Cybersecurity startup Kenna Security raises $48M Series D led by Sorenson Capital and Citi Ventures, bringing total raised to ~$98M
Risk-based vulnerability cybersecurity startup Kenna Security Inc. today said it has raised $48 million in new funding to accelerate its international expansion and drive product development.
Context & Ripple Effects
In late 2019, Kenna Security was a mid-stage bet on a specific thesis: that vulnerability management should be driven by real-world exploit data rather than raw severity scores. Its $48 million Series D, led by Sorenson Capital with Citi Ventures participating, put total funding near $98 million — and the round landed just three months after rival SecurityScorecard closed its own $50 million Series D, signaling that investors saw room for more than one risk-prioritization platform.
The arc since then has vindicated the thesis at the company level: Kenna was acquired by Cisco in 2021 for its exploit-data-driven risk modeling, while lead investor Sorenson Capital doubled down on the adjacent category with Safe Security's cyber risk quantification round in 2023. This raise is the inflection where the category moved from venture curiosity to consolidation target.
First-order effects
- Kenna gets the capital to push international expansion and product development directly against larger vulnerability incumbents like Tenable, whose 2015 $250 million raise set the scale benchmark for the space.
Second-order effects
- Sorenson Capital's return as a lead in cyber risk quantification via Safe Security's $50M Series B shows the same backers recycling conviction across the category, keeping valuation pressure on every risk-scoring vendor competing for the same enterprise security budgets.
Third-order effects
- Cisco's acquisition of Kenna confirms the structural endpoint of this pattern: risk-prioritization startups become acquisition fuel for platform vendors racing to embed exploit intelligence into broader security portfolios, narrowing independent options for buyers.
The trend: Enterprise security spending is consolidating around data-driven risk quantification, with specialized startups funded through Series D and then absorbed by platform vendors.