Apply to Register Here

Founded in 2015, Activant is a global investment firm with $1.5 B AUM that partners with high-growth founders and teams that are transforming commerce.

Activant

We’re always looking to learn about new perspectives, new research, and new ideas.

Get in touch

Disclaimers & Terms of Use

Privacy Policy

323 Railroad Avenue
Greenwich, CT 06830
USA

Greenwich

New York

Berlin

Constantia Uitsig Wine Estate
Spaanschemat River Road
Cape Town 7806
South Africa

Cape Town

Harish is providing the Amazon Prime fulfillment experience to everyone else through a combination of AI and an asset-light network of warehouses across the United States.

Alex is automating workflows for the world’s largest enterprises by using process mining to build the connective tissue for businesses.

Mayan is delivering Autonomous IT to the largest companies in the world through systems of intelligence.

Carsten built one of the largest commerce platforms in the world, which powers enterprise merchants and retailers across the globe and now serves as the SAP commerce engine.

Soups is stopping financial crime in its tracks by building the first end-to-end platform for fraud, risk, and compliance.

Adam is enabling restaurant owners to take back their customer relationships by digitizing their entire online and offline operations in a single platform.

Activant is a research-led growth firm that invests in relentless founders

Read past issues

Monthly Newsletter

Browse Research Library

Research

Perspectives

Home

Activant is a research-led global investment firm that partners with high-growth companies.

We partner with founders who have won their initial battles and are ready for the next challenge.

We typically invest when two things come together. First, the company has the potential to achieve escape velocity and transform an entire industry. Second, we believe the founders can lead the company through hyper growth, and our support can significantly increase the probability of this success. 

The critical time window to escape competitors and transform an industry is not open for long.

That’s why after we invest, the real work begins.

About

We only partner with a few founders per year. But when we do, we’re fully committed.

Our portfolio

Companies

Read our investment rationales and market perspectives.

A team built to support and advise yours.

We invest behind insights.

View all research

Founders who aspire to build something bigger than themselves chose to partner with us at their most critical point.

Team

Raised in Cape Town, South Africa, Nina studied at the University of Cape Town with a triple major in Applied Statistics, Economics, and Human Physiology. She nurtured her passion for the investment world by diving into her MSc in Mathematical and Financial Statistics, focused on developing new algorithmic scenario-based approaches to investment portfolio construction. She went on to begin her industry experience as a quantitative analyst at a boutique hedge fund and investment management firm sharpening her data analytics skills. At Activant Nina forms part of the research team, working towards identifying the next game-changing technologies and software-obsessed founders.

Growing up and to this day, I always ask the nagging question "But why?"... Approaching complexity and novelty in this way drives my curiosity to understand markets and founders. Relentless curiosity is a cornerstone of the entire Activant team, enabling us to identify the next disrupters in the world of startups. A broad knowledge base in statistics, economics, computer science, and as far as human physiology shapes how I approach research. It enables me to view things from different angles and to apply my technical knowledge when digging into the crux of the data and software world.

Safeguarding the Mona Lisa is a tough job – a prized masterpiece that could be subject to any number of elaborate heists. That’s why it is protected by powerful security tools like security cameras, motion detectors and bulletproof glass. However, the Mona Lisa does not change, replicate, or move, which makes the security job a lot easier. Data Security teams, on the other hand, must protect an asset that flies around the globe through clouds and third-party apps, where hundreds of employees demand daily, unrestricted access to that data to get their jobs done. While the Mona Lisa hangs safely in the Louvre, 

data breaches are occurring at a rate of five every single day


In this report, we explore what makes that problem so hard, why it’s about to get even harder, and how we see the solution evolving through 

. Today, companies invest over $200bn on traditional security tools, but the $5bn Data Security market is too often an afterthought. To overcome existing data breach challenges, companies need to make Data Security the building block of their security strategy.

We’ve all been the subject of phishing emails. From personal experience, we know 

. And for large enterprises with valuable IP, customer data and multi-million-dollar transaction flows, it’s an order of magnitude worse. In 2022, the average enterprise experienced over 1,000 cyber-attacks per week, or 150 every single day – more than doubling since 2020.

