Cybersecurity · Industry brief

Island and Cyera each raised $400 million in cybersecurity funding this week, leading the sector's major rounds. Island, a Dallas-based developer of secure enterprise digital operations tools, closed a Series F round led by Evolution Equity Partners at a $6.4 billion valuation, more than double its 2024 valuation. Cyera, a New York-based enterprise data security provider, secured a Series G extension round also led by Evolution Equity Partners and backed by Goldman Sachs Growth Equity, bringing its total funding to $2.7 billion. Both deals were announced during the week of September 19-25, 2026, per Crunchbase data.

Epiq acquired Canopy, a data breach response technology company, on September 25. The acquisition combines Canopy's patented platform—which assesses exposed data, detects sensitive information, and identifies impacted individuals using agentic AI for automated review—with Epiq's global scale and cyber expertise. The Canopy platform will be integrated into Epiq AI and made accessible through the Epiq Service Cloud to help organizations manage cyber incidents more efficiently and reduce risk exposure through proactive preparedness and strengthened post-event response.

Outerlimit, a New York-based cybersecurity startup founded by Tony Pepper, Neil Larkins, and Dr. Peter Vincent, has raised $16 million in pre-seed funding from AlbionVC, Evolution Equity Partners, and Crane Venture Partners. The company is developing a decentralized security platform that extends Zero Trust principles to control individual actions taken by autonomous AI agents within enterprise environments. Pepper and Larkins previously led Egress Software, which was acquired by KnowBe4 (a Vista Equity Partners portfolio company) in 2024. Outerlimit's platform addresses security gaps in existing identity and access management systems by providing cryptographically enforced authorization at the individual agent action layer, with a phased deployment approach covering discovery, visibility, and deterministic enforcement. The startup has already partnered with Fortune 500 and FTSE 100 companies and has attracted strategic angel investors including Brian Murphy (founder and CEO of ReliaQuest) and Scott Price (founder and CEO of A-LIGN).

The EU Cyber Resilience Act's reporting requirements took effect September 11, 2026, and manufacturers of products with digital elements sold in the EU now face a 24-hour reporting clock for actively exploited vulnerabilities and severe incidents. The law applies broadly to software, hardware, and connected devices, with maximum administrative fines of 15 million euros or 2.5% of worldwide annual turnover for noncompliance. Manufacturers must submit reports through ENISA's CRA Single Reporting Platform with tiered deadlines: early warning within 24 hours, vulnerability or incident notification within 72 hours, and final reports within 14 days to one month depending on category. The reporting obligations apply even to products sold before the December 11, 2027 product-compliance deadline, and US companies selling into the EU are treated as manufacturers with full reporting duties. Additional product-security requirements take effect December 2027, including secure-by-default configurations, automatic security updates, and protection against known vulnerabilities, with penalties enforced by Member States within the maximum thresholds.