Hello friends, and welcome to The Unsophisticated Investor! Brought to you by Mark, Head of UK Expansion & Operations at Shuttle!

Shuttle builds the regulated rails that syndicate leads, fund managers and their investors use to raise and deploy private capital on. The structuring, the investor checks, the payments, the compliance, the reporting, handled in one place, so the people running rounds can focus on the companies they’re backing, not the admin underneath them.

Now, let’s get into it 👇

At around 1am on Monday 2 November, technicians at Sabcobel, a Belgian refrigeration contractor, began pulling supermarket cooling units off the network. Someone had switched the evaporators into defrost mode overnight. By morning roughly 40 stores had fresh and frozen stock to throw away, and a store manager in Öland, Sweden, found a puddle on the floor and freezers set to 55°C.

It was the second time in three weeks. On the night of 11 to 12 October the same trick hit hundreds of French supermarkets, with Intermarché alone saying that around 150 to 200 of its stores were affected. A single store in Wasselonne, France, put its own loss at €220,000. The Paris prosecutor has opened an investigation and there is a technical inquiry underway.

Nobody has claimed responsibility, nor asked for a ransom. Suspicion has naturally drifted towards Moscow all the same. European states have already blamed Russia for a growing number of incidents affecting infrastructure; Russia has repeatedly denied involvement in any sabotage or hybrid operations. The absence of a ransom demand might point to external actors (such as Russia) flexing their capabilities. 

Whether the attackers turn out to be a state, a criminal group or someone inside the supply chain, the hack raises a wider question about how exposed Europe's commercial, state and civil infrastructure has become to cheap, remote sabotage. In this edition we look at the European businesses building at the forefront of that risk, and where the money backing them is going.

The story here is exposure, not sophistication. When the French wave broke, security researcher Baptiste Robert counted 2,752 Danfoss refrigeration systems reachable from the internet, 1,590 of them in France. That is 58% of the visible estate in one country, which goes some way to explaining where the attackers started.

The boxes that run supermarket fridges are rarely updated once they are fitted. Reports point to older Danfoss controllers, and France's national cyber agency, CERT-FR, issued a warning about them. Security researchers had already found weaknesses in one of these models, including a way to log in using a password anyone could work out from the date. Danfoss released a fix. Nobody has confirmed those weaknesses were used in these attacks, but the story is a familiar one: a fix existed, and the device never received it.

The November wave that occurred this week was wider and shallower. The BBC counted seven countries: Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden. Sabcobel's chief executive, Stephan Moelans, said many units will need physical modification rather than a patch, which will require investment.

AFP has since added Portugal, where seven Intermarché stores were hit through an outside refrigeration contractor, and Sicily, where at least four Coop stores run by Radenza Group lost control of their frozen-food cabinets. In the Netherlands, Danfoss said at least 17 businesses, mostly butchers and small shops, were running systems on open networks with default passwords. Counting France in October, ten countries have now been hit.

The sites hit follow no regional pattern. They range from supermarkets to a butcher and a delivery warehouse, which suggests the attackers hit any exposed controller they could find rather than targeting particular retailers.

Every attack leaves defenders a window: the time between an intruder getting in and doing real damage. That window decides whether a breach is a contained incident or a night of ruined stock across a whole chain, and it is shrinking fast. CrowdStrike's 2026 Global Threat Report puts average eCrime breakout time, the gap between an attacker getting in and moving sideways to other systems, at 29 minutes in 2025, with the fastest case at 27 seconds. The same report logged an 89% year-on-year rise in activity by AI-enabled adversaries, and found 42% of vulnerabilities were exploited before they were publicly disclosed.

The more consequential data point came from a model developer rather than a security vendor. In November 2025 Anthropic described a campaign, attributed to a Chinese state-sponsored group it tracks as GTG-1002, in which AI carried out 80 to 90% of tactical operations against around 30 targets. Humans stepped in at a handful of decision points.

Nothing published suggests AI was involved in the supermarket attacks, but it didn't need to be. Finding a few thousand internet-facing controllers on old firmware is a scanning job, and scanning, triage and exploiting known bugs are precisely the tasks agents make cheap. The case for AI on the defensive side is mostly a labour argument: a security team that reads alerts by hand is now up against something that doesn't sleep and costs very little per attempt.

Despite the attacks, and partly because of them, cybersecurity remains one of the areas venture investors find most attractive, and the numbers bear that out. Crunchbase counts $6.8bn of cybersecurity venture funding in Q3 2026, up about 50% on the previous quarter and tied for the largest quarter in years. AI companies took what it calls the "overwhelming majority", and at least 18 AI-and-security companies raised rounds of $100m or more.

Round counts fell at every stage while totals rose, so the money is going into fewer, bigger cheques. Cyera raised $600m in June and another $400m in September at a $12bn valuation, then bought Oasis Security, which manages access for AI agents, in a deal reported at around $1bn. The exit end looked similar in 2025, with Google's $32bn agreement for Wiz and ServiceNow's $7.75bn deal for Armis, which maps every connected device on a company's network, including a large operational technology (OT) business. 

OT is the hardware and software that run physical equipment, from factory lines to the controllers on a supermarket freezer. Exits of that size show that the largest technology buyers now treat security as core infrastructure worth paying platform prices for, and that device and OT visibility is part of what they want to own. For investors, that gives a clear route to a large exit, which is what justifies the size of the rounds above.

