The Cyber-Only Fund That Bets on the People Who Built the Industry

Most venture firms hedge. They spread capital across a dozen sectors so that a bad year in one is covered by a good year in another. Ballistic Ventures does the opposite. It picks a single field - cybersecurity - and puts every dollar there, run by partners who spent their careers inside the industry rather than watching it from a spreadsheet.

The firm was formed in 2021 and went public with its plans in the spring of 2022, announcing a debut fund of roughly $300 million. The pitch was unusually plain for venture capital: we only do security, and we have done it for three decades. In an industry where "generalist with a security practice" is common, a fund where every partner is a full-time cyber operator was the differentiator.

That difference starts with the people. The founding group reads like a roster pulled from the field's history. Roger Thornton, a co-founder and general partner, built Fortify Software - later acquired by HP - and served as chief technology officer at AlienVault before it went to AT&T. Ted Schlein spent 25 years as a partner at Kleiner Perkins and more than three decades in security. Kevin Mandia founded Mandiant, the incident-response company that became a household name inside every breached boardroom. Barmak Meftah and Jake Seid round out the general partners. Between them, the group has founded, funded, or operated close to a hundred security companies.

01 / THE THESISOne market, and it keeps getting bigger

The case for going all-in on one sector rests on the size and permanence of the problem. Ballistic points to a cybersecurity market that McKinsey has estimated at $1.5 to $2 trillion in potential value - a figure that reflects not what companies spend today, but what the threat surface demands. Ransomware, identity sprawl, cloud misconfiguration, and now the security implications of artificial intelligence keep widening the gap between what organizations spend and what they need.

The firm frames this less as an opportunity and more as an obligation. Its own language describes a sense of responsibility to defend society's digital infrastructure. That tone matters, because it shapes the kind of founders Ballistic attracts: people building for enterprises and, increasingly, for the shared systems everyone depends on.

02 / WHAT IT FUNDSThe map of the modern threat surface

Ballistic invests early - at the seed and Series A stages - and its portfolio functions as a map of where security is heading. The bets cluster around a handful of fronts: securing AI systems as they move from development into production, managing machine and human identity, detecting manipulated media, and automating the work of overstretched security teams.

The names in the portfolio give the categories shape. GetReal Labs works on real-time detection of deepfakes and manipulated media. Oligo Security focuses on catching attacks at runtime. Aembit handles secretless access for workloads and AI. Noma and WitnessAI address the security of enterprise AI from development through to daily use. Reach Security builds what it calls an operating system for the security controls a company already owns. Across the active portfolio - roughly two to three dozen companies - the throughline is defense against threats that did not exist, or did not matter, a few years ago.

Dark tiles mark realized exits. Selected companies shown.

03 / THE MODELNot a check, a co-pilot

Where Ballistic separates itself from a generalist fund is in what happens after the wire clears. The partners take board seats, help with recruiting, and - the part founders tend to remember - help land the first ten customers. For an early security company, that last item is the difference between a product and a business, because the buyers are wary chief information security officers who trust reputations more than pitch decks.

As a business, the structure is conventional for venture: Ballistic raises money from limited partners, invests it, and earns management fees plus a share of the returns. What is unconventional is the discipline of the mandate. A generalist fund can chase whatever is hot; Ballistic has to find its returns inside one field. That constraint is also the sales pitch to founders, who get investors that speak their language and know their buyers.

Behind the general partners sits a wider bench built for that hands-on model. The firm keeps CISOs-in-residence, venture partners, and a roster of strategic advisors drawn from industry and government. Nicole Perlroth, the former cybersecurity journalist, is among the venture partners; the advisory group includes former public-sector security leaders. For a portfolio company trying to reach a cautious enterprise buyer, an introduction from someone who has held the CISO title carries weight a cold email never will.

The customers, in the end, are two audiences at once. The obvious one is the early-stage founder choosing where to raise. The less visible one is the set of limited partners who fund Ballistic's vehicles and are, in effect, buying concentrated exposure to a single sector they believe will keep growing. The firm's job is to serve both - to be useful enough to founders that the best ones pick it, and disciplined enough with capital that its backers keep returning.

04 / THE RECORDThree funds, two notable exits

The fundraising cadence has been steady. The debut fund of about $300 million in 2022 was followed by an oversubscribed $360 million second fund that closed in early 2024. In April 2025, the firm filed to raise a new fund targeting $100 million - roughly a year after Fund II. Three vehicles in a few years is a signal about how much capital the founders believe the market can absorb.

The results include two exits that drew attention. Talon Cyber Security, an enterprise browser company, was acquired by Palo Alto Networks in a deal described as the largest venture-backed acquisition of 2023. Pangea, which builds security guardrails for AI applications, was acquired by CrowdStrike. In 2023, SC Media named Ballistic its Investor of the Year - recognition from inside the industry the firm serves.

05 / THE FIELDWhere it sits in the market

Ballistic is not alone in the specialist lane. Firms such as Ten Eleven Ventures, ForgePoint Capital, YL Ventures, and Cyberstarts also concentrate on cybersecurity, and each leans on CISO networks and security-specific go-to-market help to stand apart from generalist money. What distinguishes Ballistic within that group is the operator density of its partnership and its willingness to incubate companies rather than only fund them.

For a founder deciding where to raise, the calculus is straightforward. A generalist offers reach across industries and, sometimes, a larger balance sheet. A specialist like Ballistic offers investors who have shipped a security product, sat across from a skeptical buyer, and know which doors open. For companies whose entire value depends on being trusted by security teams, that second kind of help is hard to price and harder to replace.

The bet underneath all of it is simple to state and hard to execute: that focus beats breadth in a market this large and this fast-moving. Ballistic has spent five years and about $660 million arguing the point. The portfolio - and the buyers who keep acquiring pieces of it - will settle whether the argument holds.