Analysis · Sofina SA
Sofina is not betting on "cyber": it is building four layers
Eye Security, XBOW, Cyera, and soon Exein cover different risks. For the holding company shareholder, the subject is less a collection of start-ups than an investment thesis taking shape.
Courtesy translation of the French original.
Sofina's 2026 half-year results reveal a new intellectual focus in its direct portfolio: cybersecurity. Two new investments, Eye Security and XBOW, join Cyera, which it has already held since 2024. After the close, Sofina also signed an investment in Exein, which is still subject to closing conditions. These companies do not all operate in the same field. Together, they cover information systems, code, data, and connected devices.
In summary
Sofina is building direct exposure to digital security with complementary entry points. This is consistent with its "digital transformation" theme, but the financial impact remains limited and poorly quantified: none of these four investments appears in the holding company's top 10 direct holdings. The value of the portfolio lies primarily in the quality of the selection and access to several categories with growth potential.
Why this matters to Sofina shareholders
The direct portfolio represents €5.862 billion, or approximately half of the €11.831 billion investment portfolio at the end of June. Sofina invested €733 million in the first half of the year, across all asset classes, and added nine new direct positions. Among them, Eye Security and XBOW are in the cybersecurity sector; Cyera, an existing holding, was increased. A fourth exposure, Exein, is announced after closing. This shows where a portion of the new capital is being allocated, without, however, allowing for a calculation of its exact weight in net assets.
Four companies, four attack surfaces
| Stake | Protected Brick | Logic for Sofina |
|---|---|---|
| Eye Security | Systems for medium-sized European businesses, with 24/7 monitoring, incident response, and cyber insurance. | A significant 17.40% market share in a European platform, similar to the supported growth model. |
| XBOW | Applications and APIs, continuously tested by an AI-powered "autonomous hacker." | Exposure to automated offensive security, with an observer on the board. |
| Cyera | Sensitive data: discovery, classification, governance, and access control. | A small stake in a high-growth US company, to be increased in 2026. |
| Exein | Embedded software for machines and connected devices. | An extension of cybersecurity from the cloud to the physical world; transaction not yet closed at the time of publication. |
The most interesting takeaway, therefore, is not "Sofina acquires four cybersecurity companies." Eye protects the client company on a daily basis. XBOW searches for vulnerabilities before the attacker. Cyera controls what humans and AI agents can see in the data. Exein goes down another level, into the firmware of the equipment. The business models, competitors, and risks are different.
This complementarity reduces the risk that a single technological architecture will render the entire thesis obsolete. It does not eliminate sector-specific risk: the four companies remain exposed to similar spending cycles, the acceleration of AI, and highly funded global competition.
The Value Mechanism as Seen from Sofina's Perspective
A Coherent Thesis, but Still Difficult to Measure
Eye Security is the most straightforward case. Sofina raised €60 million and holds 17.40% of the company. The company targets European SMEs and mid-sized companies that cannot maintain a security operations center on their own. XBOW is younger and more aggressive: its platform automates penetration testing. Sofina holds 1.79% and is an observer of the board. Cyera, at 0.98%, is a smaller bet on data security in the age of AI agents.
Exein would complement this approach by protecting connected systems at the embedded software level. However, the legal timeline must be respected: Sofina indicates that the transaction remains conditional. Until the closing is announced, Exein is an investment intention, not yet a definitively held asset.
Another key limitation: Sofina does not publish the amount invested in each of these companies, nor their combined value within its net assets. They are not among its ten largest direct holdings, which together represent 27% of the look-through portfolio. Presenting cybersecurity as a new financial pillar for Sofina would therefore be premature. We can speak of an emerging and coherent thesis, but not yet a measurable driver of its net asset value.
What makes this portfolio interesting
Complementary products, European-US exposure, varying degrees of control, and a theme supported by AI, regulation, and the increasing attack surface.
What can go wrong
High valuations, rapid competition, significant trading costs, dilution during new funding rounds, and difficulty in converting outstanding technology into sustainable profitability.
Opulion Reading
Sofina's cyber portfolio reflects its investment approach: a strategic stake when its European roots and governance allow, minority investments to capture American innovation, and a gradual expansion into new segments. This architecture is compelling because it transforms a sector label into a value chain.
But Sofina's shareholders must maintain the right focus. The holding company, not the startup, remains the key issue. The crucial question will be whether Sofina can not only identify the winners at each level, but also convert these choices into net worth, and then into liquidity, without overpaying for growth.