Hyas, which maps the “command and control” structure and communication patterns of bad actors to intercept cyberattacks, raises $16M Series B
Chris O'Brien / VentureBeat :
Context & Ripple Effects
HYAS is scaling an approach it has pitched since its $6.2M Series A led by Microsoft's M12 in 2018: instead of chasing malware payloads, map the command-and-control infrastructure and communication patterns of criminal operators so attacks can be intercepted upstream. The new $16M Series B signals that investors see attacker-attribution intelligence as durable enough to fund through multiple cycles.
The round lands inside a broader run of capital into behavioral and infrastructure-focused security: Cyberhaven moved from trade-secret analytics into insider-threat prediction with an $88M raise at a $488M valuation, Halcyon drew a $50M Series A for ransomware defense, and Adaptive Security pulled an $81M Series B for simulated social engineering. HYAS is the infrastructure-mapping lane of the same thesis — model the adversary, not just the code.
First-order effects
- HYAS gets runway to expand its command-and-control mapping product beyond the law-enforcement tracking positioning of its Series A era, pushing deeper into enterprise interception sales.
- Security teams buying threat intelligence gain a funded vendor whose value proposition rests on identifying operators' locations and infrastructure rather than signature-based detection.
Second-order effects
- Incumbent detection vendors and rivals like Cyberhaven and Halcyon face pressure to fold attacker-infrastructure intelligence into their own platforms, since buyers increasingly expect attribution alongside prevention.
- Sustained venture funding across these adjacent lanes raises the bar for new infosec entrants, pushing differentiation toward specialized attack vectors — ransomware, insider behavior, social engineering, C2 networks.
Third-order effects
- If the pattern holds, enterprise security consolidates around vendors that model adversary behavior and infrastructure as a persistent dataset, marginalizing tools that only inspect files or perimeters at the moment of attack.
- The steady stream of nine-figure-capable rounds across these categories points toward a market where attacker-intelligence data becomes a priced input, potentially drawing regulatory attention to how private firms track and share criminal attribution.
The trend: Cybersecurity funding is shifting from signature-based detection toward vendors that profile attacker behavior and infrastructure, with each category — C2 mapping, insider threats, ransomware, social engineering — raising progressively larger rounds.