Costanoa Taps Cyber Vet Joe Sullivan to Find Next-Gen Security Stars

SAN FRANCISCO, CA – July 30, 2026 – In a move signaling a major strategic shift in venture capital, Costanoa Ventures has appointed Joe Sullivan, one of Silicon Valley's most experienced and high-profile security executives, as a Venture Partner. The announcement does more than just add a big name to the firm's roster; it underscores a growing conviction in the VC world that to win the next decade of cybersecurity, you need more than capital—you need battle-hardened operational expertise.

Sullivan, who previously built and led security organizations at Meta, Uber, and Cloudflare, will now advise Costanoa's portfolio and help the firm identify and invest in the next wave of companies poised to tackle the industry's most complex challenges. For Costanoa, a $2.8 billion firm known for its "boutique by design" approach to early-stage investing, Sullivan's appointment is a decisive play to deepen its expertise in a sector being fundamentally reshaped by artificial intelligence and geopolitical volatility.

A Strategic Coup in a High-Stakes Game

Venture capital has long been a world of financial engineers and product visionaries. However, in a field as intricate and consequential as cybersecurity, the value of a true operator cannot be overstated. Sullivan brings over three decades of experience, beginning as a federal prosecutor in the Department of Justice's pioneering computer hacking unit before moving to the private sector's front lines.

This deep-seated experience is precisely what Costanoa is banking on. "Joe has an exceptional ability to see where cybersecurity is going because he has spent his career helping shape it," said Greg Sands, Founder and Managing Partner at Costanoa, in the official announcement. The firm, which focuses on investments from formation through Series A, has already backed promising security startups like Empirical Security, SGNL, and Cyberhaven. Sullivan's role is to sharpen that focus, helping the firm distinguish true innovation from market noise.

The move reflects a broader trend. As cybersecurity threats become more sophisticated, VCs are realizing that pattern-matching from past successes is no longer sufficient. They need leaders who have managed massive security budgets, responded to nation-state attacks, and navigated complex regulatory landscapes. Sullivan's firsthand knowledge of the pain points CSOs face at scale provides an invaluable filter for evaluating startups. He can assess not just the elegance of a technology, but its practical viability within a real-world enterprise security stack.

From Prosecutor to Partner: A Career on the Cyber Frontier

Sullivan's journey to venture capital is a microcosm of the cybersecurity industry's own evolution from a niche IT concern to a board-level imperative. His early career as a federal prosecutor saw him tackling cybercrime, economic espionage, and computer hacking cases when the field was still in its infancy. This public service foundation, which included work on the 9/11 investigation, gave him a unique perspective on the intersection of technology, law, and national security.

His transition to the corporate world placed him at the helm of security for some of the fastest-growing companies in history. At Facebook (now Meta), Uber, and Cloudflare, he was responsible for protecting billions of users' data against a constantly evolving threat landscape. However, his career has also been marked by a significant public challenge. In 2022, Sullivan was convicted of obstruction of justice and misprision of a felony for his role in handling a 2016 data breach at Uber. The case, which involved a payment to hackers through a bug bounty program to conceal the incident from regulators, was a landmark event, marking the first time a corporate executive was held criminally liable for their response to a breach. The conviction was upheld on appeal in 2025.

While controversial, the episode sparked a critical industry-wide debate about the personal liability of security executives and the immense pressures they face. Sullivan's continued influence and his move to Costanoa suggest the industry values the totality of his experience—including the hard-won lessons from its most challenging moments. His path highlights a complex reality: the executives who have operated at the highest levels are the ones who best understand the system's fragilities and where the most impactful innovations are needed.

Securing the AI Era: Tapping Operators for Emerging Threats

Sullivan's appointment comes at a critical inflection point. The rapid proliferation of AI has created a dual-edged sword for security. While AI can power more sophisticated defense mechanisms, it also enables attackers to launch more complex, automated, and evasive campaigns. Industry analysts predict that attacks targeting AI systems themselves will become a dominant threat vector by 2026.

This new frontier is where Sullivan's "product-minded" leadership becomes particularly valuable. Joni Klippert, CEO of StackHawk, a Costanoa portfolio company where Sullivan serves on the board, highlighted this quality. "He's a deeply product-minded leader who asks the questions that shape strategy and understands the challenges security teams are facing as AI changes how software is built," she noted.

VC firms are no longer just betting on ideas; they are betting on teams that can navigate this chaotic new environment. By bringing in an operator like Sullivan, Costanoa gains an insider's view on how AI is changing the security calculus for large enterprises. This allows the firm to better vet startups claiming to offer AI-powered solutions and to identify founders who are addressing the second-order effects of AI adoption, such as new vulnerabilities in AI development pipelines and the need for new identity and access management paradigms for AI agents.

Sullivan himself sees his role as finding those who are ahead of the curve. "Some of the most important cybersecurity companies of the next decade will come from founders who are solving problems the industry hasn't fully recognized yet," he stated. His mission at Costanoa is to find and nurture those very founders. By combining his operational foresight with the firm's capital and support, the partnership aims to build the companies that will define digital defense in the age of AI. This fusion of frontline experience and early-stage investment represents a powerful new model for fostering innovation where it's needed most.