$490 Million and Zero Sold: Ballistic's AI-Security Fund Is a Bet on Exit Math, Not a New Category

Ballistic's own materials contradict the idea that a $490 million raise turns it into a generalist fund. The firm describes itself as \"a VC firm dedicated to funding and incubating innovations in cybersecurity and nothing else,\" and argues that founders \"need more money from an industry that has become too complex for general investors who simply dabble in it.\" What the November 2 filings describe is a specialist that moves up the cheque size instead of sideways across sectors.

The third flagship is sized at exactly what the second fund raised in 2024, and the $360 million target was reported publicly as early as April 2025. Nineteen months later both notices still show $0 sold and no first sale, even though U.S. cyber venture funding hit $11.5 billion in 2025. A specialist that cannot move its flagship past $360 million is short of allocator conviction, not short of opportunity.

The same six principals — Kevin Mandia, Barmak Meftah, Theodore Schlein, Jacob Seid, Roger Thornton and Philip Venables — sign both Form D notices, which points to continuity of strategy rather than a new shop. In July 2026 Ballistic added Punit Minocha, Zscaler's former executive vice president of business and corporate development, as a strategic adviser. That is a small signal with a large read-through: the fund is hiring from the platforms its portfolio companies must eventually sell to.

The most important fact about the AI-security private market is that it is not priced ahead of the public one. Island's September 2026 Series F valued the company at $6.4 billion on roughly $200 million of revenue, about 32x sales. CrowdStrike trades at 45.7x trailing sales and Palo Alto Networks at 25.0x. The private mark sits between them — priced inside a narrow band set by two names, not above the public market.

The arithmetic matters more than the narrative. For a $1 billion private mark to clear at Palo Alto's 25x, the asset needs roughly $40 million of revenue; at CrowdStrike's 45.7x it needs about $22 million. A mark written at 32x needs a buyer that clears at 32x, and only two or three listed names do. The whole venture bid therefore depends on the number of public AI-security comparables growing from two to twenty.

Two things are happening at once. U.S. cyber venture deal count through May 2026 was 203, still far below the 618 peak of 2021, so the category is not being funded by a broad proliferation of new firms. It is being funded by larger cheques into fewer, AI-native assets, with AI accounting for 82.7% of U.S. venture deal value through September 2026. Ballistic's $490 million is a bid for a slice of that concentrated flow, not a bet that security startups multiply.

Ballistic's two largest exits show the pattern. Palo Alto Networks bought Talon Cyber Security for $625 million in November 2023 — by PitchBook's count, then the largest venture-backed cybersecurity startup acquisition of the year — and CrowdStrike bought Pangea for about $260 million in September 2025, adding the AI Detection and Response layer that now sits inside the Falcon platform. Both buyers paid for a capability they could have built, and both are listed names whose multiples the private marks must eventually justify.

The window is open but narrow. Total cybersecurity M&A hit a record 404 deals and $97 billion of value in 2025 and is tracking to 450 deals in 2026, with 117 announced in the third quarter alone. AI-security deals alone went from 10 in all of 2025 to 40 in the first nine months of 2026. Forty deals cannot absorb an $11.5 billion annual funding market at venture marks, so either the buyers' ranks expand or the marks come down.

The chain has three layers and three different paydays. Upstream sits with the platforms that create the agent problem. Midstream is the venture cohort a specialist fund like Ballistic underwrites. Downstream is the security majors and enterprises that buy both — and, increasingly, the only buyers large enough to matter.

The midstream layer is what Ballistic is actually underwriting: Aikido Security at a $1 billion valuation after a $60 million Series B in January 2026, Island at $6.4 billion in September 2026, and Oligo Security raising $60 million in August 2026 to pass $140 million of total funding on 300% year-over-year revenue growth. Every one of those marks is a claim on the downstream budget — and the downstream budget is now largely owned by two or three listed acquirers.

Near term, nothing in the filings changes a listed security business. What changes is the distribution of risk. If AI-security is a budget line the two highest-multiple names can harvest, CrowdStrike and Palo Alto Networks absorb it and the fund earns fees on assets it helped create. If it turns out to be a feature that platform vendors bundle — and Anthropic's Mythos model, shipped with defensive cybersecurity capability, points that way — the venture marks have no home and the listed laggards have no bid.

The long-run consequence is either a new asset class or a feature. If AI-agent governance becomes a category with its own listed comparables — the way endpoint, network and identity each became one — then a flat $360 million flagship buys an early, cheap entry into a category whose listed winners will be worth many multiples of it. If it stays a feature inside endpoint, cloud and identity bundles, the fund has bought into a margin pool its buyers can reprice at will. Whether that budget becomes a category or a feature decides the return on Fund III more than any market call.

Fact: Ballistic has filed to raise $490 million across two vehicles with nothing sold; the AI-enabled share of U.S. cyber venture deals has reached 72%; AI-security M&A has gone from 10 deals in 2025 to 40 in nine months of 2026; and the listed security ladder runs from 45.7x sales at CrowdStrike to 7.0x at SentinelOne. Inference: the private mark is a claim on the downstream budget of two or three listed acquirers, which is why a specialist that calls itself too specialized for generalist capital has gone back to market for a second parallel vehicle. Speculation: whether that budget becomes a category or a feature decides the return on Fund III more than any forecast of spending.