With sophisticated actors frequently attacking, data breaches occur at an alarming rate, with 1,862 breaches recorded in 

 These breaches impact a wide range of companies– 53% of organizations stated that they had experienced a 

 And there are many recognizable examples: 

 all experienced breaches in the last few months.

 That bill could rise to $10mn+ for industries with extensive sensitive data, like healthcare.

 due to downtime, management distraction, loss of intellectual property and reputational damage: 73% of consumers would reconsider using a company’s product if their personal data was exposed.

’s systems were down for over a month, creating a backlog of $14bn in payments that were due through its claims 

Over 80% of impacted businesses pay ransom fees, which totaled $1.1bn in 

For example, Equifax’s 2017 breach saw them pay £11mn to the UK Financial Conduct Authority and $575mn to the US Federal Trade 

In the information age, data is a company’s most critical asset. Unlike physical assets, data cannot be replaced once it’s lost. And for customers, they can’t change critical identifiers like names and social security numbers. Once revealed, that information is public forever. You can’t un-breach data, so the stakes are incredibly high. 

To understand how we arrived at this fraught situation, we must examine the key factors making data security an intensely difficult challenge.

1. More data, duplicated across more systems, accessed more widely:

New data is growing rapidly – estimates suggest that the number of sensitive data files organizations must manage will increase ~5x by   

Even a well-architected security policy can become inundated with a growing stock of data to manage over time, 

yet 66% of staff believe that their data has already outpaced their ability to secure

 This is worsened by growing demands to be data-driven, which create a larger attack surface across different analytics systems and SaaS apps. Such demands also force companies to have more lax data access policies, lest the data security team becomes inundated with access requests and teams are left waiting too long for critical decision-making material. 

2. Disparate data sources create a lack of visibility into data:

With organizations managing an average of 187+ data sources and systems, it is incredibly difficult to appropriately classify and tag all incoming 

 As a result, organizations are often unaware of the sensitive information they possess and where it resides, hindering their ability to safeguard it adequately

. Hence only 4% of companies have dedicated storage for sensitive 

3. Inconsistent governance and security posture:

39% of companies use more than one cloud computing vendor (“multi-cloud”), and 84% mix cloud and on-premises resources 

 Also consider that companies may combine numerous data tools, such as using both Snowflake and Databricks. As a result, it is difficult to manage a consistent and unified policy, leaving vulnerabilities, especially in the cloud. Cloud resources can become vulnerable due to poor access controls, unrestricted ports and unsecured backups – 99% of cloud IDs are “excessively 

80% of data breaches involve data stored in the cloud

137 countries have instituted data protection legislation, the most prominent being 

 Individually, these regulations burden data teams with extensive considerations surrounding how they handle data, with equally painful costs for non-compliance (GDPR penalties can be as much as 4% of global turnover). But collectively, these disparate regulations create a maze that is near impossible for global businesses to navigate. With the recent proposal of an 

, all signs point to this situation intensifying.

Text-to-SQL models will 10x the number of data users, while AI co-pilots drive more SaaS systems to demand enterprise data access. 64% of companies report being “under pressure” to adopt Generative AI, but 84% see cybersecurity as the primary 

 Those roadblocks exist across the model lifecycle:

Model training requires centralizing training data which creates a honeypot for attackers.

Model development often involves the use of open-source models as well as testing with numerous models, resulting in some enterprises running over 100 different 

 This makes it difficult to detect security vulnerabilities in all the models being used over time, leading to 

more than 40% of companies suffering from privacy or security issues 

The inference phase exposes companies to prompt injection, where attackers can use specific prompts to drive the model to reveal sensitive information or inject malicious code into its underlying database to enable hackers to gain access to a system. For example, researchers at Google forced ChatGPT to reveal sensitive information from its training 

 Companies need control over what data employees provide to AI systems, which is difficult to manage at scale, particularly when employees make use of non-sanctioned AI systems, giving rise to “shadow AI.”

