Bessemer Venture Partners and Newcomer released the first AI 100 on Nov. 12 at the Cerebral Valley AI Summit in San Francisco. It replaces Bessemer’s Cloud 100. By Bessemer’s count, the 100 private companies are worth $3.6 trillion. Anthropic is No. 1, then OpenAI and Databricks.
Security is barely there. Bessemer says so in its own write-up: “cybersecurity (3), biotech (3), and robotics (13) are the biggest AI opportunities ahead. Both cybersecurity and biotechnology only have three companies represented, and together represent <3% of the list’s value.”
Bessemer doesn’t name the three. The list does. Only three of the 100 company cards describe themselves as security businesses:
| Rank | Company | How the list describes it | List valuation | List funding |
|---|---|---|---|---|
| 50 | Cyera | “AI Security Platform” | $12.00B | $2.70B |
| 56 | Abnormal AI | “Stops cybercrime with behavioral AI” | $5.10B | $546M |
| 90 | Upwind | “Cloud & AI Security Platform” | $3.80B | $830M |
Source: ai100.newcomer.co. The figures come from company data and PitchBook and were checked by Bessemer. None of these three carries the list’s “not validated by company” asterisk.
Add those up and you get $20.9 billion, or about 0.58% of the list. That’s our arithmetic, not Bessemer’s. Most of the security industry’s best-known private names aren’t here. Newcomer lists Tanium, a Cloud 100 name, among the companies that are “gone.”
So why did these three make it? Each one sells a way to control what AI systems can see, say or run, and each sits on a data path that AI is making busier.
Cyera (#50): the map of what AI is allowed to read
What it sells. Data security posture management (DSPM), DLP, privacy and, since September, identity. Cyera pitches all of it as one “trust layer” for enterprise AI. When it raised $600 million at $12 billion in June, the company framed the problem this way: enterprises “cannot tell the difference between human activity and AI agent activity inside their own systems.”
What’s technically different. Two things. First, Cyera discovers and classifies data without installing agents, and it says it does this across “hundreds of petabytes” with an “AI-native classifier that adapts to your environment and classifies data automatically, with zero tuning.” That’s a company claim, but it is the claim buyers test in a proof of concept, because tuning classification rules is where older DLP projects stall. Second, Cyera now holds data and identity in one graph. It closed its acquisition of Oasis, a non-human identity company, on Sept. 3 and turned it into Cyera Identity. On Nov. 9 it launched Cy Agents, which use that context to rank exposure and triage DLP alerts. People approve the consequential actions.
The money, as labeled. The list uses $12 billion, the June mark. Cyera says total funding is over $2 billion and that ARR has tripled “three years in a row.” It added a $400 million Goldman Sachs extension in September, still “valued over $12B.” Ctech reported on Nov. 9 that an ~$800 million round at ~$20 billion is in advanced stages. Cyera hasn’t confirmed it. If that round closes, Cyera alone would be worth more than twice Abnormal and Upwind combined.
Abnormal AI (#56): a behavior model sitting on the inbox API
What it sells. Email security for Microsoft 365 and Google Workspace that detects business email compromise, account takeover and vendor fraud from behavior rather than from signatures. In September it added an AI Security Suite aimed at “the AI their employees use” and “AI-driven attacks.”
What’s technically different. Abnormal doesn’t sit in the mail flow. It connects by API, so there is “no MX record or mail flow changes.” That also lets it see internal messages that a gateway never touches. It baselines every employee, vendor and connected app from sign-ins, communication history, and the tone and cadence of messages. An ensemble of models then makes the call. The design choice matters more as generative AI cleans up the language in phishing: if the text reads perfectly, the remaining signal is that the request doesn’t fit the relationship.
The money, as labeled. The list’s $5.1 billion valuation and $546 million in funding match Abnormal’s August 2024 Series D release: $250 million led by Wellington Management, “surpassed $200M in ARR,” 2,400+ customers and 17% of the Fortune 500. That mark is 27 months old. Abnormal hasn’t announced a newer one. One footnote for anyone reading the list in order: No. 1 is suing No. 56. Anthropic filed a trademark complaint over Abnormal’s 2025 logo in the Northern District of California (3:26-cv-06754). Abnormal disputes it, and the case is pending.
