Cybersecurity and privacy companies, many of which raised hundreds of millions, laid off ~1,400 staff since May; OneTrust laid off ~950 and Lacework let 200 go
David Uberti / Wall Street Journal :
Context & Ripple Effects
Cybersecurity had been pitched to investors as recession-proof spend, which is what made the sector's fundraising so aggressive: Lacework alone pulled in $1.3B in November 2021 while claiming 1,000+ employees. Within months of that raise, it cut 20% of staff — an early signal that big balance sheets were not insulating security vendors from the downturn.
The Wall Street Journal's tally makes that signal sector-wide: roughly 1,400 job cuts across cybersecurity and privacy companies since May, dominated by OneTrust's ~950-person reduction. The pattern has since spread beyond the privacy-compliance cohort, with Cybereason cutting 200 more roles in October after earlier June layoffs.
First-order effects
- OneTrust's ~950 laid-off employees and Lacework's ~200 represent the direct cost of correcting for 2021-era hiring built on mega-rounds like Lacework's $1.85B total raised.
- Both companies' go-to-market capacity shrinks immediately, forcing each to defend revenue with materially smaller sales and support teams.
Second-order effects
- Peers face pressure to match the burn discipline: Sophos, owned by Thoma Bravo since its $3.9B acquisition, followed with its own 10% global workforce cut, suggesting private-equity and VC-backed vendors alike are converging on the same playbook.
- Security buyers gain negotiating leverage as vendors compete harder for renewals, while the talent market floods with experienced security engineers.
Third-order effects
- The 'recession-proof security budget' thesis is being repriced: if even well-capitalized security firms cannot outrun the funding reset, expect consolidation toward acquirers and slower-growth survivors rather than a return to 2021 hiring rates.
- These cuts prefigure the much larger wave tracked by Layoffs.fyi — tens of thousands of tech layoffs by early 2024 — positioning cybersecurity as one of the first supposedly defensive categories to break.
The trend: Security startups that scaled headcount on 2021's mega-rounds are resetting burn as venture funding tightens, making cybersecurity one of the earliest 'defensive' categories swept into the broader tech layoff cycle.