Identity Funding Report 2026: Where the Money Went

Identity-security startups raised at least $4.40 billion in 99 announced equity rounds from January 2025 to October 2026, and half of those rounds were pitched at AI agents and non-human identities. Two late-stage deals, Keyfactor's growth investment of more than $1 billion and Saviynt's $700 million round, are 39% of the money; the other 97 rounds raised $2.70 billion. Agent focus is now the default pitch, but not a price premium: agent-focused seeds and Series A rounds are the same size as everyone else's. And for a growing number of companies, a round is the last step before a sale. Seven companies in this data were acquired a median of 224 days after their last round.

This report reads a round-by-round record SWI built for this purpose and checked against each company's announcement or a named press report. It pairs with the Identity Consolidation Report 2026, which covers the acquisitions side, and with the live acquisitions record. The data is downloadable below under CC BY 4.0.

Methodology

Data snapshot. Rounds come from data/identity-funding.json as of October 31, 2026. scripts/reports/identity-funding-report.mjs validates the file (required fields, allowed values, unique IDs, vendor profiles that resolve) and prints every figure quoted here.

Inclusion. A round is included when it was publicly announced between January 1, 2025 and October 31, 2026 and the company's main product is identity security: IAM, CIAM and developer authentication, IGA, PAM, ITDR and identity posture, non-human, machine and AI-agent identity, secrets management, identity verification and KYC or KYB, authorization, MFA and passwordless, decentralized identity, PKI, password management and open-source auth. Rounds are equity rounds of any stage, strategic investments, and debt, which is counted but kept out of the totals.

Excluded. Acquisitions and majority buyouts (they are in the acquisitions record), and companies whose main product is fraud scoring, AML, deepfake detection, data security or general AI security, even when they touch identity. Also excluded:

• World's three token sales, worth $135 million, $65 million and $52.5 million, because they are sales of tokens by a foundation, not equity rounds.
• A $37 million Incode raise visible only in an SEC Form D, because it was never announced.
• CertifID, Monnai and QIZ Security, as borderline on the main-product test.

SWI profiles the data security company Cyera, but its rounds are not identity rounds and are excluded too.

Amount status. Every round carries one of three labels:

• Disclosed: the company or an investor stated the figure in its own announcement. 83 of the 99 equity rounds.
• Reported: the company did not state it, and a named outlet reported it or an investor confirmed it to the press. 7 rounds, $0.30 billion.
• Undisclosed: no figure stated or credibly reported. 9 rounds. These count in round totals but not in capital.

Where a source gave a floor ("more than $1 billion", "over $20 million"), the floor is used. Non-dollar amounts use the source's conversion where it gave one. Some rounds include secondary sales by existing holders: Socure's included an employee tender, IDfy's Series F mixed primary and secondary, and Keyfactor's did not say. The totals here are announced capital, not new money on the balance sheet.

Stage. The round label is the one the source used. Where the source named no stage, SWI assigned a placeholder (usually Growth or Seed) and set round_stated to false; 18 rounds are in that position. Stage medians use only priced rounds whose stage the source named.

Agent focus. A round is flagged agent_focus when the company's product or the round announcement explicitly targets AI agents or non-human identities. That is a reading of the pitch, not a product review. An incumbent that announced its round as funding for agent identity work, such as WorkOS or Clerk, is flagged, and so is a startup built only for agents.

Limits. This is a record of announced rounds, so it is a floor, not a census: companies that raise quietly are missing. The search leaned on English-language trade press and US newswires, and India, Latin America and Israeli seed rounds covered only in Hebrew-language press are undercounted. India appears through one company. Rounds from September and October 2026 are probably undercounted too, because trackers lag. For that reason, quarter-to-quarter changes in round counts are not evidence of a trend, and this report does not treat them as one. Every round was checked against its linked source on October 30 or 31, 2026.

Finding 1: $4.40 billion in 99 rounds, and two deals are 39% of it

Disclosed amounts alone add up to $4.10 billion. Two debt facilities are recorded but kept out of these totals: ID.me's $275 million credit facility from Ares Management (January 2025) and a $2.7 million facility for the German verification company Nect.

By quarter, the money arrives in lumps:

Seven rounds were $100 million or more, and together they are 54% of all priced capital:

Keyfactor and Saviynt are both established companies, founded long before this cycle, taking private-equity-scale growth money. They are real rounds, but they are not the venture market most readers have in mind, so this report shows totals with and without them. Persona, Socure, Oasis Security, Veza and WorkOS make up the rest of the list.

Only 9 of the 101 rounds carry a valuation, and 6 of those were disclosed by the company:

The Infisical round was the last priced round in the window, a $40 million Series B at a disclosed $600 million valuation (SWI coverage).

