Aqua Security Startup Diligence Report
Proceed only to confirmatory diligence. A transaction or investment thesis for Aqua Security depends on proving durable revenue quality, retention, margin, customer quality, product defensibility, legal/regulatory posture, team stability and financing terms beyond public-list valuation evidence.
Aqua Security Startup Diligence Report
Aqua Security appears to be an eligible active private unicorn based on current public unicorn lists and active public product materials. Public evidence supports valuation/status, product presence and some customer or operating signals, but investment-grade diligence remains unresolved because financials, customer concentration, retention, contracts, legal/regulatory posture and cap-table economics are private.
Aqua Security's public valuation evidence comes from unicorn lists and historical funding signals; current valuation bridge, preferences and secondary marks are private.
Diligence request: Request full financing history, cap table, liquidation preferences, debt, option pool, 409A/valuation reports and recent secondary activity.
Audited financials, ARR, revenue quality, gross margin, cash, debt, burn, tax and forecast assumptions are not public.
Diligence request: Request audited financials, management accounts, ARR/revenue bridge, gross margin, cash/debt, tax positions, forecast model and board materials.
Public customer, user or activity signals do not disclose top-account revenue, renewal status, churn, NRR, pipeline conversion or customer satisfaction.
Diligence request: Request top-customer ARR, contract terms, renewal cohorts, churn/NRR, references and support escalations.
No public regulatory enforcement action was identified in the fetched sources; this does not substitute for legal docket and regulator checks.
Diligence request: Have counsel run docket/regulatory searches and review licenses, customer contracts, privacy/security artifacts, IP assignments and insurance.
The category includes strong competitors such as Wiz, Palo Alto Networks Prisma Cloud, Lacework, Sysdig, Snyk; public product claims do not prove win rates or pricing power.
Diligence request: Request win/loss analysis, pricing benchmarks, renewal concessions, competitive takeout evidence and product differentiation proof.
Roadmap, reliability, incident history, technical debt, architecture dependencies, data/security posture and R&D spend are not fully public.
Diligence request: Request product roadmap, architecture review, incident log, security reports, SDLC artifacts and dependency inventory.
Public leadership/headcount signals do not verify current org design, attrition, compensation, equity incentives or key-person dependencies.
Diligence request: Request org chart, HRIS export, attrition, comp plans, option grants, employment agreements and succession plan.
Public materials imply dependencies on Cloud providers and Kubernetes/container ecosystems, Open-source community and package registries, Enterprise identity / CI/CD integrations; concentration, terms and failure modes are private.
Diligence request: Request supplier contracts, SLAs, dependency maps, continuity plans and partner economics.
Aqua Security's public unicorn valuation is supported by CB Insights and a secondary unicorn list, but financial statements, retention, cash/debt, cap table and current valuation support are private.
partially verified confidence: medium
Annual and quarterly financial information for the past three years: public evidence is summarized in attached exhibits; unresolved private-data requests are listed below.
| metric | public signal | diligence request | verification status |
|---|---|---|---|
| ARR / revenue | Not disclosed in fetched public sources | Audited revenue, ARR bridge and revenue-recognition policy. | not_publicly_verifiable |
| Monetization surface | Public pricing page / sales-led | Realized pricing, discounts, gross margin and payback. | partially_verified |
| — | — | Confirm no IPO, acquisition, shutdown, material recapitalization or insolvency event. | partially_verified |
not publicly verifiable confidence: low
Financial Projections: public sources did not provide enough primary evidence to complete this checklist item; treat as a diligence request rather than an inferred finding.
partially verified confidence: medium
Capital Structure: public evidence is summarized in attached exhibits; unresolved private-data requests are listed below.
| stakeholder | public position | diligence caveat | verification status |
|---|---|---|---|
| Named public investors | TLV Partners, Lightspeed Venture Partners, M12 | Ownership percentage, preferences, pro rata rights and debt are private. | partially_verified |
| Founders / management | Michael Dube (Chief Executive Officer); Matthew Richards (Chief Operating Officer) | Founder ownership, vesting and employment terms are private. | partially_verified |
| Debt / warrants / option pool | Not disclosed in fetched public sources | Request debt instruments, option pool, warrants, safes/notes and off-balance-sheet liabilities. | not_publicly_verifiable |
partially verified confidence: medium
Other financial information: public evidence is summarized in attached exhibits; unresolved private-data requests are listed below.
