Cyberhaven

• Microsoft could deepen Purview data classification inside Microsoft 365 tenants until buyers treat Cyberhaven as redundant rather than additive.
• The data lineage advantage runs per tenant and carries no independent public benchmark, so buyers have no outside measure of how far ahead it is.
• The December 2024 Chrome extension compromise could resurface in procurement and slow deals with security-sensitive buyers.
• A $1 billion valuation set in April 2025 could outrun revenue growth and pressure a future round if enterprise traction does not scale.
• The recent CEO transition could shift go-to-market strategy mid-stride during the enterprise sales build.
• Varonis sells a comparable unified data security platform to the same regulated buyers, compressing the window to win accounts.

Sensitive data sprawls across endpoints, cloud apps, and AI tools faster than legacy controls can track it, and content-pattern detection generates noise while missing real exfiltration. The Motorola case study makes that pain concrete, describing prior tools that produced false positives and could not stop product designs leaking to competitors.

Data security posture management, data loss prevention, and insider risk are recognized security categories, and the move of corporate data into AI tools gives buyers a fresh reason to revisit controls. The market is crowded, with incumbents and a hyperscaler-bundled option competing for the same spend. [s3, s9, s5]

The product traces data lineage from origin through every copy and transformation, then classifies data by where it came from and blocks exfiltration on that origin rather than on content alone. Cyberhaven describes the lineage technology as available only from it, the foundation the rest of the platform shares.

On top of the lineage graph, the Linea AI detection agent applies proprietary Large Lineage Models to flag risky activity, and an analyst agent runs investigations and produces reports. The Motorola deployment reports a 90 percent reduction in false positives and a 98 percent reduction in investigation time, customer-supplied results on a vendor page rather than an independent benchmark. [s2, s3, s1]

Cyberhaven differentiates on data lineage, positioning origin-aware tracing as more accurate than the content classification that traditional data loss prevention relies on. One engine spanning posture management, data loss prevention, insider risk, and AI security lets it contest several categories at once.

The position is exposed on two flanks. Other data-security platforms contest the same enterprise buyers, and data-classification controls bundled into the cloud suites those buyers already run press on the same budget, so Cyberhaven has to keep its accuracy lead visible to justify a separate purchase. [s2, s1, s9]

Named enterprise references now carry independent corroboration. BleepingComputer separately lists Snowflake, Motorola, Canon, Reddit, and the law firms Cooley and Kirkland & Ellis among Cyberhaven customers, beyond the case studies and testimonials the company publishes itself.

The funding outpaces disclosed revenue. The April 2025 Series D raised $100 million at a $1 billion valuation and brought the total raised to $250 million, backed by StepStone, Schroders, and Industry Ventures, a capital base sized for a large sales build whose revenue is not public. [s8, s4, s11]

Cyberhaven was founded by five PhD students, and Volodymyr Kuznetsov is chief technology officer.

Commercial leadership has changed at the top. Howard Ting led Cyberhaven as chief executive at the April 2025 Series D, and the chief executive seat has since passed to Nishant Doshi. [s6, s7, s10]

Cyberhaven's own security is the part a buyer will probe hardest. In December 2024 attackers phished an administrator account and pushed a malicious version of the company's Chrome extension built to exfiltrate user sessions and cookies, and researchers at Sekoia and Secure Annex tied the breach to a wider supply-chain campaign that touched dozens of extensions and millions of users.

The response was fast and documented, with the malicious version removed within an hour of detection and public technical writeups. Cyberhaven also links a Trust Center listing certifications such as SOC 2 Type 2 and ISO/IEC 27001. For a vendor selling control over where data goes, the 2024 incident is the question a security-sensitive buyer will raise in procurement, weighed against that response. [s8, s14, s15, s12, s16]

Add analyzed competitors to compare them side by side with Cyberhaven.

Cyberhaven sells to security teams at large, often regulated enterprises that need to know where sensitive data lives and stop it from leaving. Independent reporting names buyers including Snowflake, Motorola, Cooley, and Kirkland & Ellis, so the buyer is a global enterprise protecting intellectual property and regulated records rather than a single application owner.

