Why We Invested in Act

Ancient Greece didn't get remembered for its scaffolding. It got remembered for its foundations. The columns, the proportions, the basic architectural principles that were so solid that people kept building on top of them for two thousand years.

That's the idea behind Act, and it's also the thesis behind our investment.

Over the last decade, cloud security built a lot of scaffolding. Visibility tools, posture dashboards, insight engines, all telling teams what's wrong with impressive precision. But scaffolding isn't a foundation. It doesn't hold weight on its own, and as AI-driven attacks accelerate, that gap has stopped being tolerable.

To secure the cloud going forward, we don't need another layer, we need to go back to the foundations, prevention, zero trust, security by design, and actually build them properly this time, with tools finally powerful enough to do it.

That's why we invested.

The problem with where cloud security stopped.

Today's cloud security stacks all suffer from the same pattern:

• Visibility without resolution - Most tools got remarkably good at surfacing what's broken. One of the greatest exits in security history was built on exactly that. But surfacing a problem and solving it are two different businesses, and most organizations are still doing the second one manually, alert by alert.
• Internal teams as the integration layer - When something needs fixing, it falls on already-stretched security and IT teams to chase it down, one insight at a time, with no guarantee the fix holds once the environment changes again.
• Reactive by default - Because prevention and zero trust have always been hard to implement at scale, most organizations quietly decided to be reactive instead. That was a defensible trade-off five years ago. It isn't anymore, not with attack paths that can be chained together and enumerated in seconds.

Act brings you resolution, not another layer of insight 

Act is built around what they call one-to-end resolution: instead of resolving each alert individually, you fix the underlying problem once, and it stays fixed as the environment evolves. 

In practical terms, this means security teams stop playing whack-a-mole with alerts and instead get environments that reach, and hold, a clean, principle-based baseline, weeks instead of years.

Why now

Three shifts make Act's timing right:

• The old trade-off is gone. Prevention and zero trust used to mean friction. AI has closed that gap, making it possible to implement first principles at a speed and scale that simply wasn't there before.
• Agents are moving into the cloud. The first wave of AI agents lived on the endpoint. The next wave lives in cloud infrastructure and production systems, and that changes what needs to be secured and how fast it needs to happen.
• CISOs are done chasing. After a year of conversations with security leaders, the sentiment is consistent: teams are exhausted by reactive posture management and are actively looking for a way back to durable, proactive security.

If the last decade of cloud security was about visibility, the next one is about resolution.

Why this team

Our conviction in Act starts with its founders and founding team. Take a look at Jonathan Langer, this is his second company with much of the same crew that built Medigate into one of the standout exits in healthcare security, so when they came to us with the seed of this idea, we already knew how they operate when things get hard. A few things stood out early:

• They've done the hard part before. Building a company from first principles to a real exit isn't theoretical for this team, they've lived it.
• They validated relentlessly. Before committing to Act's direction, the team ran an intense, months-long validation process, including deep, sequential conversations with dozens of CISOs in a single week.
• They're building infrastructure, not a feature. Act didn't start with a flashy interface and bolt on substance later. It started with the harder, less glamorous problem, actually resolving root causes, and built out from there.

As investors, we look for founders who are precise about the problem and relentless about execution. Jonathan and the Act team check both boxes, twice over.

At Team8, our security thesis has always centered on foundational, first-principles infrastructure, the kind of layer that other tools eventually have to build on top of. Act sits squarely in that thesis, and we believe it's positioned to define what proactive cloud security looks like for the next decade.

We're extremely proud to take part in this journey, and to watch what's becoming a real empire being built from the ground up.