| date | round or event | amount | valuation | participants or source | verification status |
|---|---|---|---|---|---|
| 2021-03-10 | Series E | US$135M | Valuation in excess of US$1B | ION Crossover Partners led; M12, Lightspeed, Insight, TLV, Greenspring and Acrew participated | partially_verified |
| 2021-03-10 | CB Insights unicorn list | Not disclosed | US$1B | CB Insights lists Aqua Security as a unicorn | partially_verified |
| 2021-03-10 | Wikipedia unicorn list | Not disclosed | US$1B+ | Wikipedia list includes Aqua Security | partially_verified |
Aqua Security publicly markets active products, but product-level economics, adoption, roadmap and reliability evidence require company records.
partially verified confidence: medium
Description of each product: public evidence is summarized in attached exhibits; unresolved private-data requests are listed below.
| product | audience | key features | source | verification status |
|---|---|---|---|---|
| Aqua CNAPP platform | Enterprise security teams | Code-to-cloud prevention, detection and response across build, infrastructure and runtime | SRC-003 | verified |
| Aqua Trivy / open-source tools | Developers and DevSecOps teams | Open-source vulnerability scanning and cloud-native security tooling | SRC-003 | verified |
| Kubernetes/container/runtime security | Platform and infrastructure teams | Container, Kubernetes, serverless, VM and multi-cloud workload protection | SRC-003 | verified |
| offer | public packaging | gap | verification status |
|---|---|---|---|
| Enterprise platform pricing | Public pricing page / sales-led | No public price points in fetched page; request quote and contract data | partially_verified |
| Open-source adoption | Trivy / community | Free open-source distribution supports product-led awareness but enterprise conversion is private | partially_verified |
| Private data request | ARR, ACV, discounting, renewal by module | Not publicly verifiable | not_publicly_verifiable |
Public customer or user signals exist for Aqua Security, but top customers, revenue concentration, contracts, churn and supplier dependencies are not publicly verifiable.
partially verified confidence: medium
Top customers by application: public evidence is summarized in attached exhibits; unresolved private-data requests are listed below.
| signal | public evidence | diligence caveat | verification status |
|---|---|---|---|
| Public enterprise count | 500 enterprises | Does not prove revenue, active paid cohorts, NRR or concentration. | partially_verified |
| Public customer/user categories | Government agency; Alma; GitLab; PPRO; bol.com; NCR; Bayad; Backpack Networks; Elvia | Named logos/categories require direct reference checks and contract validation. | partially_verified |
| Revenue concentration | Not disclosed in fetched public sources | Request top-customer ARR, cohorts and churn. | not_publicly_verifiable |
not publicly verifiable confidence: low
Strategic relationships: public sources did not provide enough primary evidence to complete this checklist item; treat as a diligence request rather than an inferred finding.
not publicly verifiable confidence: low
Revenue by customer: public sources did not provide enough primary evidence to complete this checklist item; treat as a diligence request rather than an inferred finding.
not publicly verifiable confidence: low
Significant relationships severed within the last two years: public sources did not provide enough primary evidence to complete this checklist item; treat as a diligence request rather than an inferred finding.
partially verified confidence: medium
Top suppliers: public evidence is summarized in attached exhibits; unresolved private-data requests are listed below.
| party or dependency | role | public evidence | risk or gap |
|---|---|---|---|
| M12; Lightspeed Venture Partners; Insight Partners | Investors/strategic ecosystem | Named in public investor/list or company sources | Economic rights and commercial terms are private. |
| Cloud providers and Kubernetes/container ecosystems | Operating dependency | Inferred from public product architecture | Supplier concentration, SLAs and business-continuity risk not public. |
| Open-source community and package registries; Enterprise identity / CI/CD integrations | Technical/commercial dependencies | Public product model implies dependency | Request contracts, SLAs, data processing and exit plans. |
Aqua Security operates in a competitive category; public sources are insufficient to verify pricing power, win rates, product differentiation or market share.
