Gili
Raanan

The Man Who Gatekeeps the Internet - and the Investors Who Fund It

Every time you've squinted at distorted letters or clicked on fire hydrants to prove you're not a robot, you've been interacting with Gili Raanan's work. He helped invent CAPTCHA in 1997 - a small, strange contribution to how the internet identifies humans. Then he quietly went on to become the most influential figure in the world's most dangerous software market.

Today, Raanan runs Cyberstarts from Tel Aviv. It is the only venture capital firm in the world focused exclusively on seed-stage cybersecurity. No growth rounds. No diversification into enterprise SaaS or climate tech. Just cyber, just early, just founders. That narrow bet has produced $55B+ in portfolio value across 28 companies, all three early seed funds returning more than 100% IRR - a number that would be remarkable at a large fund and is extraordinary at seed stage.

When Google completed its $32 billion acquisition of Wiz in March 2025, Cyberstarts' roughly 4% stake was worth somewhere between $1.3B and $1.6B - from an original seed check. Raanan has said publicly that if someone had suggested five years earlier that Wiz would reach $32 billion, he would have found it amusing. What's not amusing is how systematic the whole thing was.

The path here was not a straight line. It started with a decade in the Israeli Defense Forces' Unit 8200 - the intelligence unit that functions as something between the NSA and a startup incubator. He left with two military awards and a deep, working knowledge of how attacks are built and how defenses fail. That knowledge translated directly into products. His first company, Sanctum, shipped AppShield in 1997 - the world's first Web Application Firewall. His second, nLayers, mapped application infrastructure for enterprises who couldn't see their own systems clearly. Two companies, two exits, both acquired by American tech giants.

Then came nine years at Sequoia Capital Israel, where Raanan led cybersecurity investing and backed companies including Adallom (acquired by Microsoft for $320M) and Armis (acquired at $1.1B). The founders of Adallom, incidentally, went on to found Wiz - meaning Raanan's relationship with that particular group of founders spanned two separate funds and nearly a decade before the $32B exit.

He Doesn't Listen to Pitches. He Listens to Childhoods.

The most disarming thing about how Raanan invests is what he refuses to do first. When a founder sits across from him, he doesn't ask about TAM or go-to-market or competitive moats. He asks about their family. He asks about their failures. He deliberately approaches every meeting with what he calls an "unprepared mind" - no preconceptions about the market, no model of what the product should be. Just a person, trying to understand another person.

His thesis is simple to state and hard to execute: the quality of the founder determines everything at seed stage. The product will change. The market will shift. The strategy will evolve three times before the Series A. What doesn't change is whether someone is wired to keep going when it gets hard. Raanan wants to know if the founder he's meeting has ever been in genuine difficulty - and what they did about it.

He has described wanting to back founders "who didn't have a perfect start to life." Not failure for its own sake. But the specific kind of resilience that comes from having to figure things out without a clear path - the thing Unit 8200 selected for and the Israeli military system tended to produce in concentrated doses.

The result is a portfolio that looks, to outside observers, almost suspiciously cohesive. The Information ran a piece in 2022 describing how, when any VC in Israel considers a cyber startup, their first question is whether Gili Raanan has already invested. Not because Raanan is always right - he is playing a game he acknowledges produces one or two exceptional companies per year out of roughly 150 that start - but because his presence signals something about the founders that goes beyond the pitch deck.

Cyberstarts does not passively wait for that one exceptional company to appear, either. The firm built the Sunrise program - a structured advisory network of Chief Information Security Officers who provided portfolio companies with product feedback and market access. CISOs could earn up to $250,000 over a fund's life for advisory work. The program worked well enough that it attracted scrutiny: in 2024, an investigative report raised questions about disclosure practices and whether the advisory fees were being properly reported by CISO participants at their own companies. Raanan suspended payments and said the program was "not going anywhere." About a third of CISO advisors were quietly removed from the website. It was a moment that revealed both the sophistication of the Cyberstarts network and its vulnerability to conflicts of interest - a tension that sits at the center of how deeply embedded the firm has become in the industry it funds.

