$1.4 billion a few months in, with $0 in revenue

On July 22, 2026, Reuters broke the existence of a company that until then basically didn't exist in public. It's called Cathedral. Four people who worked at the Department of Government Efficiency — DOGE — quietly started it a few months ago, and over the past several weeks they pulled in $160 million at a $1.4 billion valuation. Andreessen Horowitz and Sequoia Capital led the round. Both took board seats.

That last part matters more than the headline number. When the two loudest names in Silicon Valley both take a board seat on the same deal, they're not treating it as a financial position. They're treating it as strategic territory.

Here's the deal: this company has no disclosed revenue and no disclosed government contracts. No product demo. A website that's effectively still in stealth. A spokesperson who declined to answer most of Reuters' detailed questions. So the $1.4 billion isn't attached to a shipped product. It's attached to the belief that a product can be shipped — and more precisely, to the question of whose phone these four people can pick up inside the Pentagon. Paying a premium for a team is routine in venture. Having government access be the actual substance of the valuation, this nakedly, is not.

What Cathedral says it wants to build isn't ordinary either. AI-driven cyber capability for the US military, and not just the defensive kind — offensive operations are explicitly in scope. Per Reuters, the company is targeting US government contracts for AI-led cyber operations against adversaries including China. On top of that, it's reportedly weighing acquiring or partnering with a data center operator to secure dedicated compute for running those operations. A software company talking about buying a data center in year one isn't a normal roadmap item. It's a declaration that they intend to own infrastructure rather than rent it.

The timing is almost too clean. Just a week earlier, on July 14, the White House formally announced GOLD EAGLE, an AI cybersecurity vulnerability clearinghouse initiative. It implements one of the core directives from President Trump's June 2 executive order on promoting AI innovation and security (EO 14409), and it pulls in the White House, Treasury, DHS/CISA, and the Department of War alongside private partners to find, triage, and patch software vulnerabilities faster using AI. Cathedral disclosed its raise the same week the government formally declared it was going to handle cyber vulnerabilities with AI. Call it coincidence if you want, but the angles line up too well.

The four people who built Cathedral

The cofounders are Gavin Kliger, Luke Farritor, Marko Elez, and Jack Stein. All four worked at DOGE in 2025, and three of them already have names the American press knows. DOGE spent that year turning the federal org chart inside out, a process that ended with more than 250,000 federal workers leaving government — and one that repeatedly put engineers in their twenties in control of agency IT systems, which was controversial every single time it happened.

The center of gravity here is Gavin Kliger. On March 6, 2026, he was named chief data officer at the Department of Defense (now the Department of War). Before government he spent five years as a software engineer at Databricks, then joined in 2025 and served as senior advisor for technology and delivery at the Office of Personnel Management. At DoD he was involved in launching the GenAI.mil platform and in the drone dominance program. On his appointment he said the US is in the middle of a global competition over military AI supremacy and needs to stack advantage on top of leadership. He took that CDO chair right as the Pentagon and Anthropic were in open conflict. Which is to say: Kliger sat in a seat that actually shaped the direction of military AI procurement, and a few months later moved to the side that receives it.

Luke Farritor's résumé is the strange one. As an undergrad at the University of Nebraska–Lincoln in 2023, he read the first word — porphyras, "purple" — off a carbonized Herculaneum scroll from the Vesuvius eruption using machine learning, and won $40,000 for it. In February 2024 he shared the $700,000 grand prize with Youssef Nader and Julian Schilliger. He's also done a SpaceX internship, and at DOGE he worked on cost cutting at the General Services Administration. The person who used AI to read a 2,000-year-old scroll is now building a company to use AI to read adversary networks. Technically these aren't as far apart as they sound — both are recovering signal from noise.

Marko Elez is closer to a lightning rod. During his DOGE stint, his access to sensitive Treasury data became a problem, and he resigned after the Wall Street Journal reported racist social media posts of his — then returned after public backing from President Trump and Vice President J.D. Vance. The fourth cofounder, Jack Stein, has the thinnest public record of the group.