It should be no surprise then that 40% of chief security officers feel that they are unprepared for the current threat environment. Implementing stronger data governance and security controls ranked as the number one priority for data leaders, above modernizing their data infrastructure or integrating AI into business 

Companies must prioritize data security, not just for compliance reasons but to maintain business continuity, brand value and competitive positioning. Data breaches cannot be treated as routine - they pose existential threats with the potential to cripple businesses.

Today, cybersecurity is a $200bn+ market and at just ~$5bn, Data Security appears to be an afterthought for CISOs. Putting data first promises a more sound strategy. Once you know where your sensitive data is, you can apply tools like access control and governance, but also have a much more targeted strategy for tools like threat intelligence, network security and cloud security. Perhaps, with efficiency gains from this approach, companies that start with Data Security could even see some overall savings on their cybersecurity budget. 

It's why we see data security becoming the fundamental building block of the broader security stack.

That sentiment is echoed by Anshu Sharma, whose highest priority security actions start with data:

That’s why we see the market evolving from its current estimates of ~$5bn to $47bn over the next decade (25% CAGR)

. We estimated our TAM based on industry-specific ACVs, considering the level of sensitive data and data complexity for that industry. From conversations with CISOs, companies are likely to spend anywhere from $500k - $5mn on data security, depending on their unique needs. We narrowed this range down to $500k - $1.5mn, noting that ACV’s of $5mn would likely only apply to extreme outliers by size and complexity. ACV is multiplied out by the number of enterprises (firms with 1000+ FTEs) per the Bureau of Labor Statistics.

This is an emerging market segment with so much potential – data security has numerous exciting components and an ecosystem of start-ups that are leading the way forward. In the next section, we walk through how we break down the data security market in the form of our Activant Value Chain.

Our View on Data Security

Working from left to right, we’ll discuss the most critical pieces of this value chain, the jobs to be done for those software products, and highlight a few of the companies leading the way in each segment.

Lack of visibility remains one of the core pain points when trying to secure data. Companies often don’t know what data they have, making it impossible to adequately secure it. 

Discovery and classification serve as the crucial first step.

 These tools automatically locate and catalog all data, from sources like databases and SaaS apps. Classification models can tag data based on its type (PII, health, etc.) and risk level. Once companies understand their risk, the right 

 scan enterprise data in any data store without installing agents on your devices, while working with both structured and unstructured data, where 

A comprehensive encryption strategy can help companies comply with regulations and serve as a last line of defense if data is breached. Sensitive data should always be subject to some form of encryption, but traditional encryption can make data 

Companies might consider technologies like tokenization (a key tool used by 

), format preserving encryption, and homomorphic encryption (which could power machine learning on encrypted data).

 is building a new piece of this architecture – the data privacy vault, a centralized point of control for sensitive data­– to ensure that data doesn’t proliferate across a company’s systems. 

 Microshard technology protects data from ransomware by shredding it into 4-byte pieces and distributing it across cloud storage locations.

. No data security strategy can be successful if permissive access policies nullify other protection measures. But, if access control is too tight, teams can’t get access to the data they need to do their work on time. Managing this tension, together with data access privileges that can vary by role, project, geographic region and time of day, makes these policies extremely complex. Luckily, activity-based access control (ABAC) can consider contextual information together with attributes like users or files to grant fine-grained access controls with minimal administrative burden.

 provide a centralized point of control to write and enforce access policies, resulting in a 73% reduction in time to employee data access and an 86% reduction in time spent on access policies. 

 provides tools to author policies in plain-language and mask data dynamically, powered by 

While the finer details of Single Sign-On (SSO) and Identity Providers (IdPs) are beyond the scope of this report, it’s worth noting that access controls only work if apps support standards like 

 has built a suite of automations that bring these non-standard applications under the umbrella of proper access control.

While data breaches may provoke the thought of 

, many breaches occur due to company employees, and 75% of those insider breaches are actually 

 Insider Threat Detection seeks to make use of contextualized user analytics to detect these risks, and stop data leaks before they occur. 

 looks to do just that, with a deep focus on behavioral science and the use of LLMs to automate the investigation of insider risk.

