David Phelps and the long way to an open door

David Phelps’s connection to Israel began with arrivals by sea. Serving in the U.S. Navy in the 1980s, he visited Haifa several times. The visits gave him relationships and a lasting confidence in the country. Years later, when his cybersecurity business needed to invest in young companies, those earlier encounters supplied a personal reason to look there.

There is something pleasingly unhurried about that sequence. A port call becomes a relationship; a relationship becomes part of an investment decision decades later. In an industry fond of announcing that everything has changed since Tuesday, Phelps offers a longer interval between introduction and opportunity.

He is the founder, chairman and CEO of Merlin Group, whose affiliates combine cybersecurity investing, cloud-compliance support and access to government customers. His career connects the technical business of making systems work with the commercial business of getting them bought. The distance between those two accomplishments has become his territory.

Before the checkbook, the ground systems

Phelps arrived at entrepreneurship with a substantial working life already behind him. His pre-Merlin career spanned 25 years and included the Navy and positions with Ford Aerospace, Martin Marietta, Loral Aerospace and The Aerospace Corporation. His technical background covered satellite command and control, ground systems design and development, and high-performance computing.

That is a particular preparation for selling technology. Satellite command and control involves a whole system, including the equipment and processes on the ground. It offers a useful lens for reading his later business: the exciting object and the machinery supporting it belong in the same conversation. A product can be impressive while the arrangements needed to use it remain unfinished.

Merlin was founded in 1997. The business adapted commercial technology for federal customers, working in areas including enterprise architecture, information management and systems modernization. By 2006, its major federal clients included the Defense Department, the Department of Homeland Security and the National Oceanic and Atmospheric Administration. These were buyers with missions, requirements and existing systems to accommodate.

The numbers arrived before the new name

Between fiscal 2000 and fiscal 2004, Merlin’s government revenue rose from $193,900 to $88.25 million. The company placed first on Washington Technology’s Fast 50 in both 2005 and 2006. For Phelps, the commercial-to-federal approach had produced a measurable business well before cybersecurity venture investing became part of its public identity.

In July 2006, Merlin Technical Solutions became Merlin International. Phelps described an ambition to pursue public-sector opportunities in Europe and Asia-Pacific while responding to commercial interest. A name change is inexpensive compared with an international expansion, of course. Here it made the intended direction explicit: a company formed around federal technology wanted a wider address book.

The following January, Merlin reorganized its government business into Enterprise Solutions, Special Programs and Technology Systems. Consulting and systems integration had a division; national-security and defense work had another. Technology Systems would help vendors reach government buyers. Phelps was already organizing around different jobs in the journey from technology to customer, a habit that would reappear in the group’s later structure.

A business built around the second meeting

Today, Phelps’s responsibilities include setting Merlin’s direction, shaping its culture and leading the senior executive team. The group’s three affiliates make his commercial argument visible. Merlin Ventures invests. Constellation GovCloud, also called CGC, helps technology companies navigate government-cloud requirements. Merlin Cyber brings technology to public-sector and enterprise customers.

Each answers a different question a founder eventually faces. Who will fund development? How will the product meet the buyer’s requirements? Who will help the company reach that buyer? The diagram is tidy; the underlying work includes engineering, documentation, testing, introductions and sales. Somewhere after the enthusiastic first meeting, somebody has to do the second meeting’s homework.

Merlin’s wider offering includes physical and digital labs, technical specialists, business development and a community of security executives. Those are company capabilities rather than a catalogue of Phelps’s personal accomplishments. They do, however, show what he has chosen to put around the investment activity. The model places money beside people who can test a product, question it and help find a customer.

The structure also gives a different meaning to the word support. An investment can be followed by a technical review, a compliance discussion or a customer introduction. Those encounters involve different people and different measures of progress. Putting them within a connected group expresses a judgment about where a technology company needs help, and about how much of the job remains after it has raised money.

For a profile of a technology investor, this is a useful change of camera angle. The interesting action can happen after the funding announcement, when an organization tries to turn a promising tool into something another organization can actually deploy.

