The report. Cyera has talked to investors about raising new money at a valuation of about $20 billion, according to The Information. The talks are early. There’s no round size, no lead investor and no closing date, and the round may not happen at all. Four months ago, on June 10, Cyera announced $600 million at a $12 billion valuation, led by Evolution Equity Partners. Goldman Sachs Alternatives later added $400 million. Total funding is now over $2 billion.
What Cyera actually sells. Cyera started in data security posture management, or DSPM. In plain words: find the sensitive files and records scattered across a company’s cloud and servers, label them, and show who can open them. Useful, but a crowded category. Then it bought its way outward. It paid about $1 billion in cash and stock for Oasis Security, which tracks non-human identities: service accounts, API keys and AI agents. It says it has completed five acquisitions in 18 months. Its pitch is no longer “we find your data.” It’s “we decide what your AI can see and do.”
The multiple. Cyera doesn’t publish revenue. Here’s what has been reported. In June, TechCrunch said Cyera had passed $150 million in annual recurring revenue, or ARR, per three people familiar. Cyera’s spokesperson called those numbers “factually and significantly inaccurate.” Calcalist later put ARR at an estimated $200 million-plus. Cyera itself only says ARR tripled three years in a row.
Take the friendlier estimate. $20 billion over $200 million is 100 times ARR. On the TechCrunch figure, it’s about 133 times. Now look at the closest public comp. On October 15, Proofpoint agreed to buy Varonis, the data security veteran, for about $6.3 billion. That’s roughly 8.4 times trailing revenue. The yardsticks differ, ARR versus trailing revenue, but the gap is not a rounding error. It’s more than ten times.
What has to be true. For $20 billion to look like a Varonis-style multiple, Cyera needs about $2.4 billion in revenue. From $200 million, tripling once gets you to $600 million. Tripling twice gets you to $1.8 billion. So investors are pricing in more than two more years of the best growth in the category, with acquisitions folded in, and no slowdown. That’s possible. It’s not a margin of safety.
Why someone will pay it anyway. The bull case is real, and it isn’t about DSPM. Every company plugging AI agents into internal data hits the same wall. An agent with too-broad access can read the board deck, the payroll file and the customer database in one afternoon. Whoever holds the map of “what data exists, how sensitive it is, and which humans and machines can reach it” becomes the permission system for AI. That’s a control point, not a feature. Control points get platform multiples. Investors aren’t paying 100x for a scanner. They’re paying for the chance that Cyera becomes the place every agent checks before it touches data.
Where I land. The thesis is right. The price is a bet that Cyera wins it outright, and fast. Three things should worry a careful buyer of this round. One, the revenue is unverified and the company disputes the outside estimates, so nobody outside the cap table can check the multiple. Two, buying five companies in 18 months blurs organic growth. Ask how much of the tripling was bought. Three, the incumbents are moving. Proofpoint is buying Varonis precisely to sell the same “who can access what” story to 14,000 enterprises. A private company raising every four months has to keep printing higher marks. A flat round at this pace reads like a down round to employees and customers.
What CISOs should do. A vendor this flush will push multi-year platform deals with DSPM, DLP, identity and agent controls bundled together. That can be a good deal. Get price caps on renewals, insist on exportable data classifications in case you switch, and ask for written roadmaps on the acquired products before you standardize on them. The permission layer is too important to buy on momentum.