-
UK: +44 203 8876 770
US: 315 508 6500 - cybersecurity@thisisiceberg.com
-
8 Devonshire Square, London, EC2M 4YJ
October has been busy. We have seen nine-figure funding rounds, a run of CRO appointments and a couple of reminders that "acquired" can mean very different things for the people inside a business.
One conversation that stood out this month was with a senior cyber salesperson weighing a move to an AI security vendor. The funding was impressive and the technology had caught his attention, but his biggest question wasn't about the product. It was who was actually buying it, and whether there was an established budget behind the number he would be carrying.
My take is that most of the new money is going into categories that did not exist two years ago, and a lot of hiring plans have not caught up with that yet.
How do you hire five years' experience in a category that is eighteen months old?
You cannot. So the real question is what you hire for instead.
1. The money has followed AI agents. The sales playbook has not.
Kevin Mandia's Armadin raised a $255.5 million Series B at a valuation above $2.5 billion, taking its total funding to around $445 million just seven months after its public launch.[1]
On 14 October Harmonic Security raised a $50 million Series B and said the money would go into growing its engineering and go-to-market teams in the US and the UK.[2]
Hadrian raised $40 million for autonomous offensive security, and Rein Security raised $25 million to protect AI agents at runtime.[3]
Opsin, which governs enterprise AI agents, added $21 million.[4]
All of that came after Island and Cyera each raised $400 million in late September, with Cyera explicitly positioning its data security around both humans and AI agents.[5]
Most of these companies are not selling into an existing budget line. In many accounts the buyer is still working out who owns the problem. It could be the CISO, the CIO, a new head of AI, or legal. A seller who has only ever displaced an incumbent in a well-understood category is going to find that hard. Here the first job is to create the budget, not to win it.
So I would look for people who have done that before, even with a different product. Someone who sold cloud security when CISOs were still asking whether they needed it. Someone who sold data security before analysts had an acronym for it.
That is where a lot of client briefs are ending up too. Conversations often start with a request for direct AI security experience. Once we talk through what the salesperson will actually need to achieve, the brief usually shifts towards a proven hunter who has taken a new technology to market: someone comfortable educating buyers, creating opportunities from scratch and talking to decision makers who may not yet realise they need the product.
2. The CRO seat is moving.
Five revenue leadership moves have been announced or taken effect since late September:
Two of those five were internal promotions, which usually means the board wants continuity. Neo is the one I would watch. When a big-platform revenue leader chooses an early-stage AI security company, people from their old teams tend to take the call.
A new CRO almost always means a new sales organisation within a year. Territories get redrawn, comp plans get rewritten, and some of the team is replaced by people the CRO has worked with before. That is not a criticism. It is what they are hired to do.
I see this regularly with senior salespeople. A CRO moves into a new business and it isn't long before they are calling people they have worked well with before. I spoke to a candidate recently who had been approached by a former sales leader about joining them at a new vendor. The trust was already there, but what interested me was how much of the pitch rested on what the business could offer today versus what the new CRO planned to build over the next twelve months.
If you are interviewing somewhere with a new CRO, ask one question early. Was this role approved before they arrived, or is it part of their plan? Those are two different jobs.
3. "Acquired" is not one thing.
CrowdStrike bought XM Cyber's technology but not its employees or customer base. Calcalist reports that only around 50 of roughly 300 Israeli staff remain.[11] A Companies House filing showed that Snyk's June cuts affected about 203 people, around 20% of its workforce and more than double what was first reported.[12]
The same filing showed that technology Snyk acquired from Helios and Enso had been written down to zero.[13]
The other kind of deal looks very different. IonQ agreed to buy Elisity in an all-stock deal worth up to $1.3 billion, with Elisity's CEO staying on to run the business.[14]
Cohere also announced plans to acquire AISLE, which builds autonomous systems that find and fix software vulnerabilities.[15]
Buyers are paying for code in some deals and for teams in others. The people inside often only find out which one they were at the end.
For a salesperson that matters. If the acquirer wanted the technology, your pipeline was not part of the value. And if you were hired to sell a product that came in through an acquisition, that product's roadmap is your career.
One number that matters
268%
That is the rise in US postings for AI Security Engineers from January to September 2026 compared with the same period last year, according to CyberSN. Over the same period, total cyber postings fell 26.4% to a four-year low.[16]
It comes from a small base of 2,409 postings,[17] and these are adverts, not hires. Even so, it tells you buyers are building teams to own this problem. Those are the people your sales engineers will be sitting across from.
If your buyer does not have a budget line yet, a great competitive closer may not be the right first hire.
That last point matters. Senior sellers will find out anyway, and they would rather hear it from you.
Plenty of well-funded AI security companies will be building GTM teams over the next year, some of them here in the UK. That is a real opportunity, but go in with your eyes open.
Ask who signs the cheque and whether that budget existed last year. Ask whether your role is part of the current CRO's plan. Ask whether the company has acquired products, and what happened to the teams that came with them.
Last month I asked whether you could genuinely see yourself hitting the number. This month I would add a second question.
Will this company still be selling this product in two years?
Good AEs can learn a new category. Far fewer SEs can stand in front of a team hired specifically to own AI risk and answer every question it has.
I think the companies that hire SEs ahead of AEs will ramp faster. The rest will find their pipeline stalls at the first technical meeting.
I would be interested to hear how your own buyers are talking about AI security. Who is signing off, and where is the budget coming from? Please do get in touch, or book a time with me here: Click Here.
Best,
George
News checked to 27 October 2026. Funding and company details reflect the organisations' announcements and the reporting cited. Hiring views are George's commentary.
