Every venture firm tells the same story about exits. The plan is an IPO, or a strategic sale at the top of the market, and nobody admits to watching the door until it is time to walk through it. Stephen Ward, co-founder of Brightmind Partners, skips the story entirely. "You have to sell on the way up," he says.
That single line explains a good deal about what Ward is building. Two years after founding a New York cybersecurity fund, and about a year after closing a $250 million debut, he is back in the market raising a second vehicle of roughly the same size. The difference this time is structural: co-founder Gur Talpaz and early colleague Tayler Sipperly left in April, leaving Ward as Brightmind's sole general partner. He is raising the next fund alone, on his own track record, at a moment when the economics of early-stage security investing are shifting in ways that reward conviction and punish sprawl.
A resume that does not look like a venture resume
Ward grew up in northwest New Jersey between two farms, in a family that could not afford college for his older brothers. After high school he joined the Coast Guard, drawn in by a television commercial of a man jumping out of a helicopter, despite barely knowing how to swim at the time. He spent four years in search and rescue.
He then studied criminal justice at Seton Hall, half-heartedly considering law school, and graduated in 1998 without a clear plan. He mailed out roughly 300 resumes and heard nothing back. What moved him forward was a Seton Hall professor who also served as a chaplain to Secret Service personnel, and to members of the FBI and CIA. The professor made introductions, and the Secret Service called first.
The agency has two missions: protection and financial crime investigation. Ward gravitated toward investigations, and after the September 11 attacks in 2001 he moved into cyber work, at a time when the Secret Service was still learning what computer crime even looked like. He was based in New Jersey, standing protection shifts between cases, when a file of blurry ATM photos landed in front of him: a man cashing out across the tri-state area with dozens of debit cards that carried legitimate account numbers and PINs.
The hacker, the informant, and eighteen months of suspicion
The arrest that followed became one of the defining episodes of Ward's career, and eventually an eight-episode Audible podcast called Operation Firewall. The short version: Ward arrested a hacker responsible for the largest credit card data theft of that era. Rather than charge him, Ward flipped him, turning him into an informant and running him for about three years against Shadowcrew, a global cybercrime network trading in stolen card data.
The arrangement worked, and then it did not. The informant kept hacking behind Ward's back. When he was caught again, he told investigators, as a diversion, that Ward was in on it. By then Ward had already left for the private sector, which meant he spent roughly 18 months clearing his name while starting a corporate job, unaware for part of that stretch that he was still under investigation. He has described the period as being hard to get out of bed for, and the investigation as feeling like a spouse cheating on you, given how much he loved the agency. The hacker ultimately received a 20-year sentence.
It is tempting to treat that story as color. It is more useful as an origin story for an investor's temperament. Running an informant is a long exercise in judging whether someone's incentives match their words, and in accepting that a relationship can be simultaneously productive and unreliable. Ward came out of it with a durable skepticism about narratives, including his own, and with the experience of being on the wrong side of an institutional process he could not control.
From CISO to check writer
Ward's private-sector career started in 2007 at J.P. Morgan, which recruited him to build a cybersecurity unit. He calls it the hardest transition of his career, describing himself as the dumbest person in the room and admitting he twice considered going back to government. He stayed, and now refers to the bank as the best management school he attended. Six years as CISO at TIAA followed, then two years at Home Depot starting in 2019.
In 2021, burned out, he quit with nothing lined up, for the first time since he was 16. The gap did not last. The founders of Wiz, whose software he had used at Home Depot, put him on a shortlist for a role at their company. Jeff Horing of Insight Partners, which had co-led Wiz's $100 million Series A in late 2020, interviewed Ward for that job and offered him a position at Insight instead.
He spent three years at the firm, working on Wiz, Abnormal Security, and Elisity. Wiz was later acquired by Google for $32 billion, and IonQ agreed to buy Elisity for up to $1.3 billion. Ward notes without apparent bitterness that the friend who took the Wiz job made life-changing money. At 49, he decided to try building something of his own, despite being told repeatedly that venture capital is a young man's game. He started cold-emailing limited partners. Fewer than 20 LPs ultimately filled the debut fund, Horing among them.
Building a firm around a thesis about timing
Brightmind launched in 2024 with Talpaz, a CrowdStrike corporate development executive whose deals had overlapped with Ward's at Insight, and Sipperly, another CrowdStrike corporate development alum, as the third employee. The debut fund closed at $250 million late last year and has made 14 investments to date.
The proof point is SGNL, an identity security startup. Brightmind led its $30 million Series A in February 2025, reportedly at a valuation around $105 million. In January 2026, eleven months after that round, CrowdStrike agreed to acquire the company for a reported $740 million. It is a remarkable outcome by any early-stage standard, and the kind of single data point that both justifies a second fund and invites scrutiny of whether the pattern repeats.
The partnership itself did not survive the win. Talpaz and Sipperly departed in April, with Ward citing differences of opinion about operations and the future of the firm in carefully worded language. By August they had co-founded a new venture firm, Cognition, with Elia Zaitsev, CrowdStrike's global CTO for the previous three years. Cognition is reportedly targeting a $170 million first fund for cybersecurity startups. Two firms, one shared origin, competing for the same founders and much of the same LP base.
Sell on the way up
Some investors asked why Brightmind did not hold SGNL longer. Ward's answer is the most interesting thing about his investment philosophy, because it is a claim about market structure rather than about any individual company. In cybersecurity, he argues, the best sales window for a startup falls between its third and seventh years. After that, the strategic landscape that made the company acquirable starts to move.