From Unit 8200 to the First Firewall

Raanan spent roughly ten years in Unit 8200 before founding Sanctum. That tenure earned him the Israeli Intelligence Forces Innovation Award in 1992 and the Israel Defense Presidential Prize in 1996 - the latter being among the most significant honors the Israeli defense establishment can bestow. He left with over ten patents in cybersecurity, security algorithms, and application management.

Sanctum, which he co-founded as Perfecto Technologies in 1997, produced two products that shaped the modern internet security stack. AppShield was the first Web Application Firewall - before there was a category called "WAF," before enterprises understood that web applications needed protection distinct from network perimeters. AppScan, launched in 2000, was the first automated web security vulnerability scanner. These weren't incremental improvements to existing tools. They were tools for problems the industry hadn't named yet.

When Watchfire acquired Sanctum in 2004 for roughly $40 million, and IBM subsequently acquired Watchfire in 2007, the technology Raanan helped build became part of the IBM security portfolio - later sold to HCL for $1.8 billion in 2019. nLayers, his second company, solved a different problem: enterprises couldn't see how their own applications were connected. EMC acquired nLayers for approximately $50 million in 2006, and Raanan spent time as VP of Strategy at EMC before the VC chapter began.

The CAPTCHA connection is the most counterintuitive piece. The technology Raanan helped develop - designed to distinguish human users from bots on the early web - was, philosophically, an early version of the same problem he now focuses on: knowing who or what you're dealing with before you let them in. The internet has been asking that question ever since 1997. He just happens to have been asking it from both sides of the table.

Nine Years at the Table Before Building One

The nine years Raanan spent at Sequoia Capital Israel from 2009 to 2018 were not merely apprenticeship. He led the firm's cyber investments during a period when Israeli cybersecurity was transitioning from a defense-industry niche to a global commercial category. The deals he made there included Adallom - a cloud security startup whose founders, Assaf Rappaport and Roy Reznik, would later build Wiz. When Adallom sold to Microsoft for $320 million in 2015, it was a good exit. When the same founders turned $300M into a $32B exit a decade later, the thread running through both deals was Raanan.

He also backed Armis, which pioneered security for connected devices in industrial environments - a problem that existed before anyone had a clean name for it. Armis was acquired at a $1.1 billion valuation in 2020 and has since continued growing independently at a $4.3B+ valuation. And Moovit, the transit navigation platform acquired by Intel for $900M, showed that Raanan's thesis at Sequoia wasn't limited to pure cyber plays.

What the Sequoia years gave him, beyond returns, was a precise view of what seed investing in Israel couldn't do inside a large multi-stage fund. Sequoia needed to write checks that justified the fund size. That meant later stages, larger companies, more predictable trajectories. What Raanan wanted to do was get in before any of that was true - when the only thing you could evaluate was the founders themselves.

The Unprepared Mind

Most venture capitalists spend the first meeting learning about the company. Raanan spends it learning about the person. He goes into founder meetings deliberately uninformed about the pitch - no pre-read on the deck, no competitive analysis beforehand. The theory is that preconceptions contaminate judgment. If you've already decided what the market looks like, you'll hear what confirms that picture.

The questions he asks instead: Where did you grow up? What was hard? What did you fail at? When it got difficult the last time, what did you do? These are not typical VC questions. They are, loosely, the questions someone with a decade in military intelligence learns to ask when they need to know if a person will hold up under pressure.

His public comments reveal a consistent belief that venture capital produces very few genuinely exceptional outcomes. Out of roughly 150 new cyber startups started in Israel each year, he's said, maybe one or two achieve what he calls real greatness. This is not pessimism. It is a description of a game where you need to be extremely right on the rare occasion when it matters, and where being wrong on most attempts is the baseline condition. The unprepared mind is his answer to the question of how you stay open to recognizing the one or two who are genuinely different.

After the Wiz deal closed, Raanan said publicly that the $32 billion exit would transform how young Israeli founders think about what's possible. "Young founders no longer dream of selling a company for $300 million to Microsoft," he said. "That is no longer the big dream." He meant it as an observation about ambition, but it also described something about his own trajectory - from a $40M exit in 2004 to managing over a billion dollars in committed capital two decades later, with the largest acquisition in cybersecurity history in the portfolio.