ThreatLocker Raises $190M Series F to Expand Zero Trust Security

ThreatLocker has secured a $190M Series F led by Elephant, with continued support from D. E. Shaw Ventures and Arthur Ventures and a significant new investment from Koch Disruptive Technologies. Announced on July 29, 2026, the round will support AI security controls, continued development of the company's Zero Trust Platform, and international expansion beginning with a new office in Reading, United Kingdom.

The Orlando cybersecurity company reports that it now protects more than 70,000 organizations worldwide. ThreatLocker's platform applies a deny-by-default model across endpoints, networks, cloud systems, users, devices, and increasingly AI agents, allowing only explicitly trusted software and approved activity instead of waiting for detection tools to recognize a threat after it has entered the environment.

The investment represents a late-stage bet that prevention is becoming operational infrastructure. Cybersecurity teams do not need another ambitious control that requires its own rescue team. They need security controls that can be deployed, understood, and managed without turning protection into a second operational disruption.

What Happened

Elephant led the Series F after first investing in ThreatLocker's Series B in 2021. Returning investors D. E. Shaw Ventures and Arthur Ventures participated in the new round, while Koch Disruptive Technologies made a significant new investment. BofA Securities served as exclusive placement agent, and Latham & Watkins LLP acted as legal counsel.

The financing extends a publicly documented funding history that includes a $100M Series C in 2022 and a $115M Series D in 2024. ThreatLocker did not disclose a valuation or cumulative funding total alongside the Series F announcement, so neither can be reported confidently.

ThreatLocker says the capital will support existing controls for AI-related security risks, continued platform development, and international expansion. The company's first announced expansion is a new office in Reading, adding to existing operations in Orlando, Dublin, Dubai, and Brisbane while strengthening coverage across the United Kingdom and Europe.

Why This Matters Now

The broader cybersecurity landscape reinforces the timing. The 2026 Verizon Data Breach Investigations Report found that 31% of breaches originated from software vulnerabilities, 48% involved ransomware, and 15% of attack techniques were augmented by generative AI. Attackers continue to gain speed and scale while enterprise environments grow more complex with additional identities, devices, cloud services, and autonomous agents.

That combination strengthens the case for security controls that limit what can execute and what trusted software is permitted to access. Detection remains essential, but it is increasingly expected to recognize more behaviors across more systems at machine speed. Prevention reduces the number of potentially harmful actions that ever reach that detection layer.

The approach also aligns with the formal direction of Zero Trust. NIST SP 800-207 defines Zero Trust as removing implicit trust based on network location or asset ownership while requiring explicit authentication and authorization for every resource request. NIST's 2025 implementation guidance expands that framework further, documenting 19 reference architectures and moving Zero Trust beyond policy language toward practical engineering.

From Endpoint Control to an Operating Model

ThreatLocker began with application allowlisting, but the Series F thesis extends well beyond a single endpoint control. Allowlisting can prevent unauthorized software, AI tools, and AI-generated code from executing, while Ringfencing limits what approved applications and AI agents are allowed to access, modify, or interact with.

The broader platform adds Zero Trust Network Access and Zero Trust Cloud Access under the same control philosophy. Those capabilities extend protection to internal resources and SaaS applications, where stolen credentials and trusted sessions can otherwise create a false sense of security.

ThreatLocker also provides privileged access management, storage protection, data controls, configuration management, endpoint detection and response (EDR), and managed detection and response (MDR) through the same platform. The strategic objective is not that one dashboard eliminates cyber risk. It is that the company applies a consistent prevention philosophy across the environments where permissions, identities, applications, and AI agents increasingly intersect.

That distinction matters for managed service providers and internal security teams alike. A control can be technically rigorous and still fail in practice if daily exceptions, policy changes, and operational demands become unmanageable. ThreatLocker attributes its growth to making Zero Trust more practical to deploy and maintain, which is often the unglamorous work that separates sound architecture from expensive shelfware.

The Team Behind the Thesis

Danny Jenkins, Sami Jenkins, and John Carolan founded ThreatLocker in 2017 after witnessing the limitations of reactive cybersecurity defenses. Danny Jenkins serves as CEO, Sami Jenkins as COO, John Carolan leads Quality Assurance, and Michael Jenkins serves as CTO.

That leadership continuity provides a consistent strategic direction from application control to a broader Zero Trust platform. While the product portfolio has expanded, the central philosophy has remained the same: define what is permitted, constrain what trusted software can do, and deny everything else by default.

The investor group reinforces that continuity. Elephant remains the lead investor, Arthur Ventures and D. E. Shaw Ventures continue their support, and Koch Disruptive Technologies adds both strategic relationships and access to Koch Labs capabilities. Together, the syndicate combines long-term financial backing with new strategic resources to support the company's next stage of growth.

What the Series F Signals

ThreatLocker's $190M Series F signals that late-stage investors continue to see opportunity in prevention-first cybersecurity platforms, even in an increasingly competitive market. The opportunity extends beyond selling another endpoint product. It is about becoming the policy and control layer that governs applications, identities, devices, cloud services, and AI agents across an enterprise.

The challenge is execution. A broader platform introduces more integrations, policies, exceptions, and operational complexity, making simplicity just as important as coverage. ThreatLocker's reported base of more than 70,000 protected organizations suggests meaningful market adoption, but the next stage will be measured by whether broader control remains practical as deployments continue to scale.

For operators, that is the more valuable lesson from the financing. Deny-by-default succeeds only when the approved path remains efficient enough for the business to operate without friction, and prevention becomes sustainable only when security teams can manage it without becoming the next organizational bottleneck.