A critical assessment of NewCore’s $66M seed at a ~$300M valuation — a pre-revenue identity startup vowing to go “head-to-head with Microsoft and Okta” just as those incumbents bundle agent identity into suites enterprises already own, and as the field’s best independents get acquired. Led by Cyberstarts.
By NewCore’s own account it has fewer than 10 customers, none yet billed, with revenue starting “summer 2026.” A $66M raise at a ~$300M valuation on zero confirmed revenue is a Series-A-sized bet priced like a growth round — underwritten by pedigree and AI narrative, not traction.
The incumbents NewCore vows to fight are already shipping agent identity inside the suites enterprises own — Microsoft Entra Agent ID, Okta’s open Cross App Access. And the field’s best independents are being bought: CyberArk by Palo Alto (~$25B), Veza by ServiceNow (~$1B).
Lead investor Cyberstarts ran the “Sunrise” program, which paid CISOs tied to portfolio growth and was forced to suspend after reporting on conflicts of interest. NewCore’s design partners cannot be assumed independent until proven so — the model is built to manufacture early demand.
Key Finding: NewCore pairs a genuinely strong founding team — Alon’s Dome9 exit is real and relevant — with a thesis that runs directly against the market’s direction of travel. It is a pre-revenue company priced at $300M, selling a standalone proprietary identity layer into a market where identity is increasingly bundled for free with the platform, the standards are going open, and the credible independents exit by acquisition rather than by beating Microsoft. The most plausible outcome is an acquisition by one of the very giants it claims it will fight.
NewCore says it will go “head-to-head with Microsoft and Okta.” The problem is that the entire category — agent identity — is being absorbed into suites and acquired by platforms, in real time, around it.
Ships Entra Agent ID — agent identity bundled with Entra / M365 that enterprises already pay for.
Launched Cross App Access (XAA), an open protocol for agent-to-app auth, plus agent ISPM and Universal Directory.
~$25B acquisition — explicitly to “secure and enable agentic AI.” CyberArk had already absorbed Zilla and Venafi.
~$1B for non-human + AI-agent governance, folded into the ServiceNow AI Control Tower.
The structural heart of the story: NewCore is selling a standalone, proprietary identity layer in a market where identity is increasingly free with the suite, and where the two most credible independents of the last cycle — CyberArk and Veza — were acquired rather than built into Microsoft-beaters. Historically, standalone identity vendors that try to out-feature bundled suite functionality lose.
Secure Split Key, VisualMFA, “trust scoring” and split-key SAML/OIDC signing had no public product during stealth, no published whitepaper, no third-party audit, and no SOC 2 or ISO at launch. The live site is marketing-forward with minimal technical specificity, names no customers, lists no pricing, and ships an empty “/trust” page. Every technical claim — including “phishing-resistant” and “no single point of compromise” — is, for now, marketing.
Lead investor (Gili Raanan). Its “Sunrise” program paid CISOs — some via personal accounts — tied to portfolio growth, and was suspended after Calcalist reporting on conflicts of interest.
The real signal. Co-founded Dome9, sold to Check Point for $175M in 2018. A credible, repeat security founder — the basis for the valuation.
Non-human identity — the fast-moving category NewCore enters late, against better-capitalized pure-plays like Oasis (~$190M) and Astrix.
The open OAuth-2.1-based agent-auth spec finalizing July 28, 2026. If agent identity standardizes here, a proprietary layer thins to a feature.
The “Agentic Skill” ties NewCore to Claude Code, Codex and Cursor — runtimes owned by Anthropic, OpenAI and Anysphere, any of whom can ship native identity.
Claimed at launch — yet customers aren’t billed until “summer 2026.” Availability and revenue are not the same thing.
A “seed” round this size, at this valuation, with this little traction, is a bet on the founder and the narrative — priced as if the demand were already proven.
The charitable read: in cybersecurity, a proven founder with a clean exit and a hot category can command a premium seed, and four years of runway buys time to find product-market fit before the suites fully close the gap. The skeptical read: $300M pre-revenue prices in success that hasn’t happened, in a category consolidating toward the incumbents — leaving little room for error and a real risk of a flat or down extension if “summer 2026” monetization slips.
Seven structural risks the $66M does not resolve.
Microsoft Entra Agent ID and Okta XAA bundle agent identity into platforms enterprises already own, while Palo Alto/CyberArk ($25B) and ServiceNow/Veza ($1B) vertically integrated the category. A standalone proprietary layer must out-execute free suite features — historically a losing position in identity.
~$300M post-money on fewer than 10 non-paying customers and revenue that hasn’t started. The valuation rests on Alon’s track record and AI hype, not demonstrated demand. A down-round or flat extension is live if “summer 2026” monetization slips.
Structural and undisclosed. Cyberstarts’ suspended “Sunrise” program paid CISOs tied to portfolio growth — the textbook mechanism for manufacturing portfolio-affiliated early customers. No launch coverage asks whether NewCore’s design partners are arms-length; until disclosed, the traction signal is suspect.
SSK, VisualMFA and “trust scoring” have no public audit, whitepaper, or certification. Security buyers demand SOC 2 / ISO and pen-test evidence; NewCore’s “/trust” page is empty at launch and the claims are marketing until validated.
If agent auth standardizes on MCP’s OAuth-2.1 spec (finalizing July 2026) plus Okta’s open XAA, the proprietary “identity layer” thins toward a feature. NewCore’s moat depends on the market not standardizing — a bet against the current direction of travel.
The “Agentic Skill” ties NewCore’s value to Claude Code, Codex and Cursor — runtimes owned by Anthropic, OpenAI and Anysphere, any of whom could ship native identity controls or change the integration surface.
In non-human / agent identity specifically, Oasis (~$190M) and Astrix already out-raise a single seed, and the niche has produced acquisitions, not standalone winners. NewCore is late and not uniquely capitalized for the slice it most resembles.
NewCore is a strong team making a bet against the direction of its own market. Zohar Alon’s Dome9 exit is real, and identity for AI agents is a genuine emerging problem. But the company is pre-revenue at a ~$300M valuation, selling a standalone proprietary layer where Microsoft and Okta already bundle agent identity for free, where the open standards are converging, and where the strongest independents — CyberArk, Veza — exit by acquisition. The traction signal is also clouded by lead investor Cyberstarts’ suspended “Sunrise” demand engine. The honest framing: this is a well-funded acquisition target, not a credible Microsoft-killer — and the buyer is likely one of the giants it says it will fight.
Based entirely on publicly available information, including the TechCrunch announcement of June 15, 2026. All traction and valuation figures are company-supplied and press-repeated, not independently verified. The conflict-of-interest concern is inherited from documented reporting on lead investor Cyberstarts and is a structural inference, not evidence of specific NewCore misconduct.
