The energy at RSA Conference (RSAC) 2025 was palpable. Hewlett Packard Pathfinder investors were among the 44,000 cybersecurity enthusiasts who attended the annual flagship event that spans San Francisco’s Moscone Center. Our week was packed with discussions with promising startups (nearly 80 exhibited at the “Early Stage Expo”), new product releases by incumbents, and trying to get secure Wi-Fi! Most conversations were dominated by AI, but others were in more traditional areas of cybersecurity, and collectively they informed our top five takeaways:
● Protect AI Exits to PANW: On Day #1, the conference kicked off with a major market validation for AI Security companies, as Palo Alto Networks announced it will acquire Protect AI, an early mover in securing the AI development lifecycle, for a rumored $650M – $700M¹. The deal highlights growing urgency around the category and, after having gotten to know the company, comes as no surprise to Pathfinder. Congratulations to Ian and the team!
● RSAC to Invest $50M in the Finalists: The Innovation Sandbox competition took advantage of its access to launch an interesting investment strategy. Starting in 2025, it will invest $5M through an uncapped SAFE in each of the ten finalists.² This demonstrates a forward-thinking, founder-friendly, YC-styled move to get early-access to companies, the likes of which have gone on to exit for, or gain valuations of, hundreds of millions of dollars (i.e., Talon won in 2022, then exited for $458M; HiddenLayer and Reality Defender both raised up-rounds following RSAC in 2023 and 2024, respectively).
● ProjectDiscovery Wins Innovation Sandbox: This year the Innovation Sandbox also crowned ProjectDiscovery, which offers open source tools to automate attack surface monitoring and vulnerability management, with the title of “Most Innovative Startup.” Given that for the previous two years winners were AI security-focused (i.e., Reality Defender to detect deepfakes, HiddenLayer to secure the AI development cycle), this marked a notable shift back to solving a “foundational problem like vulnerability management”, as the company mentioned in its blog post following the win. However, looking a bit deeper, AI is still so pervasive that it’s baked into its product (i.e., to help convert internal vulnerability data into automated detection pipelines). This reflects the notion that AI-powered capabilities are no longer a premium, they’re table stakes; said another way: you can be a non-AI security company and still use AI.
● Incumbents Debut Agentic AI for SOCs: While we saw less agentic AI at the Early Stage Expo than expected (however with ~80 startups, we could have missed some), it was more the industry incumbents who made announcements regarding agentic capabilities that could bolster security operations centers (SOCs). Among them was Crowdstrike, which unveiled capabilities for Charlotte AI, its agentic model to triage detections, ask & answer its own questions, and initiate remediations. SentinelOne unveiled its Purple AI Athena release, which utilizes agentic AI to mirror the deep security reasoning and orchestration of human SOC analysts. Similarly, IBM announced its Autonomous Threat Operations Machine (ATOM), which uses agents to accelerate threat detection, enrich context, and perform (some) remediation. Overall, agentic AI was portrayed as a burgeoning space with developments that are nascent, but show potential in meaningfully reducing the level of effort for humans-in-the-loop.
● Resurgence of OT Security: Outside of AI, Operational Technology (OT), a more mature area of cybersecurity, received renewed attention. OT refers to the controls and monitoring of machines that manage energy utilities, manufacturing facilities, water treatment centers, etc. Historically, these systems were not on the internet (i.e., air-gapped), but are now connecting to corporate intranets, or even the public internet. Aware of the opportunity, Pathfinder is proud to be an investor in Dragos, an OT cybersecurity vendor that provides asset visibility, threat intelligence, and incident response. However, this year we noticed companies tackling a separate OT issue - network microsegmentation. Startups including Elisity, Zero Networks, and TXOne Networks, displayed their ability to segment & secure lateral movement in OT (and IT) environments. Among the incumbents, Cisco released advanced capabilities to address OT security in its Industrial Threat Defense platform, including adaptive industrial zone segmentation using Cisco Secure Firewall. Unlike AI applications that might not deploy to production, we know that OT systems are here to stay. Thus, while the growth potential of OT security is overshadowed by AI’s, the budget for buyers of the former is more likely to be allocated, which we find valuable.
Reflecting on the event, RSA once again proved itself to be the epicenter for cybersecurity innovation and with the proliferation of AI, events like it become even more important. This is because, when it comes to AI and cybersecurity, enterprises face three key challenges: (1) leveraging AI-powered solutions to strengthen defenses against existing vulnerabilities, (2) adopting AI security tools to combat emerging threats from AI-enabled attackers, and (3) ensuring the security of their own AI systems as they scale. At the same time, there are legacy issues that are intensifying as antiquated industries embark on digital transformation. To that end, Pathfinder is interested in cybersecurity companies serving enterprises at any stage of tech-readiness.
If this resonates with you, and you’re a Founder/CEO of a cybersecurity company, let’s connect. Please reach out to us at pathfinder-newsletter@hpe.com.
¹“Palo Alto Networks Acquires Startup Protect AI as RSA Conference Kicks Off." Investors Business Daily, April 28, 2025
²Investments are provided by Crosspoint Capital Partners, a significant shareholder in RSAC.
If you like this article consider subscribing to our bi-monthly newsletter to get information about our portfolio, solutions, and insights delivered to your inbox.