The median seed round in the US this year sits at roughly $3.1 million, and cybersecurity comes in around $3 to $4 million, according to Pitchwise’s July 2026 breakdown of median seed size by industry.
Ben Bernstein, Dima Stopel and John Morello raised $51 million.
That’s somewhere between thirteen and seventeen times the sector norm, handed over at the earliest possible stage. The context is that Palo Alto Networks bought their previous company, Twistlock, for approximately $410 million in cash, a figure confirmed in Palo Alto’s own SEC filing rather than just a press release. Twistlock had taken $63.1 million in venture money across its life, so investors saw roughly a 6.5x return on capital invested. The company that money eventually built, Minimus, sells hardened container images.
So the exit explains the appetite. What it doesn’t explain is what that money was for, why the product it funded no longer exists, or how you can check the team’s credentials yourself in about ninety seconds. Let’s take those in order.
What that $51M bought
Oversized seed rounds tend to look like ego until you stop reading them as a verdict on an idea and start reading them as a purchase of time.
Bernstein was fairly open about this when the round was announced. Speaking to TechCrunch in October 2023, he framed the size as deliberate: they wanted room to incubate the idea properly, knowing competitors would show up once the category got interesting. That’s a very different rationale from wanting a big headline.
The wider pattern backs him up. Carta data reported through Crunchbase in August 2026 shows that founders who had previously led a venture-backed company took more than half of all Seed and Series A capital in 2025, and 40% of round volume. Nor was this a cold pitch; YL Ventures, who co-led alongside Mayfield, had seeded Twistlock back in May 2015. Third time working together. Outsized security seeds have become a pattern in their own right; Europe’s largest cybersecurity seed went to NeuralTrust at $20 million, also on the back of a team investors already knew.
A $3 million seed requires you to be right immediately. A $51 million seed gives you permission to be wrong once and keep going, and that permission is the asset you’re really buying.
The product they binned
Which brings us to the strongest evidence in the whole story: the thing that didn’t work.
The round wasn’t raised for Minimus. It was raised for Gutsy, a company applying process mining to security operations. Gutsy is gone. The team scrapped it and re-emerged eighteen months later with something else entirely.
Funding coverage usually skims past a pivot as though it’s mildly awkward. Read it the other way and it becomes the only real test of whether the money was well placed, because it shows you what the founders did when their first answer came back wrong.
Stopel described the reasoning in an October 2025 interview: ‘It wasn’t interesting enough. And it doesn’t matter why. In a startup, if there’s no sales, nothing else matters.’ They cut the team from 50 people to 30, killed the MVP, went back into stealth for eight months and returned as Minimus at RSAC in April 2025. On the difference between the two products, he put it simply: at Gutsy, people said nice to have; with Minimus, they say we need this.
Doing that in public, after a round that size, takes a specific kind of steadiness. If you’ve ever sat on a product you knew wasn’t selling, you’ll recognise how rare it is.
Receipts you can check yourself
Now for the credential that made the round possible in the first place, and a small lesson in how to verify one.
NIST Special Publication 800-190, the Application Container Security Guide, was published on 25 September 2017. Open the PDF on NIST’s own publication server and the cover lists three authors: Murugiah Souppaya of NIST, Karen Scarfone of Scarfone Cybersecurity and John Morello, then CTO of Twistlock. This is the US government’s guidance on securing containers, co-written by someone now building container security products.
Morello is one of three named authors, so co-authored is the accurate word. Company press materials have described the team as the authors of NIST SP 800-190, which stretches it slightly. Small thing, but checking it is the point.
The rest of the paper trail holds up well:
- Twistlock served over 290 customers at acquisition, with more than a quarter of them in the Fortune 100, per Crunchbase News’ May 2019 coverage
- Minimus container images went live on Iron Bank, the US Department of Defense repository of signed hardened images, in July 2025
- The company reports passing 1,200 users within its first 90 days after launch, a company-supplied figure
When a founding team helped write the government’s own guidance on a problem and then spent a decade selling into it, what’s a first-time founder meant to put on the opposing slide?
The category caught up
The second bet got validated faster than any model would have predicted.
Chainguard, the closest comparison, has raised around $892 million in total, including a $356 million Series D at a $3.5 billion valuation in April 2025, reaching roughly $40 million ARR with more than 150 enterprise customers. Docker released its own hardened images free under Apache 2.0 in December 2025. Minimus removed the registration wall from its entire catalogue in June 2026 and shipped its Supply Chain Protection suite and minicli tool the same month.
Notice that the big seed and the free product are one decision seen from either end. You can only give the catalogue away if the capital already exists to make revenue a later conversation.
The cheque was for the judgment
Strip away the exit, the guidance document and the customer logos, and you’re left with a number from a peer-reviewed study.
Gompers, Kovner, Lerner and Scharfstein, examining more than 10,000 VC-backed companies for the Journal of Financial Economics, found that previously successful founders succeed again 30% of the time, against 18% for first-timers. Read it honestly and 30% still means most attempts don’t land. Track record buys you better odds, not a guarantee.
What the Twistlock team had was the funding and the nerve to spend one attempt learning something, and still have another in hand.
There’s a footnote to all this. The guide Morello co-authored is now marked withdrawn on NIST’s site. The field he helped document has outgrown its own founding paperwork, and he’s building for whatever comes next.
When the next headline seed round lands in your feed, the number won’t tell you much on its own. Ask what it buys the founders, and how many attempts it gives them. That’s the thought worth taking into your own raise.
Sponsored by Minimus