How you read this lineup depends entirely on where you're standing. Supporters say they're the only cohort that has personally felt where government bottlenecks are. Critics say it's a pipeline where the people who cut the budget now collect it. But after the Reuters story, the question American outlets converged on was narrower than either take: can a team that made its name on cost cutting actually build military-grade enterprise software?

The structure of the round, and the data center subplot

Three things in this round are worth studying.

First, a16z and Sequoia came in as co-leads. Firms at that weight class typically don't split a lead — and here both took board seats and went in together. The natural read isn't shared conviction so much as competitive pressure: miss this deal and you may miss the entire next defense AI cycle. a16z is already a major Anduril investor, and it participated in Anduril's $5 billion Series H in May 2026 that pushed that valuation past $60 billion.

Second, the budget line Cathedral is aiming at is still small. US Cyber Command's FY2026 budget request included a new program called "AI for Cyberspace Operations," but it was funded at roughly $5 million — a rounding error inside a $1.3 billion R&D plan. Separately, though, the Pentagon is running a task force studying how to safely deploy frontier AI with hacking capability into CYBERCOM and NSA missions, and the follow-on budget that comes out of that work is the real pie. Cathedral's $1.4 billion isn't priced against today's budget. It's priced against the budget expected to open up in 2027 through 2030.

Third, the data center question. AI used for offensive cyber operations is awkward to run on general-purpose cloud. Commercial cloud terms of service frequently restrict workloads like intrusion simulation and exploit generation, and classified environments add physical isolation requirements on top. Building your own compute is a design choice that routes around those constraints from day one — and it also means this company's capital intensity sits well outside normal software startup math. You cannot buy a data center with $160 million. Which means this round is best understood as a beachhead for the next one.

Item Detail
Company Cathedral, still in stealth
Went public July 22, 2026 (Reuters exclusive)
Raised $160 million
Valuation $1.4 billion (est. post-money)
Lead investors a16z, Sequoia Capital (co-leads, both on the board)
Cofounders Gavin Kliger, Luke Farritor, Marko Elez, Jack Stein
Business AI cyber operations for the US military (offensive and defensive)
Disclosed revenue/contracts None
Infrastructure plan Evaluating data center acquisition or dedicated compute partnership
Policy backdrop White House GOLD EAGLE (July 14), EO 14409 (June 2)

What each side walks away with

Cathedral is buying time more than money. In defense procurement, the stretch that kills young companies isn't technical — it's procedural. Security clearances, access to the officials who actually have authority, a seat at requirements definition, entry into a pilot contract: that sequence normally takes years. If one of your cofounders was the Pentagon's CDO until recently, that whole stretch can compress. Add $160 million and you can carry two to three years of engineering payroll and secure infrastructure buildout at zero revenue — enough runway to survive until a first OTA lands. (Other Transaction Authority is the contracting vehicle DoD uses to route around traditional procurement and pull in new technology fast.)

a16z and Sequoia bought an option. In defense tech terms, $1.4 billion is not a big absolute number. Anduril is in the $60 billion range, Shield AI around $12.7 billion, Saronic around $9.25 billion. So for both firms, a Cathedral stake is a relatively cheap call option on "cyber operations," a category that currently has no owner. If the US military seriously funds AI cyber ops, that stake could become the next Anduril. If it goes to zero, it's absorbable at the portfolio level.

The Pentagon and the White House get policy coherence. GOLD EAGLE declared a direction — find and fix vulnerabilities faster with AI — and executing that direction requires private suppliers who will actually do the work. The legacy primes move slowly on software. The frontier AI labs attach conditions to military use. A company built from scratch to do nothing but military cyber operations slots exactly into that gap. After Anthropic refused autonomous weapons and mass surveillance use cases, got designated a supply chain risk, and was swapped out for OpenAI, DoD has a strong motive to secure AI suppliers who don't attach conditions.