Finding 2: where the money went, by category

Categories follow SWI's vendor taxonomy; the category of a company SWI profiles is its profile category. The ranking by capital is mostly a ranking of single deals: Saviynt makes IGA, and Keyfactor alone makes PKI. By number of rounds, identity verification (23) and AI-agent and non-human identity (19) lead, together 42 of the 99 rounds.

Identity verification is the steadiest category, with rounds from Persona's $200 million Series D down to a $1 million seed for the Canadian startup deepidv. Sardine ($70 million Series C), IDfy (about $52 million Series F), Vouched ($17 million Series A) and Didit also raised.

Finding 3: half the rounds are pitched at AI agents

49 of the 99 equity rounds (49%) were for a company or a round that explicitly targeted AI agents or non-human identities.

The hypothesis that agent identity was the funding theme of 2026 is half right. By capital it holds: excluding the two late-stage deals, agent-focused rounds took 54% of priced capital in 2025 and 66% in 2026. By round count, the share barely moved, from 48% to 51%. The agent pitch had already become standard in 2025, and 2026 put more money behind it rather than more companies.

Two kinds of company carry the flag. One kind was built for agents and non-human identities from the start. Token Security raised a $20 million Series A, Clutch Security a $20 million Series A, and Keycard $38 million across a seed and a Series A. Arcade.dev raised a $12 million seed and a $60 million Series A, Hush Security an $11 million seed and a $30 million Series A, and Defakto (formerly SPIRL) a $30.75 million Series B. Corsha raised an $18 million Series A plus two strategic follow-ons. The other kind is an established vendor that pitched its round at agents: Persona, which framed its Series D around verifying the people behind AI agents, WorkOS, Clerk, Descope, Saviynt, Veza and C1. SWI's agent identity standards map covers the protocols these companies are building to.

The missing agent premium

We expected agent-focused startups to raise larger early rounds. They do not:

At seed and Series A the medians are within $1.3 million of each other, and the Series B gap is $5 million on 13 rounds. Investors are funding more agent-focused companies, not paying more per company at the early stages. Founders should read the agent pitch as a way into the meeting, not as a way to a larger check. The samples are small, and pre-seed (two agent-focused rounds) is too thin to read at all.

Finding 4: stage benchmarks, and the mega-seed share

Each stage roughly doubles the median of the one before it, from $3.0 million at pre-seed to $9.5 million at seed, $20.0 million at Series A and $40.0 million at Series B. Most strategic investments carry no amount: Cisco's in Teleport and Arcade.dev, the CrowdStrike Falcon Fund's in Above Security (SWI coverage), NEC X's in Indicio and Booz Allen Ventures' in Corsha.

The seed range is the striking one. We define the mega-seed share as the share of all priced seed capital that sits in seed rounds of $20 million or more. In identity security for 2025 and 2026 it is 55%: six of 31 priced seed rounds hold $237.0 million of $433.7 million.

Four of the six are Israeli. NewCore and Oak announced theirs as they left stealth, and Oak's had been raised in private months earlier. Descope's is a top-up of an older seed by existing investors. A seed this large is a Series A in all but name. A buyer meeting one of these companies should judge it on the product and the team, and should not read the round label as a sign of how mature the company is.

Finding 5: the US takes four fifths of the money

Country is the company's stated headquarters. Many Israeli-founded companies list a US headquarters and Israeli R&D: Oasis Security, Clutch Security, Descope and Linx Security count as US here. Counted by founding team, Israel's share would be larger. Without Keyfactor and Saviynt, the US share of capital falls to 71%.

Israel is the agent-identity hub of this data: 12 of its 14 rounds were agent-focused, the highest rate of any region. Those include Token Security, Hush Security, Fabrix Security, Apono, Oak, NewCore, Willow and Rig Security.

Europe raised a fifth of the rounds but 6% of the money, at a median a quarter of the US figure. The UK has six rounds, including Push Security's $30 million Series B and Outerlimit's $16 million pre-seed. The Netherlands and Spain have three each, among them Duna's $35 million Series A for business identity and Didit's seed. The largest European round is GitGuardian's $50 million Series C (France). The European rounds also include Passbolt's $8 million Series A (Luxembourg) and a set of EUDI-wallet and eID companies: Lissi, Evrotrust, Wultra and Gataca. Only 4 of the 21 European rounds were agent-focused.

India appears through one company, IDfy, which raised a Series F of about $52 million and a later round of about $23 million at a reported $256 million valuation. That reflects the limits of the search, not the Indian market.

Finding 6: no investor dominates

89 of the 101 rounds name a lead or co-lead investor, and those 89 rounds name 100 different firms.