To act on that, Brightmind tracks security acquisitions systematically, along with what large buyers are building versus buying. The reasoning is that cybersecurity M&A behaves like a chain of competitive reactions. If Palo Alto Networks is likely to buy something, CrowdStrike feels the pressure, and then Zscaler looks over to see what just happened and considers a matching move. A startup's acquirability is therefore a function of where it sits in that chain, not just how good the product is.
The fit analysis cuts both ways. CrowdStrike is unlikely to buy a portfolio company building something it is already building. Palo Alto Networks might love a company but decline the deal if the acquisition would force its installed base to migrate away from something it bought five years earlier. Ward's summary of the exercise is blunt: it is very easy to call something a good match or a terrible match in hindsight, and figuring out which one it actually is takes most of the firm's time.
There is real risk in the sell-early discipline. Selling a winner at $740 million means forgoing the possibility that it becomes a $7 billion company. But the reverse risk is worse for a small fund with concentrated positions: strategic buyers change priorities, budgets tighten, and a company that was acquirable in year four can be unsellable in year seven. Ward's approach treats exits as an operational discipline rather than an admission of defeat, which is closer to how corporate development teams actually think than most venture messaging admits.
The market Ward is raising into
The backdrop makes the timing legible. According to PitchBook, early-stage cybersecurity startups raised more than later-stage rivals for the first time in more than a decade, with $4.7 billion in seed-through-Series B deals through September 2026, already ahead of the full total for 2025. The number of deals fell to 248 from 358, which means fewer companies raised larger rounds. The average cybersecurity seed round rose to $8.4 million in the first nine months of 2026, up from $5.54 million a year earlier.
That combination, fewer deals and bigger checks, describes a market where capital is concentrating around teams that investors already believe in. It is a favorable environment for a fund that leads rounds and takes real ownership, and a difficult one for a fund that spreads small checks across many companies. It also raises the bar for sourcing: if the good companies are fewer and better funded, missing them costs more than it used to.
The AI security question
Ward is openly skeptical about how much of the money labeled AI security is actually AI security. PitchBook classified 278 deals in the first half of 2026 as AI security. Brightmind's manual review found roughly 30 that qualified as true examples. The gap is not a knock on PitchBook, which applies consistent categories across a huge dataset, so much as an illustration of how loosely the label gets applied by founders and investors looking for a narrative.
His view of the large model developers is similarly measured. He does not expect Anthropic or OpenAI to take over the security world, but rather to do just enough to satisfy their enterprise customers, leaving room for specialists. For what he calls zero second protection, meaning detection and response fast enough to act in real time, he favors cybersecurity-specific models running locally on the customer's own systems, pointing to companies such as Empirical Security as an example of the approach.
He also looks for startups positioned to displace incumbents he considers vulnerable, naming 27-year-old Qualys and 24-year-old Tenable. The argument is structural: security platforms built for an era of periodic scanning and static infrastructure carry architectural assumptions that become liabilities once workloads, identities, and now agents change continuously.
The second fund will not be purely cybersecurity. About 20 percent is earmarked for AI infrastructure deals, a deliberate widening given how much of the security stack now depends on where models run and how they are served. Ward also expects a meaningful share of teams to come from Israel; roughly 40 percent of the debut fund's startups were based in Tel Aviv.
Five people and a lot of agents
Brightmind is a five-person firm, which is unusual for a $250 million vehicle and clearly intentional. COO Iva Messy, another Seton Hall graduate, came from Felicis and Andreessen Horowitz, on the recommendation of Ward's cousin, former Workday CEO Carl Eschenbach. Sven Wollschlaeger, who spent three years alongside Ward at Insight, is a principal. Taylor Cleveland, Ward's chief of staff at Home Depot, joined recently. CTO Jamie Mneimneh, whom Ward first hired at Home Depot as a distinguished engineer, built the AWS environment the firm uses to test products and the AI agents that now source most of Brightmind's deal flow.
That last detail is the most consequential. By automating top-of-funnel sourcing, the firm avoids hiring a bench of analysts and keeps management fees down, a structural advantage for a fund of this size. The trade-off is the obvious one: automated sourcing scales discovery, not judgment. The diligence, the fit analysis against incumbent roadmaps, and the decision to sell on the way up all remain human work, done by a very small team.
As for the founders he is most comfortable backing, the answer comes without hesitation: second-time founders who stick together. It is a preference consistent with everything else about the firm, which is built around repeatability rather than debut narratives.
What to watch
The obvious question about Brightmind's second fund is concentration. A sole general partner running a $250 million vehicle is a key-person structure, and the departure of two founders within two years of launch is the kind of event LPs model carefully. Ward's answer is a track record with one significant exit and 13 other bets still unresolved, plus a thesis about exit timing that is falsifiable and specific, which is more than most funds offer at this stage.
The second question is competition. Cognition, staffed by his former partners and a sitting big-company CTO, is chasing the same founders with a thesis built around agentic AI. That is a genuinely different pitch, and it may pull deal flow in a direction Brightmind does not cover.
The third question is the market itself. Early-stage security rounds are getting larger while deal counts shrink, which favors established managers and punishes hesitation. Ward spent his career making consequential decisions under incomplete information: running an informant, clearing his name, leaving a comfortable CISO seat, cold-emailing LPs at 49. Raising a second fund alone is a smaller leap than any of those, and it rests on a simple, unfashionable proposition: in cybersecurity, timing the sale matters as much as picking the winner.