Why cybersecurity remains our first conviction

Cybersecurity is Menlo’s first vertical: the one we invest in, and the one we operate in every day through Purcept and Mindlapse. This note explains why.

An existential problem, not a cost line

Digital security is no longer an IT budget line: it is a condition of survival. An organisation that loses control of its systems loses its customers, its reputation, sometimes its licence to operate. European regulation (NIS2, DORA, the Cyber Resilience Act) turns that reality into an obligation: cyber accountability now reaches executives and boards.

The consequence for an investor: demand is not cyclical. It is structural, driven by both the threat and the law.

Where we invest across the cyber spectrum

We look at the full spectrum (governance, detection, response, sovereignty) with a preference for:

• Governance connected to reality. Organisations are drowning in declarative frameworks. Tools that connect security policy to the actual state of the information system, what Mindlapse builds, replace a documentation industry with a data industry.
• Tooled-up detection and response. The cyber skills shortage is here to stay; products that multiply one analyst rather than require ten will win.
• Sovereignty. For a European company, hosting, encryption and the software supply chain are becoming commercial arguments, not just constraints.

The operator’s advantage

We do not discover this market in analyst reports. Purcept puts us in front of CISOs’ real problems every week: arbitrated budgets, stacked tools that do not talk to each other, audits that change nothing. Mindlapse teaches us what building a cyber product actually costs: trust is earned slowly, lost quickly, and audited.

It is our most reliable investment filter: when a team shows us a solution, we know whether the problem exists, who pays for it, and what has already failed.

What we look for

Technical founders who know their threat from the inside (former operators, analysts, pentesters, architects) building for an identified buyer, with a defensible advantage: proprietary data, distribution, or depth of integration. At pre-seed, with a long-term commitment.

Building in cyber? Let’s talk.