Ex-Secret Service Agent Turned VC Raises Another $250M Cybersecurity Fund

A former U.S. Secret Service agent who once flipped a hacker is now writing his next chapter in cybersecurity investing. According to TechCrunch, Stephen Ward—former Secret Service agent and Chief Information Security Officer at Home Depot—is preparing a second fund for Brightmind Partners, targeting around $250 million.

From the Front Lines of Law Enforcement to Corporate Security Chief

Stephen Ward's career trajectory is unusual in security circles. Early in his career he served in the Secret Service, where part of his job involved dealing with cybercriminals—and he even succeeded in "flipping" a hacker into an asset. That experience gave him a first-hand understanding of how attackers think. After leaving government, he became Chief Information Security Officer at Home Depot, responsible for the retail giant's overall security posture.

The significance of this resume is that he understands both the offensive and defensive sides, and he has also steered the security budget of a large enterprise. For a cybersecurity fund, that background means he can assess whether technology is genuine during due diligence, and understand CISO customers' real pain points after investment.

The U.S. Secret Service is often understood by the public as a presidential protection agency, but it also has a statutory mandate to investigate financial and cybercrime. Its cybercrime investigation division has long tracked cases such as credit card fraud, ransomware, and business email compromise, so agents frequently come into direct contact with cybercriminals' tactics, toolchains, and underground ecosystem. In a law enforcement context, "flipping a hacker" usually refers to converting an attacker who has been identified or arrested into an informant through plea agreements, reduced sentences, or cooperation deals, assisting with subsequent investigations or vulnerability tracing. This kind of cooperation model requires law enforcement to accurately judge both the attacker's technical capabilities and psychological motivations.

Brightmind Partners' Second Fund

According to TechCrunch, Brightmind Partners is raising a second fund of about $250 million. Compared with the first fund, this size indicates that the firm has built a certain level of trust among LPs (limited partners). The cybersecurity sector has remained hot in recent years, but fund managers with genuine hands-on industry experience are still scarce, and Ward's personal brand is an important fundraising asset.

Currently, public information is limited; the fund's specific investment stage, LP composition, and first close timing have not been disclosed.

LP (Limited Partner) refers to the capital provider in a private fund, typically including pension funds, endowments, family offices, and high-net-worth individuals. Their role is to provide capital but not participate in day-to-day management; the party responsible for management and investment decisions is called the GP (General Partner). A fund reaching its target size often means the GP has completed multiple rounds of roadshows with LPs and obtained subscription commitments. A second fund is usually seen as a test of the first fund's performance: LPs will consider the first fund's returns, exits, and post-investment support capabilities when deciding whether to commit more. Therefore, the information that "the second fund reaches $250 million" reflects the firm's actual reputation among LPs more than a first-time fundraise does.

Why Security Investing Needs People Who "Know the Field"

The special nature of cybersecurity investing is that product effectiveness is often difficult to measure with traditional metrics. The value of a firewall or detection platform depends on whether it can stop attacks in real-world offensive and defensive scenarios—and that requires investors to have judgment on both sides. Ward's path from the Secret Service to corporate CISO covers exactly these two dimensions.

On the other hand, enterprise security procurement has a long decision chain and CISOs have significant say, so investors with CISO networks can help portfolio companies reach customers faster after investment. This is also why many security funds in recent years have emphasized being founded by "operators."

CISO (Chief Information Security Officer) is the executive responsible for security strategy, budget, and risk management within an enterprise, reporting directly to the CEO or CIO. In security product procurement, the CISO is usually one of the budget gatekeepers and final decision-makers, but decisions often also require approval from IT, procurement, legal, and even the board of directors, resulting in long decision cycles and many evaluation dimensions. For this reason, security startups generally have longer sales cycles than typical SaaS products, and investors with CISO networks can help portfolio companies enter marquee customer accounts faster and shorten validation cycles. This is also why "operator-founded" funds are seen as having a structural advantage in the security sector.

Open Questions

This fundraising is still at an early stage. Brightmind Partners has not yet publicly responded to TechCrunch's request for comment (or has not disclosed further details), and the fund's final size and investment strategy remain to be seen. For those watching the cybersecurity primary market, whether Ward can translate his law enforcement and corporate security experience into a replicable investment methodology is the next point worth tracking.

One-line Summary

Former Secret Service agent and Home Depot CISO Stephen Ward is raising a second cybersecurity fund of about $250 million for Brightmind Partners.

Paragraph Summary

The article reports Stephen Ward's career transition and latest move: he was a U.S. Secret Service agent involved in cybercrime investigations who successfully flipped a hacker, later served as Home Depot's Chief Information Security Officer, and is now raising a second cybersecurity fund of about $250 million for Brightmind Partners. The article notes that Ward combines offensive-side understanding, defensive experience, and enterprise security budget management, giving him differentiated advantages in technical due diligence and post-investment support; the second fund reaching this size also shows the firm has earned a certain level of LP trust. However, key details such as the fund's investment stage, LP composition, and final size have not been disclosed, and whether his investment methodology can be replicated remains to be seen.