Like Insider Threat Detection, DSPM is a monitoring and analytics tool, but is focused on the company’s total data security posture. DSPM vendors are generally uniform in their ability to perform data discovery and classification, provide visibility into data access and alert risky behaviors, as well as identify whether data has been appropriately encrypted and access controlled. The risk monitoring capabilities of DSPM have attracted significant investment in the space, including 

When data breaches occur, companies need a way to resume operations. One way is to keep backups that are 

 from your operations. Backups can’t protect companies from much of the significant costs of a data breach, and resuming operations may not be seamless, but the ability to return to operations in a doomsday scenario is paramount. Companies like 

 provide the ability to automate backups to an append-only, air-gapped database, while also providing valuable attack detection analytics.

PPTs refer to a suite of technologies that ensure data privacy and security in AI/ML systems. For example, confidential computing creates a hardware-isolated enclave which protects the security of infrastructure and data being executed on. 

 is protecting LLM users from prompt injection and sensitive data leaks, while offering an easy-to-integrate approach that has detected 100mn+ real-world vulnerabilities. 

’s federated compute gateway allows users to collaborate on machine learning projects from different regions in a secure and compliant way, while 

 deploys any LLM interface into an enterprise’s on-premises environment, so companies can leverage all of their existing security infrastructure with AI.

Best-of-breed or a platform? It’s an age-old question and as always, there are arguments for each. In an area with significant complexity like data security, there is a lot of room for best-of-breed players to build features that platform players don’t have the focus to match. However, our view is that to fight issues like data siloes, lack of visibility and inconsistent policies, consolidating on a platform makes the most sense. Companies like 

 are building out suites that cover the entire data security value chain. 

 Data Command Center operates across security, privacy, governance, and compliance. With a unified data discovery and classification engine, teams across all four domains can be powered by a common data model, boasting best-in-class accuracy rates and value-add tools like LLM security.

For too long, Data Security has been some combination of a budget afterthought or too difficult to get right. Now, companies are in crisis with a data breach cadence that measures 

As teams race to implement AI, these issues just get worse. It’s time for security teams to invert the stack, making data security the first thought and the fundamental building block of their cybersecurity stack.

The information contained herein is provided for informational purposes only and should not be construed as investment advice. The opinions, views, forecasts, performance, estimates, etc. expressed herein are subject to change without notice. Certain statements contained herein reflect the subjective views and opinions of Activant. Past performance is not indicative of future results. No representation is made that any investment will or is likely to achieve its objectives. All investments involve risk and may result in loss. This newsletter does not constitute an offer to sell or a solicitation of an offer to buy any security. Activant does not provide tax or legal advice and you are encouraged to seek the advice of a tax or legal professional regarding your individual circumstances.

This content may not under any circumstances be relied upon when making a decision to invest in any fund or investment, including those managed by Activant. Certain information contained in here has been obtained from third-party sources, including from portfolio companies of funds managed by Activant. While taken from sources believed to be reliable, Activant has not independently verified such information and makes no representations about the current or enduring accuracy of the information or its appropriateness for a given situation.

Activant does not solicit or make its services available to the public. The content provided herein may include information regarding past and/or present portfolio companies or investments managed by Activant, its affiliates and/or personnel. References to specific companies are for illustrative purposes only and do not necessarily reflect Activant investments. It should not be assumed that investments made in the future will have similar characteristics. Please see “full list of investments” at https://activantcapital.com/companies/ for a full list of investments. Any portfolio companies discussed herein should not be assumed to have been profitable. Certain information herein constitutes “forward-looking statements.” All forward-looking statements represent only the intent and belief of Activant as of the date such statements were made. None of Activant or any of its affiliates (i) assumes any responsibility for the accuracy and completeness of any forward-looking statements or (ii) undertakes any obligation to disseminate any updates or revisions to any forward-looking statement contained herein to reflect any change in their expectation with regard thereto or any change in events, conditions or circumstances on which any such statement is based. Due to various risks and uncertainties, actual events or results may differ materially from those reflected or contemplated in such forward-looking statements.

Join us for our
Genesis Summit!

Office

Nina
Matthews

Research Analyst

Office

Research

Relevant Experiences

Join us for our Genesis Summit!

Office

Nina Matthews

Research Analyst

Office

Research

Relevant Experiences

Join us for our
Genesis Summit!

Nina
Matthews