partially verified confidence: medium
Competitive landscape by market segment: public evidence is summarized in attached exhibits; unresolved private-data requests are listed below.
| competitor | product overlap | differentiator to test | source basis |
|---|---|---|---|
| Wiz | High | Validate win/loss, pricing, retention and product proof. | Analyst market map from public category context |
| Palo Alto Networks Prisma Cloud | High | Validate win/loss, pricing, retention and product proof. | Analyst market map from public category context |
| Lacework | High | Validate win/loss, pricing, retention and product proof. | Analyst market map from public category context |
| Sysdig | Medium | Validate win/loss, pricing, retention and product proof. | Analyst market map from public category context |
| Snyk | Medium | Validate win/loss, pricing, retention and product proof. | Analyst market map from public category context |
| axis |
|---|
| Product breadth |
| Pricing power |
| Trust/compliance |
| Distribution |
| Switching costs |
Competitive positions are analyst estimates from public category context.
Public channels show a viable GTM surface for Aqua Security, but CAC, payback, quota attainment, pipeline quality and channel revenue mix are private.
partially verified confidence: medium
Strategy and implementation: public evidence is summarized in attached exhibits; unresolved private-data requests are listed below.
| channel |
|---|
| Sales-led enterprise motion |
| Customer case studies |
| Open-source Trivy community |
| Cloud and DevSecOps ecosystem partnerships |
not publicly verifiable confidence: low
Major Customers: public sources did not provide enough primary evidence to complete this checklist item; treat as a diligence request rather than an inferred finding.
partially verified confidence: medium
Principal avenues for generating new business: public evidence is summarized in attached exhibits; unresolved private-data requests are listed below.
| signal |
|---|
| Owned product website |
| Customer/use-case content |
| Sales productivity |
not publicly verifiable confidence: low
Sales force productivity model: public sources did not provide enough primary evidence to complete this checklist item; treat as a diligence request rather than an inferred finding.
not publicly verifiable confidence: low
Ability to implement marketing plan with current and projected budgets: public sources did not provide enough primary evidence to complete this checklist item; treat as a diligence request rather than an inferred finding.
Public product surfaces indicate ongoing product/R&D activity, but R&D budget, roadmap timing, technical debt, incidents and security posture require private review.
partially verified confidence: medium
Description of R&D organization: public evidence is summarized in attached exhibits; unresolved private-data requests are listed below.
| item |
|---|
| Product / engineering roadmap |
| Technical leadership |
| R&D budget / technical debt |
partially verified confidence: medium
New Product Pipeline: public evidence is summarized in attached exhibits; unresolved private-data requests are listed below.
| project or area |
|---|
| Aqua CNAPP platform |
| Aqua Trivy / open-source tools |
| Kubernetes/container/runtime security |
Public leadership or headcount signals are incomplete; current org chart, attrition, compensation, incentives and management background diligence remain private.
not publicly verifiable confidence: low
Organization Chart: public sources did not provide enough primary evidence to complete this checklist item; treat as a diligence request rather than an inferred finding.
partially verified confidence: medium
Historical and projected headcount by function and location: public evidence is summarized in attached exhibits; unresolved private-data requests are listed below.
| function or region |
|---|
| Company-wide headcount |
| Turnover / departures |
| Compensation / equity |
partially verified confidence: medium
Senior management biographies: public evidence is summarized in attached exhibits; unresolved private-data requests are listed below.
| name |
|---|
| Michael Dube |
| Matthew Richards |
| Nir Makovski |
| Hadas Finkelman |
| Sean McGowan |
not publicly verifiable confidence: low
Compensation arrangements: public sources did not provide enough primary evidence to complete this checklist item; treat as a diligence request rather than an inferred finding.
not publicly verifiable confidence: low
Incentive stock plans: public sources did not provide enough primary evidence to complete this checklist item; treat as a diligence request rather than an inferred finding.
not publicly verifiable confidence: low
Significant employee relations problems, past or present: public sources did not provide enough primary evidence to complete this checklist item; treat as a diligence request rather than an inferred finding.
not publicly verifiable confidence: low
Personnel Turnover: public sources did not provide enough primary evidence to complete this checklist item; treat as a diligence request rather than an inferred finding.