Elad Gil led both of Infisical's rounds. Summit Partners led the largest deal in the data and the highest valuation (Socure's $5.2 billion), two late-stage bets on identity verification and machine identity. Ribbit Capital, a fintech investor, co-led both Persona and ID.me, a sign that identity verification is funded as financial infrastructure. Pantera Capital, a crypto fund, led both Humanity Protocol's proof-of-personhood round (with Jump Crypto) and TransCrypts' credential-verification seed.

Corporate investors show up more often as strategic follow-ons than as leads. Cisco Investments joined SGNL's Series A and Arcade.dev's Series A extension, and made a strategic investment in Teleport. The CrowdStrike Falcon Fund invested in Above Security and joined C1's Series B. Two of the companies those funds backed, SGNL and C1, were later bought by CrowdStrike and Workday respectively. A corporate fund in a round does not predict who buys the company.

Finding 7: the raise-to-sale interval

We define the raise-to-sale interval as the number of days between a company's last announced funding round and the announcement of its acquisition. It measures how often, and how fast, a round turns out to be the last step before a sale.

Seven of the 89 companies in this data had been acquired by October 31, 2026, according to SWI's acquisitions record:

The median interval is 224 days, about seven months. Five of the seven companies were agent-focused when they raised. None of the seven took longer than 13 months to go from its last round to a signed deal. Veza is the one case with both a valuation and a price: ServiceNow paid about 1.5 times the reported $808 million Series D valuation, 218 days later.

Seven of 89 is 8% in at most 22 months. The share is small, but it is concentrated among the companies investors most wanted to fund. Three of the eight largest agent-focused rounds in the data, Oasis Security's $120 million, Veza's $108 million and C1's $79 million, were followed by a sale within a year. Other agent-identity companies bought in 2026 (Astrix Security, Natoma, Entro Security, Permiso Security) have no round in this window, so they do not appear here. The consolidation report covers that 87-day run of acquisitions.

SWI covered the sales as they happened: Cyera and Oasis, 1Password and Apono, ServiceNow and Veza, Silverfort and Fabrix, CrowdStrike and SGNL, and Workday and C1.

What this means for buyers and for founders

For buyers: read a round as a viability signal, with two caveats

A recent round tells you the vendor has runway, and runway is the first question in any multi-year identity contract. The data adds two caveats.

• A big round does not mean a long independent life. Oasis Security raised $120 million and agreed to sell 131 days later. If you are buying from a well-funded agent or non-human identity startup, assume an acquisition within the contract term is plausible. Negotiate change-of-control, renewal caps and data export before signing, not after. The consolidation report lists the clauses.
• A round label is not a maturity signal. A $60 million seed from a company that left stealth this year means investors are confident. It does not mean the product has years of production deployments behind it. Ask for references at your scale.

Use the stage medians to calibrate. A vendor with a $3 million pre-seed has very different staying power from one with a $40 million Series B. Both can be the right choice, but the first needs an exit plan in your contract.

For founders: benchmark against the median, not the headlines

• The medians are $9.5 million at seed, $20 million at Series A and $40 million at Series B. Fewer than one in five priced seeds (6 of 31) reached $20 million, and four of those six went to Israeli companies.
• An agent pitch gets you into more meetings, but not a larger check: agent-focused seed and Series A medians match everyone else's.
• European identity rounds median $7.8 million, against $30 million in the US. If you are a European company raising from US investors, those investors will benchmark you against the US numbers.
• Corporate venture arms are active, mostly as strategic follow-on investors. A corporate investor is not a promise of an exit to that corporation.
• A buyer may come within a year. Seven companies in this data sold a median of 224 days after their last round, and most of them did not disclose the price.

About the data

The dataset is one row per round (101 rows: 99 equity, 2 debt), generated by scripts/reports/identity-funding-report.mjs from data/identity-funding.json. Each row has:

• the company and its SWI vendor profile where one exists (45 rounds)
• category, round, and whether the source named the stage
• amount in USD and amount status, valuation and valuation status
• announcement date, lead investors, HQ country and region
• the agent-focus flag
• any later acquisition from the acquisitions record
• the source URL, SWI's own coverage where it exists, and the verification date

The source URL is the company's own announcement where one could be opened, and otherwise a named outlet's report.

The data is licensed CC BY 4.0. Cite it as: StartWithIdentity.com, Identity Funding Report 2026, snapshot October 31, 2026, and link the finding you use: each key finding above has a stable anchor (#finding-1 to #finding-8).

This is a dated snapshot, and it will be wrong in places. Rounds that were never announced, rounds covered only in non-English press, and rounds from the last weeks before the snapshot are the most likely gaps. If you know of a missing round or a wrong figure, send it with a source. Corrections are credited.