The segmentation rides one capability across several budget lines. The same data lineage engine serves data security posture management, data loss prevention, insider risk, and the newer AI security use case, which lets Cyberhaven enter an account through whichever pain a buyer feels first and expand into the others.

The platform classifies, traces, and protects data from one place. Data lineage follows information from its origin through copies and transformations, which lets Cyberhaven classify and block exfiltration based on where data came from rather than on content patterns alone.

Cyberhaven layers agentic AI on top of the lineage graph. The Linea AI detection agent applies proprietary Large Lineage Models to flag risky activity, and an analyst agent runs investigations and produces reports with next steps. The Motorola case study reports a 90 percent cut in false positives and a 98 percent cut in investigation time, customer-supplied results on a vendor page rather than an independent benchmark.

The AI security line points the same machinery at AI usage. It surfaces shadow AI, scores AI apps and agents for risk, monitors MCP servers and agent activity, and prevents data leaks to AI tools. Even there the controls act on the data rather than the model, so it extends data-flow protection into AI-agent observability rather than standing up a separate defense of the AI system.

A latent advantage Cyberhaven has not yet realized would aggregate the data-movement graphs and user-behavior telemetry it records across many customer estates into shared exfiltration-pattern benchmarks and cross-customer detection heuristics that no single tenant could derive from its own data alone, a position the public record does not yet evidence.

Go-to-market runs through a direct enterprise sales motion backed by public customer stories, and the customer base now carries outside corroboration. BleepingComputer separately names Snowflake, Motorola, Canon, Reddit, Cooley, and Kirkland & Ellis among Cyberhaven customers, evidence of references beyond the case studies the company publishes itself.

The motion is funded well ahead of disclosed revenue. The company raised a $100 million Series D in April 2025 at a $1 billion valuation, bringing the total raised to $250 million, and named StepStone, Schroders, and Industry Ventures as investors, capital the company said it would put toward aggressive go-to-market investment while its revenue stays undisclosed.

Cyberhaven does not publish a public rate card, consistent with a vendor selling negotiated subscriptions to large enterprises rather than self-serve plans. The unit it sells is platform coverage of an organization's data estate across endpoints and cloud applications.

The commercial implication is that a buyer scopes a platform purchase rather than a single tool. Because the four lines share one lineage engine, a team that adopts one can reduce the friction of expanding into the others.

The product is delivered as software the customer deploys and runs across endpoints and cloud applications. The Motorola story describes a quick rollout that gave immediate visibility, and the customer configures classification and response policy rather than operating a managed service.

The AI agents shift work from analysts to software but do not add a human accountability layer. The Linea detection and analyst agents automate detection and investigation, yet the delivered artifact is still a tool the customer operates rather than a service that accepts responsibility for the risk judgment.

Trust is the most exposed part of the story. In December 2024 attackers phished an administrator account and pushed a malicious version of the company's Chrome extension designed to exfiltrate user sessions and cookies, and researchers at Sekoia and Secure Annex tied the breach to a wider supply-chain campaign that touched dozens of extensions and millions of users.

Cyberhaven removed the malicious version within an hour of detection and published technical writeups, and it links a Trust Center listing certifications such as SOC 2 Type 2 and ISO/IEC 27001. For a vendor whose pitch is controlling where data goes, the 2024 incident is the question a regulated buyer will raise in procurement, weighed against that response.

Cyberhaven positions itself as one platform spanning data security posture management, data loss prevention, insider risk, and AI security, with data lineage as the shared foundation. The strategy is to make four data-security jobs run on one engine rather than as separate tools.

Outward, the platform watches data across endpoints, web, email, cloud apps, and removable media, and extends to AI tools as a new channel. Inward, standardizing this many data-security functions on one vendor concentrates reliance on Cyberhaven, the consolidation it sells and the single-vendor dependence a cautious buyer weighs.

Cyberhaven was founded by five PhD students, and Volodymyr Kuznetsov is chief technology officer.

The executive layer has changed at the top. Howard Ting led Cyberhaven as chief executive at the April 2025 Series D, and the chief executive seat has since passed to Nishant Doshi.