Skip to content
BULWARKSecurity Capital

The thesis

Defense is a permanent, compounding market — not a cycle.

Attackers are now capitalized like startups and organized like enterprises. The result is a category that does not soften in a downturn and does not saturate: as software eats a domain, security follows it, and the defensive surface grows faster than the thing it protects.

Attackers are capitalized like startups and organized like enterprises. Defense is no longer a cost center — it is the load-bearing wall of the digital economy.

01

Demand

Non-optional spend

Security is the rare budget line that survives every cut. Boards treat a breach as an existential and personal liability, and regulation keeps converting best practice into obligation. Demand is structural, not discretionary.

02

Surface

The attack surface only expands

Cloud, AI, identity sprawl, and machine-to-machine traffic each open a new front faster than the last is closed. Every platform shift is a fresh security market before it is anything else.

03

Trust

Trust is the real product

Enterprises don't buy features — they buy the confidence to move faster without getting breached. The companies that own that trust become infrastructure, and infrastructure compounds.

04

Distribution

Distribution favors specialists

Security is sold to a skeptical, technical buyer through a small, tight community. A fund embedded in that community shortens the path from first call to signed enterprise contract.

The long view

We've seen this pattern before.

Every computing platform shift creates a security wave behind it, on a lag. The wave is always underestimated while it's forming. This is the record.

  1. 1988

    The first worm

    The Morris Worm — the internet's first real security incident. A new industry starts forming behind it.

  2. 1996

    The perimeter era

    Firewalls and network segmentation define security for a decade. The edge is the thing you defend.

  3. 2010

    The cloud shift

    Workloads leave the data center faster than anyone can secure them. A boundary-less surface opens.

  4. 2016

    Bulwark founded

    We started recording here — investing in the founders defending the surface as it opened.

  5. 2020

    Identity becomes the perimeter

    Remote work and SaaS sprawl dissolve the network edge. Credentials become the thing attackers target first.

  6. 2023

    The agent wave

    AI systems are handed autonomy and credentials of their own — a new, fast-growing population with no governance model yet.

  7. 2026

    You are here

    The pattern is repeating, on a shorter cycle than the one before it.

How we work

We keep a low profile. On purpose.

The people we invest in defend systems adversaries are actively trying to break — so the people investing in them shouldn't become a second attack surface. We'd rather be known by the companies we invest in than by the noise we make about ourselves.

The next line of defense

If you're building it, we want the first call.

We lead early, hold conviction, and stay through the rounds that matter.

For Founders