Most of the software inside big companies isn't really written by those companies, because modern apps are stitched together from thousands of open-source packages that anyone can update at any time. Socket just hit a $1 billion valuation by treating that as the security problem it is.

What Socket Actually Does

Socket scans every open-source package a developer pulls in, then watches for behavior that doesn't belong. If a package suddenly tries new network calls or activates only in certain environments, it gets blocked before it ships.

Founder Feross Aboukhadijeh started the company in 2020 after watching the same attack pattern hit project after project, where hackers don't break into a big company directly but instead poison a small package the company depends on.

Customers now include Figma, Brave, and Vercel, and the pitch lands easily because the attacks keep landing. Recent campaigns linked to North Korea hit the Axios developer tool, while the "Shai-Hulud" worm hijacked CI pipelines through compromised npm packages.

Cybersecurity has been one of the strongest corners of the market, and the spending pattern behind that strength shows up in our morning notes. Market Briefs breaks down which trends are worth your portfolio's attention - five minutes a day, plus a free investing masterclass when you join.

Why The Valuation Jumped

Socket has raised about $65 million in funding before this round, starting with a $20 million Series A in 2023 led by Andreessen Horowitz and followed by a $40 million Series B in 2024. Going from that base to a $1 billion valuation in roughly 18 months is not a normal pace.

Two things explain it.

• The first is the scale of the attack surface, since modern apps pull in tens of thousands of dependencies written by thousands of maintainers.
• The second is who's behind the recent attacks: when the attacker is a nation-state group, the customer list for defense gets a lot longer fast.

Socket has also been buying, picking up Coana in 2025 to add "reachability analysis," which flags which vulnerable code paths actually get used instead of dumping every theoretical risk on a security team.

Aboukhadijeh has described the recent wave bluntly: attackers are targeting the critical infrastructure of software development - source repos, CI/CD systems, package registries, and the publish tokens that bind it all together.

Worth Watching

Roughly 75 cybersecurity companies are now valued at $1 billion or more, up about 40% in two years, according to industry counts.

Software supply chain security used to be a niche category, and now it's a unicorn factory.

Want this kind of read on the market every weekday morning? Sign up for Market Briefs and get a free 45-minute investing masterclass thrown in.