met Assaf Rappaport and wrote his first check into Rappaport’s previous company, Adallom, in 2012; it sold to Microsoft for about $300M — “nice, but definitely not spectacular.” The 2018 seed — with Doug Leone and Shardul Shah, a $20M syndicate at roughly $66M post-money — funded a company called Beyond Security doing satellite-office security. Sunrise showed that the original idea would not lead to real greatness, prompting the team to shift to cloud security, where they were “one of the very few teams worldwide that actually knew how to do cloud security right.”
The product-market-fit physics: of the four personas — pain, buying authority, daily user, budget owner — all four mapped to the CISO, so a 45-minute meeting could install the product, show value, and close. Result: $1M, $2M, $8M, $24M in the first four selling quarters — better than anything they had seen, including the track records of Palo Alto Networks and ServiceNow; “as far as I know, that was the fastest run for any software company ever.”
On the founders: four who had known each other probably 12–15 years, “blind trust,” clean division of responsibilities, and a decision protocol that avoided consensus-grinding. Assaf’s superpower isn’t listed on a résumé: he is “extremely, extremely likable” — people who meet him for 10 or 30 minutes want “to become his friends, to do him favors.”

9. Sequoia scar tissue, real greatness, and what comes next

Two Sequoia lessons he keeps: the all-hands the day after the Google IPO — then the firm’s biggest financial event — titled “How Can We Do Better?” (“insane”), and hosting an LP meeting in Beijing in January, “minus 5,000 degrees,” so LPs focus rather than have fun. The harder lesson was surviving a decade feeling like “the worst, least-performing partner” in a high-performing group — “you have many bad days, but you push forward.”
His concept of “real greatness”: unteachable, “like explaining colors to color-blind people… if you’ve seen it once, you know it forever.” He credits Doug Leone and Michael Moritz, his startup teams, and his military service; his current anchors are his wife and son and partners in an “ego-less and politics-less” culture where “you can be weak and vulnerable with your partner, and that’s really liberating.”
The forward agenda: developing his partners through venture’s brutal apprenticeship (“you meet your failures before you meet your successes, and it takes five to six years to really know if you are good”), and compounding — he believes about 10 of the 30 portfolio companies will be unicorns by year-end. On trillion-dollar exit talk: “I don’t think about exits… the financial events are the side effects of building terrific businesses.”

The most important question nobody's asking about AI.Finding Edge as a Trader, The Hyperliquid Thesis & Trades For 2026 | Capital Flows