Special Report: Israeli Cyber Startups M&A Landscape 2024

In this first part of the blog series, we will analyze the M&A landscape in Israel. The full report can be downloaded below. All data is of the date of publication on December 23, 2024.

*Data sources: Pitchbook, IVC, Startup Nation Finder, well-regarded PR publications, first-hand information.

Exits (M&A):

There have been 116 acquisitions of VC-backed Israeli cyber companies in the last six years generating more than $23B in combined exit value. 51 (44%) of them have been at or above $100M in exit price.

This year, 67% of exits were at or above $100M. We saw almost the same number of $100M+ exits as last year, but last year, these $100M+ exits accounted for only 52% of total exits. Compared to 2019, 2024 saw 2.8X the amount of $100M+ exits.

After which fundraising round do majority M&As in Israeli cyber occur? Does it differ for exits that are above $100M?

The majority of exits above $100M used to be after growth funding rounds, but now, most $100M+ exits happen after just Seed or A funding. This year, 57% of total $100M+ exits have been after the company raised just seed or series A funding.

Since 2019, 61% of total exits (regardless of size) have been after the company raised just seed or series A funding. 45% of all $100M+ exits have been after just seed or series A funding.

How much time does it typically take to get acquired, and how has this changed over time?

Today, the average Israeli cyber exited company is only 3-4 years old. Many of today’s acquisitions are startups that were founded during the COVID boom.

When looking at the average (table 1), as compared to last year, for $100M+ exits, the time to exit from day 1 has decreased by 29%, or by almost 2 years. For exits under $100M, the time to exit has decreased a bit compared to last year. Moreover, compared to 2019, exits less than $100M are actually taking 21% longer to get acquired than they used to.

However, when evaluating the median to account for outliers like CyberSixGill, CyberInt, Imperva, Perimeter81, and other companies that were running for 10+ years before exiting, we can see a clearer story that hasn’t changed much since 2019: Smaller exits typically happen in three years and $100M+ exits typically happen in four.

* This excludes CyberInt

During the COVID-19 bubble, we saw a sudden switch in majority: Instead of the shortest exits being the smallest, suddenly exits at or above $100M happened in the shortest time. When the bubble burst in 2022, things reverted back to “normal” for 2022 and 2023, and this trend is continuing.

How much fundraising capital does it take to exit? How has the Exit:Fundraising Multiple (the amount you were acquired for divided by the amount you raised) changed?

What are the categories of M&A Waves we have seen, and how have they changed over time?

“M&A Wave” is a phenomenon that we define as a bulk of vendors operating in the same space with very similar value offerings that are all acquired around the same time. A recent example of this can be seen in the DSPM space, aka the DSPM M&A Wave. Most DSPM companies were founded in 2020. By 2023, we saw three DSPM acquisitions (Polar Security, Laminar, Dig Security) and in 2024 we saw another two (Flow Security, Eureka). There are two remaining players, Cyera and Sentra, each working to achieve scale instead of going the fast M&A route.

Main subcategories of M&A waves through the years:

• 2019 = Bot detection, connectivity, secure access, SOAR, WAF, container security
• 2020 = Threat intelligence, authorization, kubernetes security, ad-tech security
• 2021 = ASPM, workload, endpoint, more SecOps
• 2022 = more endpoint, web security, IOT, ASPM, mobile
• 2023 = API Security, ransomware prevention, SASE, CSPM, PAM

The same thing happens on the early-stage investment side – what we call the “Seed Wave” of investments, where major VCs make plays in a specific market category around the same time.

For example, this year we’ve seen nearly ten different teams in Israel work to establish and raise seed funding rounds for companies operating in the ‘AI for the SOC’ space. We’ve also seen a ‘next-gen DLP’ seed wave and an ‘AI Security’ seed wave, with many Israeli ‘Security for AI’ companies launching out of stealth such as Noma, Lasso, DeepKeep, Apex, Prompt, Adversa, and more.

The next question to ask would be: Is it easier/faster for startups to get acquired if they RIDE a wave or if they create a new one? We’ll explore this in a future report.

Summary

Moving forward, we believe that M&A activity in Israeli cyber will remain strong and will remain the main avenue for liquidation in this ecosystem. Here are some predictions:

• Time to Exit – Although it has been decreasing over time, it will only continue to decrease up to a certain point. Companies still need to deliver legitimate value and see growth over time in order to be acquired.
• Exit: Fundraising Multiples – Multiples have been 6-7X on average in the last six years. As threat landscapes continue to evolve and cyber remains top priority, with interested acquirers on the other side who are seeing success and have the ability to continue buying companies (enough free cash flow for acquisition activity), we predict this will likely stay steady over time.
• Acquirers – Up until now, most M&A activity has been done on behalf of American public corporates. This will continue, but we will also see more acquisitions done on behalf of Isreali private companies that are growing fast, such as Wiz and Cyera who have both acquired Israeli startups this past year.
• M&A Wave Categories – We predict the M&A wave for Unified Remediation will continue in the coming months. Other categories that can see M&A waves in the coming year include early-stage startups in Security for AI, non-human identity, and CNAPP (features, not platforms).

