Costanoa recruits Joe Sullivan, a former Meta, Uber and Cloudflare security leader, to back cybersecurity startups

Costanoa, a venture capital firm that backs companies across cybersecurity and other areas, said it has brought in Joe Sullivan, a veteran technology security executive with past roles at Meta, Uber and Cloudflare. The move is positioned as an effort to support what the firm described as the next generation of cybersecurity companies.

The announcement, carried by Yahoo Finance, frames Sullivan’s addition as part of Costanoa’s broader investing work across categories that include Applied AI, AI infrastructure, cybersecurity, national security and fintech. Costanoa did not lay out a specific fund mandate or list target sub-sectors in the post, but the emphasis on cybersecurity suggests it expects to devote more attention to early bets in security infrastructure, tools and services.

Sullivan’s background spans multiple large-scale internet and cloud-oriented companies, all of which have had to address security at scale. Meta’s own public footprint, Uber’s platform complexity and Cloudflare’s network security focus indicate the kind of operational security perspective that venture investors often seek when underwriting startups that sell to enterprises and public sector organizations.

While the firm did not specify what kinds of cybersecurity products it intends to prioritize, the language around “next generation” suggests a focus on newer approaches to threat detection, identity and access controls, application security or infrastructure protection, rather than only traditional security software categories. The announcement did not disclose whether Costanoa plans to lead larger rounds, establish new vehicle structures, or concentrate on seed versus later-stage deals.

Costanoa also did not provide details on Sullivan’s day-to-day responsibilities, such as whether he will sponsor specific deals, sit on investment committees, or help recruit portfolio operating talent. For now, the disclosed information centers on his appointment rather than on any pipeline commitments or named startup investments.

For cybersecurity investors, the hiring of a senior security operator can matter because buyers increasingly expect practical integration, measurable outcomes and strong incident readiness. Startups that can demonstrate security performance in real environments, including complex enterprise IT and cloud setups, often have to translate technical claims into operational results for security teams and procurement stakeholders.

Still, gaps remain. The announcement did not name any specific cybersecurity companies Costanoa expects to back with Sullivan, did not describe expected check sizes, and did not provide timeline guidance for when markets would see the firm’s next wave of deals. Investors will likely watch for follow-on disclosures such as new partnership posts, portfolio updates, or later rounds tied to the firm’s cybersecurity thesis.

Going forward, the most immediate announcement to monitor is whether Costanoa’s portfolio expansion in cybersecurity accelerates after Sullivan’s arrival, and whether the firm’s public statements start to get more specific about the product areas it believes are underfunded. Additional details about his prior projects and how that experience translates into investment selection would also help clarify the strategy behind the move.