Upwind (#90): runtime security done in the kernel
What it sells. A cloud-native application protection platform (CNAPP) built from runtime outward. Upwind covers workloads, APIs and, since its September purchase of Aegis and launch of Upwind AI Security Labs, AI agents.
What’s technically different. Most cloud security platforms began as agentless posture scanners and bolted on runtime later. Upwind started at runtime. Its docs say the sensor “applies policy and filtering directly with eBPF in the kernel... instead of sending events to a user space agent,” which avoids the context-switch cost on high-frequency send, read and write events. It can stop a compromised container or block a malicious process. An open-source Kubernetes Operator deploys the sensor as a DaemonSet. Upwind says that if the sensor fails, “there would be no impact on the containers or the host kernel.” That sentence is the first thing a platform team asks about.
The money, as labeled. A $400 million Series C at $3.8 billion, closed Oct. 28, up from $1.5 billion nine months earlier, with more than $800 million raised in total (SecurityWeek). Bessemer led that round. Bessemer is also the firm that built this list. Bessemer says its method is 35% market leadership, 30% valuation, 20% operating metrics and 15% people and culture, and Upwind’s list figures match its public release. Readers should still know about the overlap.
Adjacent, not counted: Cribl (#66) and Factory (#73)
These two make security teams’ work possible. Neither is a security vendor on the list’s own terms.
Cribl describes itself as an “AI Platform for Telemetry.” Its Stream product collects, reduces, enriches and routes logs “from any source to any tool,” which is why so many SOCs use it to control SIEM ingest costs. It has also spent 2026 buying its way toward security: CardinalOps for detection engineering in July, Radiant Security’s AI SOC technology in August, Tero this week. With CardinalOps, it said it was building “a complete, open alternative to the SIEM stack.” List figures: $3.5 billion and $600 million, matching its 2024 Series E. In our view, of the 97 non-security names, Cribl is the one most likely to be counted as security on next year’s list.
Factory sells AI agents (“Droids”) for software engineering. It made the list on coding, and Newcomer groups it with Cognition, Lovable and Replit. But this week it moved into vulnerability remediation. Security Factory, in private preview since Nov. 10, takes scanner findings, works out whether they are reachable and exploitable, and reproduces them in isolated environments before writing a fix. On Nov. 12 Factory launched a Cyber Defense Network. Founding partners Snyk, Palo Alto Networks, Semgrep, Cogent, Casco, DepthFirst and Detail send findings in, and Factory’s agents send back “merge-ready fixes.” List figures: $5.0 billion and $400 million.
Who we left out, and why
- Defense and autonomy: Anduril (#7), Helsing (#30), Shield AI (#35), Saronic (#41), Skydio (#54). This is national-security hardware, not enterprise cyber.
- Safe Superintelligence (#37): its card says it builds for “the secure development of superhuman intelligence.” That’s AI safety, not a security product.
- TypeSafe AI (#52): a model company. The “safe” refers to typed decision models.
- Serval (#96): AI service management. It has real just-in-time access and access-review features, but its core is the IT help desk.
- DensityAI (#74), Prometheus (#33), Instinct (#40): compute, a physical-engineering lab and a consumer assistant.
Why practitioners should read the other 97, too
Several companies on the list run your AI supply chain. This week showed what that means. Fireworks (#9) updated its breach notice on Nov. 9: attackers reached billing data and, for some accounts, datasets and incomplete model weights. Notion (#27) said some customers’ Notion AI chat transcripts were exposed through Fireworks and disconnected from it. Two of the top 30 private AI companies were in one incident report. Neither is a security company. Both are now security problems for their customers.
The takeaway
For analysts: AI money still prices security as a small slice of the market, under 1% of this list’s value. The three companies it did count have one thing in common, and it isn’t “AI-powered detection.” Each one controls something an AI system depends on: the data it reads (Cyera), the human trust it exploits (Abnormal), and the runtime it executes in (Upwind). Two of the three valuations are recent marks. One, Abnormal’s, is from 2024.
For practitioners: the useful question isn’t which vendor has the most AI. It’s which control point your AI rollout can’t work without, and whether you own it yet.