I generally ignore funding announcements. Every week, I get a dozen press releases celebrating massive rounds, oversubscribed rounds, strategic rounds, stealth rounds—pick your adjective. Most of them feel like self-congratulatory fluff, or half-hearted victory laps dressed up as news. And there’s an unmistakable subtext running through many of them: a polite kiss-the-ring acknowledgment of the investors combined with a little name-dropping to boost credibility.
That’s all fine, but it doesn’t tell me anything useful. Funding isn’t the story. The problem you solve is the story. Why your solution is more innovative, or more cost-effective, or more aligned with where the market is going—that’s what actually matters. If you can’t articulate why anyone should care beyond “we raised money,” then I’m not sure even you know why the company exists.
Most funding updates skip right past that part. But once in a while, a story crosses my radar that reflects something deeper happening in the market—something that says more about the state of cybersecurity and the structural challenges founders face than the capital itself.
Holly Ventures is one of those stories.
But before getting to that case study, it’s worth stepping back to look at the broader issue: the early-stage funding model in cybersecurity is increasingly misaligned with what founders actually need.
The Early-Stage Mismatch
Venture capital has spent the last decade racing toward scale. Larger funds. Larger rounds. Larger expectations for how quickly a young company should grow. In many parts of the tech ecosystem, that structure delivers exactly what it promises. But cybersecurity has always moved differently, and the mismatch between what early-stage founders need and what the traditional VC model provides keeps getting more obvious.
Capital is no longer the scarce resource. Attention is. Access is. The kind of early guidance that helps a technical founding team translate a sharp idea into a product someone will actually buy is often buried beneath the machinery of big funds that have to deploy fast to justify their size.
Cyber startups don’t fail because they couldn’t raise enough to hire a sales team. They fail because they couldn’t get meaningful early customer feedback. Or because their first ten design partners didn’t stick. Or because no one wanted to take a risk on something new without a clear Gartner category to slot it into. Those aren’t problems you solve with a bigger seed round. They’re problems you solve by getting the right people involved early, in the right way.
Access, Not Capital, Is the New Constraint
That’s where the tension sits today. Large venture platforms are built to lead big rounds, move quickly, and push companies into growth trajectories that make sense for the fund, not necessarily for the product’s reality on the ground. Smaller funds can provide focus and hands-on involvement, but often lack the network density to help a startup find its first referenceable customer or its first few hires.
The gap has opened the door for alternative funding models: solo GPs, micro-funds, operator-led vehicles, and more flexible co-invest structures. These models try to rebalance something that has tilted too far toward scale and away from fit. In cybersecurity, the need feels sharper because founders are navigating a market overloaded with AI-themed pitches and vapor claims.
John Brennan, founder and managing partner at Holly Ventures, explained why that early proximity matters so much. His philosophy is simple and grounded: build trust first, then deliver the hard truths that actually move a company forward. As he put it, “You need to actually earn the trust and credibility with founders first. So, yes, I can be blunt, and yes, I can deliver feedback which sometimes is harsh, but until founders know that I’m doing that for their betterment and the betterment of the company, it could just be me being a jerk.”
That insight is at the heart of what’s missing in the traditional model. Cyber founders don’t need more capital. They need someone willing to invest time, reputation, and relationships at the most vulnerable stage of the journey.
Holly Ventures as a Case Study in the Shift
Brennan’s new fund, Holly Ventures, is a response to the structural issues that plague early cyber startups. It’s a deliberately small $33 million seed fund designed to sit alongside — not compete with — the top investors in cybersecurity. Instead of trying to lead every deal or deploy massive checks, Brennan structured Holly around early operational help, founder-level engagement, and access to a dense network of CISOs and investors.
The decision wasn’t about raising a fund. It was about correcting for what founders actually need at Day Zero: relationships, validation, and honest feedback long before scaling makes sense.
Brennan’s goal was not to recreate a large platform model; it was to remain flexible enough to work with every major investor in the ecosystem. As he put it, “I wanted to make sure that I still have the ability, even though I wasn’t investing out of a larger fund that was leading deals, I still wanted to make sure that I could work with the best founders.”
Holly Ventures doesn’t solve every problem in the market, but it captures a broader trend: smaller, more adaptable funding structures built around the realities of cybersecurity innovation rather than the needs of venture fund mechanics.
A Market Leaning Toward Fit, Not Flash
The cybersecurity funding ecosystem isn’t broken, but it’s strained. Too many early-stage teams are trying to mold themselves into investor expectations that were built for very different kinds of businesses. And too many investors are stuck in structures that limit their ability to give founders the early attention they need.
The next evolution of cyber investing won’t be driven by who raises the biggest fund or who generates the loudest AI narrative. It will be driven by investors who prioritize fit over flash — the ones who recognize that capital is abundant, but alignment is scarce.