OT security is a smaller market, but it has started to produce exits of its own. Mitsubishi Electric bought Nozomi Networks for just under $1bn and Accenture's deal for Dragos was the OT story of the summer. Claroty, whose researchers found the Danfoss flaws, raised $150m in January at a reported $3bn. New York-based Cyera's June round alone was four times Claroty's.

Most of the new money is buying AI that replaces analyst hours, with a smaller and fast-growing slice going to controls on AI agents themselves. OT security, the layer that would have protected a freezer, is the quietest part of the list. Companies below are illustrative of where capital is going, not recommendations.

Belgium, which spent Monday throwing out frozen food, also produced one of Europe's newest security unicorns in Aikido. And the European names on this list sell into software teams, not the people who run stores, warehouses and factories.

If one fund sits closest to the companies in this edition, it is Evolution Equity Partners. It was founded by Richard Seewald and Dennis Smith and opened in New York and Zurich, and it now also runs offices in London and Palo Alto. It does almost nothing outside cybersecurity, and its stated aim for the latest fund is to build "European champions" in the UK and EU alongside its US and Israeli bets.

The European root is Seewald's. Before Evolution he backed and built AVG Technologies, the Czech antivirus business that listed on the New York Stock Exchange in 2012 and was bought by Avast in 2016 for about $1.3bn. That deal is still the template the fund pitches: back a security product early, carry it to a strategic buyer.

That is close to a ninefold increase in fund size over nine years, while staying in a single sector. Firm-wide assets are now above $2bn, managed by a team of about 30 across roughly 60 portfolio companies. Fund III writes cheques of $20m to $150m. British Patient Capital, the British Business Bank's commercial arm, is among the limited partners, which makes the UK state an indirect investor in the strategy.

The pattern is consistent. Evolution's exits go to strategic buyers, mostly listed security platforms, at sub-$1bn prices that return a fund many times over when the entry cheque is a Series A. Talon is the clearest case. Evolution led its $100m Series A in August 2022 and Palo Alto Networks bought the company about 15 months later.

Evolution's recent cheques read like a list of the companies above. It led Island's $400m Series F in September at a $6.4bn valuation, led Cyera's $600m round in June, and joined Armis's $435m round in November 2025, weeks before ServiceNow agreed to buy Armis for $7.75bn. It backed Phosphorus, the device-security company Dragos bought in June, and Noma Security, which raised $100m for AI agent security last year.

Almost all of Evolution's capital is in identity, data, browser and AI-agent security, the layers inside the corporate network where the largest rounds and the largest exits have been. Its OT exposure runs through Armis and Phosphorus, both of which sold to buyers who wanted device visibility rather than control of physical equipment. A specialist with this record has not yet made a large bet on the floor where the freezers live. That is either a signal about the returns available there or the gap a smaller European fund will try to fill.

Other European cyber specialists work at a smaller scale. Paladin Capital's London-based Cyber Fund II raised $372m, Amsterdam's TIN Capital runs its fifth European Cyber Tech Fund, Paris-based Auriga Cyber Ventures has reached an €80m interim close on its second fund, and Porto's 33N Ventures is backed by the European Investment Fund. 

Regulation is arriving, though at the wrong end of the supply chain. Since 11 September 2026 the EU Cyber Resilience Act has required manufacturers to report actively exploited vulnerabilities in their products within 24 hours, with a full notification at 72 hours. The Act's main security-by-design obligations follow on 11 December 2027. None of that patches the 2,752 controllers already bolted to supermarket walls.

EU agriculture commissioner Christophe Hansen said food security "requires more attention at all levels". The practical question is who pays to secure equipment that is already installed. The grocers carried this week's losses, but they work on thin margins and most fall outside NIS2, so nothing yet obliges them to spend. Refrigeration contractors such as Sabcobel install and maintain the controllers, but they are small regional firms without security teams. The manufacturers now have reporting duties under the Cyber Resilience Act, but those duties cover products on sale, not units fitted years ago. The most likely buyers are insurers and the larger chains, through maintenance contracts and cover conditions. For a startup, that points to revenue tied to site visits and contractor partnerships, which grows more slowly than software sold to a security team.

The AI security operations companies are a cleaner venture story, with software margins and a labour budget to replace. Whether or not their tools would have caught a defrost command sent at midnight, the past few weeks have exposed weaknesses in hardware and software with real costs for the businesses and people that depend on them. Now that it is a question of European security, expect it to stay on the political and boardroom agenda.

For investors, the lesson is a mismatch. Venture has priced the AI-era threat as a software problem inside the corporate network, and that is where the largest rounds and exits sit. These attacks were a hardware problem on the shop floor, where European companies such as Indurex and MON5 raise single-digit millions and sell slowly through operators and contractors. If either wave is attributed to a state, the budget behind protecting the cold chain could change quickly.

The Unsophisticated Investor is brought to you by Mark, Head of UK Expansion & Operations at Shuttle. Shuttle's mission is to power the next generation of syndicate leads, fund managers, and their investors, backing the great innovations of tomorrow. To do it, we're building private market infrastructure for running investment operations. By stripping away the legal friction and admin for deal managers, we make it easier than ever for Investment managers to run high-performing opportunities and to open those opportunities up to a wider, modern network of investors.

Mark
Shuttle’s Head of UK Expansion & Operations