The broader DOGE alumni network benefits too. Cathedral is the highest valuation any DOGE-alumni company has hit, and once that precedent exists, fundraising gets dramatically easier for the founding teams that follow.

Taxpayers and oversight bodies get the least. A company with no public revenue and no public contracts becoming a unicorn largely on government relationships leaves the question of whether revolving-door rules and conflict-of-interest review actually function fully unanswered.

The path Palantir walked, and the companies that didn't make it

There's precedent for this shape. Palantir, founded in 2003, got inside government via investment from In-Q-Tel, the CIA's venture arm, and then spent more than a decade single-handedly proving the proposition that Silicon Valley can sell software to the government. Early on, the criticism that its valuation was absurd relative to revenue never let up. It eventually went public and climbed into the hundreds of billions in market cap, which settled the argument. Anduril is the faster version: founded 2017, powered by a celebrity founder in Palmer Luckey and a procurement-reform narrative, past $60 billion in eight years, with a $5 billion Series H in May 2026 that doubled its valuation.

The success stories are the ones you hear about. Companies that led with government relationships as their primary asset and then quietly disappeared are far more numerous. The hard part of defense procurement isn't opening the door — it's surviving five years after the door opens. If you never get folded into a program of record, you cycle through pilot contracts until the money runs out. The industry calls this the Valley of Death: OTAs get you to a prototype fast, and most companies stall at the threshold where prototypes become production contracts. Cathedral's founder network solves the first problem and does nothing for the second.

There's a second-order risk too. Relationships depreciate alongside administrations. Depending on how the 2028 US election goes, this team's largest asset can flip into its largest liability.

One more case worth holding onto: Scale AI. It built a government contract base on defense data labeling and AI evaluation, then in 2025 Meta bought a 49% stake for roughly $14.3 billion — and major customers like Google and OpenAI walked. That episode showed how acutely defense and government customers care about a supplier's ownership structure and neutrality. The moment Cathedral acquires a data center or entangles itself deeply with one large capital partner, the same trust problem becomes available.

There was another large round the same week, on a different continent. On July 21, London-based Humanoid closed a $152 million Series A led by Prime Movers Lab at a $1.35 billion post-money valuation, making it Europe's first pure-play humanoid robotics unicorn. Bosch, Schaeffler, Fubon Financial VC, and Aglaé Ventures participated; cumulative funding is now $270 million. About two years old with roughly 200 engineers, the company is building the wheeled HMND 01 platform plus its own AI software stack, KinetIQ, with a beta promised in Q4. Cathedral and Humanoid have nothing to do with each other commercially. What they share is that two hard-tech companies with almost no revenue got billion-dollar valuations within days of each other. Two thermometers, same reading, on what summer 2026 capital markets feel like.

How the competition responds

The most direct rival is Twenty. In June 2026 it raised $100 million at a $1 billion valuation — an offensive cyber startup building a platform that uses agentic AI to automate the full cyber kill chain for the US military. It was the first venture-backed offensive cyber company to reach unicorn status, and about six weeks later Cathedral showed up at a higher price. The two will collide head-on over the same budget lines, the same program officials, and the same talent pool. Twenty's likely play is to lean hard on having actual product and actual contracts already in hand.

Palantir and Anduril will respond differently. Both already have deep wiring inside the Pentagon, and cyber operations is a natural extension of their existing platforms. The cheapest counter available to them is acquisition: buy a small team with similar capability and bolt it on before Cathedral lands a first contract, and the opening for a newcomer narrows. But that $1.4 billion price tag has already made Cathedral much harder to buy. That's simultaneously a moat and a set of handcuffs on its exit options.

Raytheon, Lockheed Martin, and Booz Allen — the traditional prime and consulting camp — will compete on process. They have decades of clearances and program management experience, and they hold an overwhelming edge on the documentation and audit requirements of defense contracting. In a new area like AI cyber operations, their most likely move is to team with startups, take the prime contractor position, and put the startup underneath as a subcontractor. In that scenario Cathedral wins the contract but hands over a lot of margin and most of the control.

