Blackwall raises $100M at a $2.2B valuation to sell bot filtering through hosting providers
Blackwall raised $100M at $2.2B valuation on October 20. It sells bot and AI-agent filtering through hosting providers, so site owners reach it via their host.
Blackwall is an Estonian web security company that filters traffic before it reaches a site. It separates human visitors and legitimate AI agents from malicious bots, and it offers DDoS protection. On October 20, 2026, it announced a $100M Series C at a $2.2B valuation, led by AVP according to TechCrunch and tech.eu. The more interesting part is the sales model. Blackwall does not sell to websites directly. Hosting, managed-service and cloud providers resell its filtering under their own brands.
Key points
- Funding: a $100M Series C at a $2.2B valuation, led by AVP, with Dawn Capital, MMC Ventures and Tera Ventures participating (TechCrunch, tech.eu).
- Distribution: providers set their own prices and share revenue with Blackwall. The company runs a free tier that shows a site’s traffic and threats, and charges for protection and tools (TechCrunch).
- Gaps: the two valuation baselines in the coverage do not reconcile, and the articles we read give no traffic share, customer count or revenue.
Background
Blackwall was formerly known as BotGuard. In March 2025, TechCrunch reported a €45 million Series B, roughly $49.2 million by the article’s conversion. The article said the company had been operating since 2019 and worked with more than 100 intermediaries, including hosting providers, managed service providers and e-commerce platforms, covering 2.3 million websites and applications. Its flagship GateKeeper product is a reverse proxy that inspects traffic, uses AI to help analyze it, and filters malicious requests in real time.
The 2025 coverage was about malicious traffic. This time TechCrunch put AI agents at the center, describing the company as helping websites cope with bot traffic, “especially AI agents.” It groups Blackwall with Cloudflare, Akamai and Imperva as peers, and notes that Cloudflare’s AI Crawl Control is a related product.
Hosts are being pulled in two directions. GoDaddy opened its hosting, email and commerce APIs to AI coding agents on October 15. On October 5, Wikimedia published details of activity from an agent that appears to be run by OpenAI, including millions of automated requests against its platform. Reddit has said it will stop RSS output on November 13 and end its public API in March 2027, citing large-scale scraping and abuse. Blackwall’s business sits on that line: let agents in, and keep unwanted scraping out.
The facts
Blackwall’s numbers mostly come from its homepage, its investors and press coverage. The table lists each claim, where it appears, and whether we could check it.
| Claim | Where it appears | What we found |
|---|---|---|
| $100M Series C at a $2.2B valuation | Company homepage banner, TechCrunch, tech.eu, Dawn Capital | Four sources agree. The banner reads “Blackwall raises $100M at $2.2B valuation.” |
| AVP leads the round | TechCrunch, tech.eu | Dawn only says it is “excited to welcome our friends at AVP.” AVP’s own website could not be checked. |
| Valuation up fourfold on the 2025 round | TechCrunch, quoting executive chairman Roi Carthy | The article does not give the earlier valuation. |
| Valuation rose from about €221M to €1.03B within a year | tech.eu, September 30 | Siena Secondary Fund’s Rando Rannus expects an independent party to confirm it through the new round. |
| More than half of requests come from machines | Dawn Capital | No percentage or method given. |
| Bots make up 53% of web traffic | Tech Funding News, citing Imperva | No report name or year given. We do not use it. |
| Millions of websites; billions of requests a day | Dawn Capital, tech.eu | No customer or request count behind the claim. |
GateKeeper’s product page lists behavioral analysis, signature detection, HTTP header and request metadata inspection, connection fingerprinting, IP reputation scoring and geofencing. Network-level filtering uses BGP Flowspec, and the target is bots, scrapers and API abuse. The page we read says nothing about AI agent identification or agent-level authorization, and it gives no accuracy figure. The “legitimate AI agent” distinction that TechCrunch describes does not appear there.
According to TechCrunch, the new money will fund expansion across North America, Europe, Asia-Pacific and the Middle East, plus more tools for hosting, cloud and managed service providers. tech.eu says the funding will support operations in 12 strategic regions.
What others say
TechCrunch’s story centers on the multiple. Executive chairman Roi Carthy told the outlet that the round raised the company’s valuation fourfold compared with its 2025 round. The article does not say what that earlier valuation was, so the multiple cannot be checked.
tech.eu starts from a different number. Its September 30 report said Blackwall’s valuation grew about 368% in a year, from around €221 million to €1.03 billion. It quoted Siena Secondary Fund’s Rando Rannus as expecting an independent party to confirm the figure through the new round. The same outlet says Blackwall ranked fifth in TopTech 2026, an annual list of Estonia’s 30 most valuable tech companies compiled by Prudentia Tallinn and Siena Secondary Fund. Its October 20 story also mentions a report last month that put the company at €1 billion.
The two baselines do not fit one valuation curve. Measured from tech.eu’s September starting point, $2.2 billion is well over four times larger. Measured from TechCrunch’s fourfold claim, the earlier round would sit near $550 million. Nothing in the material we read settles which is right.
Tech Funding News disputes the “Europe’s most valuable cybersecurity scaleup” claim, noting that Exein made the same claim at a $1.7 billion valuation.
Dawn Capital, one of the investors, gives the most favorable reading. It describes bot management, WAF, DDoS mitigation, caching and “agent-level access controls” as features a customer can switch on. That is the investor’s account, not an independent measurement. IT之家’s short Chinese report also quotes executive chairman Roi Carthy on the fourfold increase. We found no independent test of detection accuracy in the material we read.
Our take
Our read is that the distribution model matters more than the valuation. A security product a site buys directly leaves the choice with the site owner. A product a host resells puts bot rules and agent policy in the host’s control panel, where most site owners are unlikely to look. That is our judgment, not the company’s.
If your site runs on a managed host, the first step is simple. Look in the control panel for bot management or agent access controls, then ask support which filtering stack sits underneath. TechCrunch reports that Blackwall offers a free tier showing traffic and threats. We did not test its signup flow.
Three things remain uncertain: the valuation starting point, the source of the traffic figures, and whether the “legitimate AI agent” distinction shows up in the product itself. Watch for a public list of hosting partners, an independent detection test, revenue or customer figures, and whether AVP publicly discloses the investment.