The cloud has paperwork

In April 2021, Merlin launched Constellation GovCloud as a managed service intended to reduce the time, cost and complexity of pursuing FedRAMP authorization. The offering combined a cloud platform with advisory support, documentation, compliance oversight and continuous monitoring. Phelps’s response to a difficult purchasing environment was to make some of the preparation a service.

The practical emphasis matters. A young software company can find itself responsible for policies, operational controls and ongoing compliance work alongside its product development. Constellation’s launch addressed those tasks directly. The less photogenic parts of a technology business had acquired their own product proposition. The cloud, it turns out, comes with a filing cabinet.

By December 2023, Constellation GovCloud had announced a provisional authorization from FedRAMP’s Joint Authorization Board. Phelps described the platform in terms of reducing investment risk and accelerating revenue. That language connects compliance to the founder’s operating problem: spending resources to enter a market before knowing whether sales will follow.

His public argument in 2024 extended that concern. He urged investors to advise portfolio companies early on decisions that affect government-market eligibility, and called for closer cooperation among government, vendors and private-sector partners. He treated adoption as work requiring its own attention. Approval opens an opportunity; a company still needs positioning, people and a sales effort afterward. His preferred business sits across those consecutive demands.

Haifa, revisited with a different purpose

When Phelps and Merlin Ventures managing partner Shay Michel discussed their U.S.-Israel business in 2022, Phelps returned to those Navy visits as part of the explanation. Familiarity with the country had preceded the investment thesis. He also emphasized the management teams behind the technology. His account makes relationships part of the business’s substance, alongside the software.

That emphasis has a concrete setting: an American company helping Israeli cybersecurity businesses approach U.S. customers. It asks people on either side to understand the other’s constraints. A founder needs access to a buyer; the buyer needs grounds for confidence. Phelps’s career gives him experience of the federal environment, while Michel and the investment team work within the Israeli technology community.

The personal thread is modest and specific. The Haifa visits did not come with a venture fund attached. They became useful later. Phelps’s story leaves room for a form of preparation that is difficult to schedule: getting to know people before there is an immediate transaction to discuss.

“It’s the people together behind the technology that make the difference.”David Phelps · 2022

More than $75 million, and people to put beside it

On June 4, 2025, Merlin Ventures announced the closing of a dedicated inaugural fund above its $75 million target. Phelps would manage it alongside Seth Spergel and Shay Michel. The fund focused on seed-stage cybersecurity companies, with a strong emphasis on Israel, and paired its investing with U.S. market access and co-investment relationships.

The announcement also described six exits from earlier investment vehicles, including Talon and Dig Security, acquired by Palo Alto Networks, and InfoSec Global and Veriti, acquired by Keyfactor and Check Point respectively. Those outcomes belong to the firm and its teams. Their relevance to Phelps’s story is the accumulated business behind the new fund, rather than an overnight arrival in venture capital.

The people around the fund included cybersecurity founders and mentalist Lior Suchard. That last profession is a welcome interruption in a procession of security titles. Even in a business built around checking assumptions, there seems to be room at the table for someone whose profession involves surprising the audience.

Hiring people who know the other side of the desk

Phelps continued adding government experience to Merlin’s leadership. In October 2025, former Cybersecurity and Infrastructure Security Agency executive Matt Hartman joined as chief strategy officer. Phelps wrote about the appointment himself, connecting Hartman’s understanding of government missions with the group’s work for emerging vendors, established providers, investors and end users.

In March 2026, former CISA chief information officer Bob Costello joined as chief digital and information officer. His remit included digital strategy, technology architecture and enterprise AI, as well as work with affiliates and portfolio companies. Phelps emphasized Costello’s ability to translate complicated mission requirements into practical capabilities. The appointment put another experienced government technology operator inside the organization.

These choices suggest how Phelps expects his business to earn its place. The organization needs people who understand the customer’s systems and responsibilities, as well as people who understand a startup’s product. Connections may make an introduction possible; experience helps make the conversation useful.

The line from Haifa to Merlin’s present work is a long one, with aerospace jobs, federal customers, reorganizations and an investment operation along the way. Phelps’s recurring subject is what happens between a technical possibility and a working relationship. A door opens. There is still a considerable amount of work on the other side.