Stephen Ward, co-founder of Brightmind Partners, is preparing to raise a second cybersecurity fund targeting around $250 million — roughly matching the $250 million first fund he closed late last year. This marks a significant move in the investment world’s shift toward earlier‐stage cybersecurity funding. Ward is now the firm’s sole general partner, after co-founder Gur Talpaz departed in April. Brightmind has so far backed 14 startups and already scored a major exit: SGNL, acquired by CrowdStrike for $740 million just 11 months after Brightmind led its Series A.
From Secret Service to Cyber Venture Capitalist
Ward’s image as an investor breaks the usual mold. He spent nine years in the U.S. Secret Service, then served as Chief Information Security Officer at TIAA and Home Depot. One of his defining moments during government work involved arresting a hacker responsible for a major credit card data breach. Rather than prosecute immediately, he flipped the hacker as an informant, running him for years, though that arrangement later led to accusations against Ward himself — which he spent about 18 months clearing. The hacker was eventually sentenced to 20 years in prison, and the story went on to become a podcast series titled “Operation Firewall.”
Brightmind’s Strategy and Emerging Trends
Ward started Brightmind in 2024 with Talpaz, who himself moved on earlier this year to form a separate venture firm called Cognition. Even in that turbulence, Brightmind has demonstrated early success, particularly the SGNL deal. Ward emphasizes that in cybersecurity, the biggest returns tend to come between years three to seven — and that investors must know when to encourage founders to “sell on the way up,” rather than waiting for an IPO forever.
The investment landscape itself is tilting toward early‐stage cybersecurity funding. Through September, seed through Series B deals in the sector had already surpassed the total for all of 2025. Cyber seed rounds spiked too; average sizes went from about $5.5 million last year to $8.4 million year-to-date. Yet Ward questions how much of the recent enthusiasm is being poured into what he considers real AI security; his own diligence found far fewer true “AI security” startups than headline data suggested. He’s also exploring cybersecurity-specific models running on clients’ systems to deliver immediate protection, rather than broadly sweeping AI solutions.
In his second fund, Ward plans to maintain roughly the same fund size, with about 20 percent aimed at AI infrastructure. He expects a large portion of the portfolio to come from Israel — Brightmind’s first fund has nearly 40 percent of its startups based in Tel Aviv. His internal team now includes a COO, a principal with a history at Insight Partners, a CTO who developed Brightmind’s AI deal sourcing agents, and a chief of staff recently transitioned from Home Depot.
Ward says his drive is rooted in the humility and urgency of his upbringing. Growing up in rural northwest New Jersey without financial privilege, he views venture capital as a responsibility. He told investors Brightmind needs to deliver a “3× net fund,” something he won’t accept anything less of before celebrating.
Why This Matters
This development is more than another large fund in cybersecurity. It signals a turning point: early-stage players are now drawing more capital than later-stage firms — a reversal of recent trends. The rise of seed and Series A rounds, coupled with sharper scrutiny over what qualifies as AI security, suggests the market may be entering a phase of greater discipline and specialization. For entrepreneurs, it reinforces that investors want more than buzzwords; they want substance — strong product-market fit, defensible tech, and timing. For investors, it’s a reminder that due diligence, exit timing, and portfolio strategy matter more than ever in a crowded, fast-growing field.