Generally, the exit:fundraising multiple (“fundraising multiple”) has remained steady – around 6-7X. This means that per the median and average, over the last six years, an Israeli cyber startup is acquired for six to seven times the amount of funding they raised in their company lifetime. I don’t believe there is a causal relationship here (just because you raise more money does not guarantee you will get acquired for more money), but there is  correlation. The fact that the multiple increased drastically for larger exits and decreased over time for smaller exits could be the implication of larger early-stage fundraising rounds. Those that are growing fast are seeing higher valuations than ever before, and those that aren’t able to sustain this growth ended up getting acquired for more reasonable prices. Meaning, if you succeed in fast growth, your valuation skyrockets. If you don’t, then you aim to sell fast.

When looking at last year compared to now, we can see that:

• There is an increase of 41% for exits at or larger than $100M. This means, the same amount of funding is generating 41% more in exit dollars.
• For exits below $100M, it is still more, but just by 11%.

The bottom line from the analysis thus far is: Fundraising dollars are resulting in MORE exit dollars in LESS time.

Have the majority of Israeli cyber exited companies raised from Israeli or Foreign VCs? Who are the VCs in Israel seeding the best performing companies?

The majority of exited Israeli cyber startups from 2019 to today were seeded by Israeli VCs but raised follow-on funding rounds from top USA-based or European-based funds like Bessemer, Insight, SYN Ventures, Battery, Tiger Global, Accel, USVP, and others. The early-stage VCs in Israel specializing in leading seed cyber rounds are Team8, Cyberstarts, Glilot, and YL Ventures, and are considered Tier 1 for early-stage as measured by higher numbers of M&As and Unicorns against other VCs.

Their strong results enable them to get first access to top deal flow and continue to drive repeatable results. These four Tier 1 early-stage cyber VCs have seeded 25% of the total exited companies (72% of which have been at or above $100M). Out of the total exits at or above $100M, they have seeded 41% of them.

Cyberstarts-backed companies have generated the most amount of exit dollars since 2019. Cyberstarts has the highest number of $100M+ cyber exits and are tied with Glilot for the highest number of cyber exits in general, regardless of size.

These four early-stage, cyber-focused VCs have built strong names for themselves over the last six years. Data shows the cyber portfolio companies of these four funds see FASTER time to exit and typically a better fundraising multiple (the ratio of amount of funding raised to total exit dollars generated) compared to startups funded by other early-stage VCs.

hile none of these four have a company that has IPO’d yet, Cyberstarts, YL and Team8 have seeded 8/21 unicorns today, many of which are expected to potentially go public, such as our portfolio company Claroty (Team8), Wiz (Cyberstarts), Cyera (Cyberstarts), Island (Cyberstarts), Axonius (YL Ventures), and others.

Who are the most active acquirers of Israeli cyber startups?

71 of the 116 M&As of Israeli cyber startups since 2019 were done on behalf of public companies and 45 on behalf of a private company. The acquirers consist of a mix of both Cyber Titans and Tech Titans. The only private company with at least 3 acquisitions is Wiz, all in the last 12 months.

What are the categories of M&A Waves we have seen, and how have they changed over time?

“M&A Wave” is a phenomenon that we define as a bulk of vendors operating in the same space with very similar value offerings that are all acquired around the same time. A recent example of this can be seen in the DSPM space, aka the DSPM M&A Wave. Most DSPM companies were founded in 2020. By 2023, we saw three DSPM acquisitions (Polar Security, Laminar, Dig Security) and in 2024 we saw another two (Flow Security, Eureka). There are two remaining players, Cyera and Sentra, each working to achieve scale instead of going the fast M&A route.

Main subcategories of M&A waves through the years:

• 2019 = Bot detection, connectivity, secure access, SOAR, WAF, container security
• 2020 = Threat intelligence, authorization, kubernetes security, ad-tech security
• 2021 = ASPM, workload, endpoint, more SecOps
• 2022 = more endpoint, web security, IOT, ASPM, mobile
• 2023 = API Security, ransomware prevention, SASE, CSPM, PAM

The same thing happens on the early-stage investment side – what we call the “Seed Wave” of investments, where major VCs make plays in a specific market category around the same time.

For example, this year we’ve seen nearly ten different teams in Israel work to establish and raise seed funding rounds for companies operating in the ‘AI for the SOC’ space. We’ve also seen a ‘next-gen DLP’ seed wave and an ‘AI Security’ seed wave, with many Israeli ‘Security for AI’ companies launching out of stealth such as Noma, Lasso, DeepKeep, Apex, Prompt, Adversa, and more.

The next question to ask would be: Is it easier/faster for startups to get acquired if they RIDE a wave or if they create a new one? We’ll explore this in a future report.

Summary

Moving forward, we believe that M&A activity in Israeli cyber will remain strong and will remain the main avenue for liquidation in this ecosystem. Here are some predictions:

• Time to Exit – Although it has been decreasing over time, it will only continue to decrease up to a certain point. Companies still need to deliver legitimate value and see growth over time in order to be acquired.
• Exit: Fundraising Multiples – Multiples have been 6-7X on average in the last six years. As threat landscapes continue to evolve and cyber remains top priority, with interested acquirers on the other side who are seeing success and have the ability to continue buying companies (enough free cash flow for acquisition activity), we predict this will likely stay steady over time.
• Acquirers – Up until now, most M&A activity has been done on behalf of American public corporates. This will continue, but we will also see more acquisitions done on behalf of Isreali private companies that are growing fast, such as Wiz and Cyera who have both acquired Israeli startups this past year.
• M&A Wave Categories – We predict the M&A wave for Unified Remediation will continue in the coming months. Other categories that can see M&A waves in the coming year include early-stage startups in Security for AI, non-human identity, and CNAPP (features, not platforms).