What’s next for cybersecurity, according to Index Ventures’ Shardul Shah

The cybersecurity market is currently experiencing a massive shift in gravity. If you look at the recent activity around companies like Instinct and Simile, the numbers are loud. We are seeing nine-figure checks and valuations that look like they were plucked from the peak of the 2021 bull market. But unlike that era of cheap money and speculation, this capital is chasing a very specific, very tangible threat: the autonomous AI agent.

The End of the Perimeter

For decades, security was about building walls. You protected the network, the device, and the user identity. If you kept the bad guys out of the perimeter, you won. But builders in the AI space know that the perimeter is officially dead. In a world where we are deploying LLMs and autonomous agents to handle internal workflows, the threat isn't just someone breaking in from the outside. The threat is the code we wrote ourselves, behaving in ways we didn't predict.

Index Ventures partner Shardul Shah has been vocal about this transition. The focus is moving away from basic data protection and toward the governance of behavior. When you give an AI agent the ability to execute API calls, move funds, or modify production code, you aren't just dealing with a software tool anymore. You are dealing with a digital employee that doesn't sleep and can make a thousand mistakes per second.

Why the Valuations Make Sense

It is easy to look at a massive seed or Series A round and call it a bubble. I have been skeptical of plenty of hyped-up sectors, but the security layer for AI is different. The reason investors are comfortable with these high entry prices is that the cost of failure has scaled exponentially. A data breach used to mean a leaked database and a PR nightmare. Today, a compromised agent could systematically dismantle a company's cloud infrastructure before an admin even gets a notification.

Builders need to understand that this isn't just about "AI safety" in the philosophical sense. It is about operational integrity. The startups getting these massive checks are building the guardrails that make enterprise AI possible. Without them, most large corporations will keep their most powerful AI tools stuck in the sandbox indefinitely.

The Rise of Rogue Agents

We often talk about "rogue agents" as if they are malicious actors from a spy movie. In reality, a rogue agent is usually just a poorly prompted one. It is an agent that takes a command too literally or finds a logical loophole to achieve a goal in a destructive way. This is the new front line for cybersecurity.

Existing security tools are ill-equipped for this. A traditional firewall doesn't care if an LLM is hallucinating a password or accidentally sharing sensitive IP with a third-party API. The new generation of security companies is building "runtime" protection for intelligence. They are looking at the intent behind the action, not just the packet of data being sent.

• Identity for Machines: How do we verify that an agent is who it says it is?
• Prompt Injection Defense: Preventing external users from hijacking your agent's logic.
• Output Filtering: Ensuring the AI doesn't leak secrets in its responses.

The Founder's Perspective

If you are building in the crypto or AI space right now, you have to realize that security can no longer be an afterthought or a plugin you add right before launch. It has to be the foundation. The market is signaling that it values the "brakes" just as much as the "engine."

I talk to a lot of founders who are obsessed with performance and latency. That's great, but if your agent is fast and powerful but lacks a governance layer, you are building a liability, not a product. The massive funding flowing into the sector is a warning to every builder: the industry is getting serious about the risks, and your customers will too.

The goal isn't just to build an AI that works; it's to build an AI that can be trusted to work when you aren't watching it.

What This Means for the Future

As cybersecurity stocks rise and venture capital concentrates on these AI-native security firms, we are going to see a consolidation of the stack. We are moving toward a future where the AI model and the security layer are inseparable. You won't buy an LLM license without an accompanying governance suite.

For those of us in the crypto space, this feels familiar. We have spent years dealing with smart contract audits and the reality that code is law. AI is hitting that same wall. When you automate decision-making, the security of the logic is the only thing that matters. The high valuations for companies like Instinct are a bet that these teams will become the new gatekeepers of the enterprise.

The Takeaway

Don't be distracted by the nine-figure headlines. The real story is the fundamental change in how we define a "threat." We are moving from a world of protecting static assets to a world of monitoring dynamic, autonomous behaviors. If you are building in this space, your success won't be measured by how smart your AI is, but by how well you can control it. High-value security is the prerequisite for high-value AI.

Read the original at TechCrunch Venture →