The frontier AI labs are in a messier spot. Anthropic held its line on restricting autonomous weapons and mass surveillance use, got designated a supply chain risk by DoD around February–March 2026, and called the move illegal and politically motivated while signaling legal action. OpenAI moved quickly into the vacated space, then re-added surveillance-related guardrails after internal pushback. Net: the frontier labs have structural constraints that keep them from opening their models to offensive cyber without limits, and that gap is precisely Cathedral's market. A company that doesn't train its own frontier model, and instead fine-tunes open-weight models to run in isolated environments, routes around lab policy entirely.

So what actually changes

If you're a developer, the comp landscape for security engineers is shifting again. People with exploit development, reverse engineering, and fuzzing automation experience were already scarce, and now two or three well-capitalized startups are hiring for them simultaneously. The stack is also moving. Workflows that hand vulnerability discovery and patch prioritization to LLM agents just became a de facto candidate for a government standard by way of GOLD EAGLE, which makes it likely that private security teams start evaluating similar pipelines. The pattern where defensive tooling gets commercialized first and offensive technique leaks out through papers and benchmarks has repeated for twenty years.

If you're an investor, this is a moment to be more careful, not less. Defense tech venture funding hit $14.6 billion through May 2026, already past the $9.6 billion full-year 2025 record and roughly 9x the $1.6 billion of 2020 in six years. Fortune and others have already started the bubble conversation, and a large share of that capital is concentrating in Anduril, Shield AI, and Saronic, widening the gap between the top tier and everyone below. More companies reaching unicorn status on team premium with zero revenue is a classic late-cycle signal. The counterweight: defense budgets are tied to political calendars rather than consumer cycles, so if a correction comes, it'll likely arrive later and land softer than in consumer AI.

If you're a regular user, the thing to watch is oversight. Cyber operations run by government agencies sit under control mechanisms — congressional intelligence committee reporting, rules of engagement. Whether the same level of oversight applies when a private contractor executes part of that operation is far less clear. Layer AI agents on top, pushing target selection and execution speed past human pace, and reconstructing "who approved this" and "why that target" after the fact becomes genuinely hard. What logging and audit trail standards get imposed may end up mattering more than raw technical performance.

If you're watching from Korea, there are two takeaways. One is procurement structure. The US deliberately built bypass routes like OTA and SBIR so a one- or two-year-old company can enter defense prototype contracts. Korea's defense acquisition process still carries high track-record and certification requirements, which makes it very hard for a new software firm to get in. The other is the privatization of cyber capability. If the US moves toward outsourcing part of its offensive cyber capability to private startups, allied countries will feel pressure to build comparable capability — and export controls and technology transfer rules will likely tighten alongside it. For Korean security firms that's an opportunity and a regulatory risk at the same time.

🥄 Three Things You're Probably Wondering

— So what does this mean for me? Not much directly, not yet. But if the government standardizes AI-driven vulnerability discovery and patching, you'd feel it a few years out as faster patch cycles in the open source libraries and cloud services you already use. The catch is that attack automation speeds up on the same curve, so which direction the net effect lands is still an open question.

— Why is this happening now? The White House announced GOLD EAGLE on July 14, the June 2 executive order directed the creation of an AI cyber clearinghouse, and DoD is running a task force on putting frontier AI into CYBERCOM and NSA missions. Filling the war chest right as the policy door opens is the obvious read. Actual budget allocation is still small, though, which makes today's valuation a bet on future budgets rather than current ones.

— Is Cathedral ahead of its competitors? On valuation alone it's above Twenty at $1 billion, but Twenty is ahead on product and contract track record. What Cathedral has is its founders' firsthand experience inside the Pentagon, which is a real edge up to the first contract and a separate question from surviving the five years after it. Calling a winner right now would be premature.

Sources

Numbers and criteria are as of announcement and may change. Investment calls are yours to make!