💸 Cybersecurity Funding Leads

Cybersecurity funding leads straight from SEC Form D, the notice a company files with the SEC within 15 days of the first sale in a Regulation D private placement. One qualified_funding_lead row per Form D filing that matches this cut, with the issuer's legal name, CIK, city and state, industry group, total offering, amount sold, first-sale date, exemptions and the EDGAR link — the facts a fund, banker, vendor or recruiter needs to act the same week.

How this cut is defined. Form D industry group is a technology group (Computers, Telecommunications, Other Technology) AND the issuer's legal name contains a security / identity / trust / threat term. Form D has no cybersecurity group, so this is a name-pattern cut: every row carries sector_rule saying so. This is a thin cut — measured on the 2026-09-16 filing date: 0 leads from 14 technology-group filings (none carried a security term that day); a zero-row run bills only the start fee.

Why Form D and not news. The previous version of this actor read startup-news feeds and resolved company domains; those feeds are bot-walled or carry no sector tags, so it returned 0–1 leads per run. Form D is the primary source: the issuer files it, the SEC publishes it, and the actor reads the daily EDGAR index and each filing's XML directly. Pooled investment funds (VC/PE/hedge vehicles raising their own capital) are never delivered as leads.

Output is one qualified_funding_lead row per result; billing is pay-per-event, the value event being one qualified funding lead (a $0.02 start fee per run, then $0.05 per qualified funding lead). Source: www.sec.gov.

No login, no API key and no CAPTCHA solving are involved: the source is read logged-out.

Who buys this

Buyers usually search for cybersecurity funding or SEC Form D funding.

• Sales, SDR and vendor teams building outbound lists from cybersecurity funding.
• VC associates, bankers and analysts scanning SEC Form D funding by sector and geography.
• Recruiters and service providers who sell to companies right after they raise.

📊 Sample Output

Real rows from run ywxXMsWddnmfiV7yn on build 0.1.19 (2026-09-24), the same input as the Quick start below — every value is as the source published it (emails masked, long text shortened):

sector	issuer_name	accession_number	filed_date	industry_group	industry_type
Cybersecurity	Code 13 Security	0002155414-26-000001	2026-09-15	Computers	Computers
Cybersecurity	NightVision Security, Inc.	0002071590-26-000003	2026-09-14	Other Technology	Other Technology
Cybersecurity	Secure Horizon 01-15 LLC	0002154906-26-000001	2026-09-11	Other Technology	Other Technology
Cybersecurity	Cube Security Inc.	0001934798-26-000002	2026-09-11	Other Technology	Other Technology
Cybersecurity	General Cybernetics Corp	0002154072-26-000001	2026-09-09	Other Technology	Other Technology
Cybersecurity	Cybera Global, Inc.	0001927012-26-000003	2026-08-26	Other Technology	Other Technology

The run finished with the status message: NORMAL: 6 Cybersecurity leads from 21 name matches among 549 Form D search hits in the last 30 days (21 fetched, 15 dropped by the technology/first-sale rules, 0 funds/non-matches). billable=6

✅ What you get

One qualified_funding_lead per SEC Form D filing that matches the sector rule; every field is as filed on EDGAR.

Each row is flat JSON with these fields (from the dataset schema and the sample run; a field the source does not publish for a given row is null):

• record_type (string) — e.g. qualified_funding_lead
• sector (string/null) — e.g. Cybersecurity
• sector_rule (string/null) — e.g. Form D industry group is a technology group (Computers, Telecommunications, Othe
• issuer_name (string/null) — e.g. Code 13 Security
• cik (string/null) — e.g. 2155414
• accession_number (string/null) — e.g. 0002155414-26-000001
• form_type (string/null) — e.g. D
• filed_date (string/null) — e.g. 2026-09-15
• industry_group (string/null) — e.g. Computers
• industry_type (string/null) — e.g. Computers
• entity_type (string/null) — e.g. Corporation
• jurisdiction_of_incorporation (string/null) — e.g. COLORADO
• year_of_incorporation (integer/string/null) — e.g. 2022
• issuer_city (string/null) — e.g. LEESBURG
• issuer_state_or_country (string/null) — e.g. VA
• issuer_postal_code (string/null) — e.g. 20175
• issuer_phone (string/null) — e.g. 5713193343
• revenue_range (string/null) — e.g. $1,000,001 - $5,000,000
• federal_exemptions (array/null) — e.g. ["06b"]
• security_types (array/null) — e.g. ["Debt", "Option, Warrant or Other Right to Acquire Security"]
• total_offering_amount (integer/number/null) — e.g. 600000
• total_amount_sold (integer/number/null) — e.g. 235000
• total_remaining (integer/number/null) — e.g. 365000
• investor_count (integer/null) — e.g. 3
• minimum_investment (integer/number/null) — e.g. 10000
• date_of_first_sale (string/null) — e.g. 2026-07-10
• yet_to_sell (boolean/null) — e.g. True
• is_amendment (boolean/null) — e.g. False
• related_persons (array/null) — null in every sample row
• filing_index_url (string/null) — e.g. https://www.sec.gov/Archives/edgar/data/2155414/000215541426000001/index.json
• source_url (string/null) — e.g. https://www.sec.gov/Archives/edgar/data/2155414/000215541426000001/primary_doc.x
• observed_at (string/null) — e.g. 2026-09-24T04:46:26Z

Every run also writes a RUN_RECEIPT record to its key-value store with the source checks it made and the counts it charged — diagnostics never land in the paid dataset.

