Cybersecurity funding grew about 28% in Q3 once Keyfactor's $1 billion round is removed
Cybersecurity startups raised $6.8 billion in Q3 2026, up about 50% on the prior quarter, according to Crunchbase data. At least 18 AI-linked companies raised $100 million or more while round counts fell at every stage.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+20
- Incentives
- Not scored
- Confidence60
FakeGit's operator re-aimed more than 13,000 existing GitHub repositories at the SmartLoader malware in 34 hours, Apiiro found. At least 700 of the accounts involved appear to belong to legitimate developers, so a credible-looking owner is weak evidence that a download is safe.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+10
- Incentives45
- Confidence60
Island traced fake ChatGPT, Gemini, Claude and Perplexity ad tools to a phishing operation whose Telegram channel took hundreds of victim submissions. Its targets are agency buyers and admins, whose one login can spend several advertisers' balances.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+15
- Incentives40
- Confidence60
OpenAI learned roughly two months after the fact that its agents had entered an Australian government service holding Medicare data, Cryptopolitan says. So far the money is going to cybersecurity vendors, whose shares in one Goldman Sachs basket have roughly doubled since April.
Perspective Coverage
19 publishers
- Builder
- Builder 30%
- Operator
- Operator 46%
- Investor
- Investor 24%
Reality
- Evidence78
- Adoption
- Not scored
- Hype gap+22
- Incentives60
- Confidence72
Island raised $400 million at a $6.4 billion valuation, about 32 times the roughly $200 million in revenue Calcalist reported. Since the March 2025 round the price has risen by a third while sales doubled, so each dollar of revenue now costs investors less than it did.
Perspective Coverage
3 publishers
- Builder
- Builder 28%
- Operator
- Operator 28%
- Investor
- Investor 44%
Reality
- Evidence55
- Adoption50
- Hype gap+20
- Incentives65
- Confidence60
NovaCookies rents real-time Microsoft 365 session theft for $320 a month
Island says the adversary-in-the-middle service runs on at least 755 domains against hundreds of organizations. The session it steals arrives after an authentication the identity provider records as entirely normal.
Reality
- Evidence45
- Adoption58
- Hype gap+18
- Incentives65
- Confidence55
Island's MCP scan flags instruction-manipulation signals in 1,108 of 33,563 builds
Island scanned 475,865 tools across 33,563 MCP server builds in July 2026 and found manipulation signals in 3.3% of them. Its researcher says a scan can confirm the capability is there without seeing what will actually run.
Reality
- Evidence45
- Adoption30
- Hype gap+30
- Incentives70
- Confidence50
buildOne report1 publisher NovaCookies turns an MFA approval into a live Microsoft 365 session for $320
Island's write-up describes an adversary-in-the-middle proxy that hands passwords, push approvals and SMS codes to real Microsoft servers, then keeps the cookie Microsoft issues. Origin binding is the only listed control that breaks it.
Reality
- Evidence48
- Adoption40
- Hype gap+18
- Incentives66
- Confidence47
Island says the kit relays Microsoft 365 sign-ins behind genuine Docusign envelopes and legitimate Microsoft or Google redirects, leaving sender reputation nothing to grade.
Reality
- Evidence60
- Adoption58
- Hype gap+18
- Incentives74
- Confidence62