Legal, regulatory, IP, insurance and material contract diligence for Aqua Security cannot be completed from public sources alone.
partially verified confidence: medium
Pending lawsuits against the Company: public evidence is summarized in attached exhibits; unresolved private-data requests are listed below.
| category |
|---|
| Pending lawsuits against company |
| Lawsuits initiated by company |
| Insurance / material contracts |
not publicly verifiable confidence: low
Pending lawsuits initiated by Company: public sources did not provide enough primary evidence to complete this checklist item; treat as a diligence request rather than an inferred finding.
not publicly verifiable confidence: low
Environmental and employee safety issues and liabilities: public sources did not provide enough primary evidence to complete this checklist item; treat as a diligence request rather than an inferred finding.
not publicly verifiable confidence: low
Material patents, copyrights, licenses, and trademarks: public sources did not provide enough primary evidence to complete this checklist item; treat as a diligence request rather than an inferred finding.
not publicly verifiable confidence: low
Insurance coverage and material exposures: public sources did not provide enough primary evidence to complete this checklist item; treat as a diligence request rather than an inferred finding.
not publicly verifiable confidence: low
Material contracts: public sources did not provide enough primary evidence to complete this checklist item; treat as a diligence request rather than an inferred finding.
partially verified confidence: medium
Regulatory agency problems: public evidence is summarized in attached exhibits; unresolved private-data requests are listed below.
| matter |
|---|
| Public lawsuit search result |
| IP / open-source |
| Security/privacy |
| ID | Claim | Status | Sources |
|---|---|---|---|
| EC-001 | Aqua Security appears on CB Insights as a private unicorn valued at US$1B. | verified high | SRC-001 |
| EC-002 | Aqua Security appears on Wikipedia's unicorn startup list. | partially verified medium | SRC-002 |
| EC-003 | Aqua Security publicly markets an active product platform. | verified medium | SRC-003 |
| EC-004 | Aqua Security has public monetization or packaging signals. | partially verified medium | SRC-005 |
| EC-005 | Aqua Security has public customer, user or market-side activity signals. | partially verified medium | SRC-006 |
| EC-006 | Aqua Security has public leadership or operating-company signals. | partially verified medium | SRC-004 |
| EC-007 | Aqua Security has public funding or investor signals but private financing terms remain undisclosed. | verified high | SRC-007SRC-001 |
| EC-008 | Audited financial statements, ARR, cash, debt and cohort metrics for Aqua Security were not public in fetched sources. | not publicly verifiable low | SRC-001SRC-003 |
| EC-009 | Aqua Security has legal, regulatory or IP diligence issues that require private records. | partially verified medium | SRC-003 |
| EC-010 | Aqua Security competes in a crowded category where public product claims do not prove defensibility. | inconclusive low | SRC-003 |
| EC-011 | Aqua Security's go-to-market channels are publicly visible but sales productivity is private. | partially verified medium | SRC-003 |
| EC-012 | Aqua Security's R&D and roadmap signals are public only at product-feature level. | partially verified medium | SRC-003 |
| ID | Publisher | Title | Accessed |
|---|---|---|---|
| SRC-001 | CB Insights | CB Insights Complete List Of Unicorn Companies | 2026-06-05 |
| SRC-002 | Wikipedia contributors | List of unicorn startup companies | 2026-06-05 |
| SRC-003 | Aqua Security | Aqua Cloud Native Application Security | 2026-06-05 |
| SRC-004 | Aqua Security | About Aqua Security | 2026-06-05 |
| SRC-005 | Aqua Security | Aqua Platform Pricing | 2026-06-05 |
| SRC-006 | Aqua Security | Aqua Customers | 2026-06-05 |
| SRC-007 | PR Newswire / Aqua Security | Aqua Security Announces $135 Million in Series E Funding at a $1 Billion Valuation | 2026-06-05 |
This report is a public-evidence diligence snapshot, not investment advice. Important financial, legal, technical, and contractual facts remain non-public and should be verified directly with management and primary documents before any investment decision.