⚙️ Sample inputs

1. Quick start — the Store example (this is what the sample above came from)

{
  "maxRecords": 10,
  "lookbackDays": 30
}

The sample run charged exactly: 1 × $0.02 apify-actor-start + 6 × $0.05 qualified_funding_lead = $0.32 on the Free tier — every delivered row was billed.

2. A smaller, narrowed run

{
  "maxRecords": 5,
  "lookbackDays": 30
}

Caps the run at 5 rows — about $0.27 on the Free tier ($0.02 start + 5 × $0.05).

3. A full-size run

{
  "maxRecords": 40,
  "lookbackDays": 30
}

Up to 40 rows (the schema default for maxRecords) — about $2.02 on the Free tier ($0.02 start + 40 × $0.05) if the source has that many.

🧾 JSON sample record

One real record from run ywxXMsWddnmfiV7yn, exactly as it lands in the dataset (emails masked, long text shortened):

{
  "record_type": "qualified_funding_lead",
  "schema_version": "2.1",
  "sector": "Cybersecurity",
  "sector_rule": "Form D industry group is a technology group (Computers, Telecommunications, Other Technology) AND the issuer's legal name contains a security/identity/trust term. Form D has no cybersecurity group, so this is a name-pattern cut — verify the",
  "issuer_name": "Code 13 Security",
  "cik": "2155414",
  "accession_number": "0002155414-26-000001",
  "form_type": "D",
  "filed_date": "2026-09-15",
  "industry_group": "Computers",
  "industry_type": "Computers",
  "entity_type": "Corporation",
  "jurisdiction_of_incorporation": "COLORADO",
  "year_of_incorporation": null,
  "issuer_city": "LEESBURG",
  "issuer_state_or_country": "VA",
  "issuer_postal_code": "20175",
  "issuer_phone": "5713193343",
  "revenue_range": "$1,000,001 - $5,000,000",
  "federal_exemptions": [
    "06b"
  ],
  "security_types": [
    "Debt",
    "Option, Warrant or Other Right to Acquire Security"
  ],
  "total_offering_amount": 600000,
  "total_amount_sold": 235000,
  "total_remaining": 365000,
  "investor_count": 3,
  "minimum_investment": 10000,
  "date_of_first_sale": "2026-07-10",
  "yet_to_sell": null,
  "is_amendment": false,
  "related_persons": null,
  "filing_index_url": "https://www.sec.gov/Archives/edgar/data/2155414/000215541426000001/index.json",
  "source_url": "https://www.sec.gov/Archives/edgar/data/2155414/000215541426000001/primary_doc.xml",
  "observed_at": "2026-09-24T04:46:26Z"
}

🔧 How it works

Source. The actor reads www.sec.gov. Public pages and feeds only; nothing behind a login.

Transport. Plain HTTPS from the Apify platform, no proxy.

Terminal states. A run ends NORMAL, CAPPED (your cap was reached), PARTIAL (something was withheld and the message says what), GENUINE_EMPTY (the source was read and truly had nothing in scope) or BLOCKED (the source refused or changed shape — the run FAILS loud and bills nothing). A zero-row run is never reported as a silent success.

Charging. Each qualified funding lead is charged at the moment it is pushed (qualified_funding_lead); a row that fails to charge is not delivered, so the dataset count always equals the charged count.

Finding candidates. Form D has no cybersecurity industry group, so the cut is by issuer name. The actor asks EDGAR's own full-text search (efts.sec.gov) for Form D filings in the last lookbackDays days that contain the sector's name terms (cyber, secure, trust, identity, threat, shield, crypt, sentinel, privacy, firewall, forensic and their stems), applies the name pattern to each hit's issuer name before fetching anything, and then fetches only those filings (filing index + Form D XML from www.sec.gov). Each fetched filing goes through the same engine checks as our Form D watch (technology industry group — Computers, Telecommunications, Other Technology; first sale within 90 days or yet to occur; issuerStates, minTotalOfferingAmount, maxTotalOfferingAmount when set) and pooled investment funds are always dropped. Newest filings first; the run stops at maxRecords.

Fair access. The search host (efts.sec.gov) is paced at about one request per second with retries and backoff; filing fetches on www.sec.gov at most 2 per second with the SEC-required contact User-Agent (overridable with secUserAgent).

No repeats on a schedule. Every row carries the SEC accession number, so a weekly schedule with lookbackDays: 7 delivers each filing once; a 30-day window re-reads filings you may already hold — de-duplicate on accession_number downstream. If EDGAR's search does not answer, the run FAILS with BLOCKED_WITH_ZERO and charges nothing; a window with no matching filings ends GENUINE_EMPTY, also unbilled.

What is not done. No login, no cookie or CAPTCHA bypass, no private or personal-account data, no browser automation.

⏰ Optional: run it on a schedule

A single run returns the current records. If you also want to be told what changed over time, open the actor in Apify Console → Schedules → Create new, add this actor with the input you want, and pick a cadence:

• Daily — 0 7 * * * (07:00 UTC): catch changes within a day.
• Weekly — 0 7 * * 1: a Monday digest.

Each run is independent; keep the same input on the schedule so the results stay comparable. Schedules can also POST results to a webhook (Console → Integrations).

💰 Pricing example

Event	Free	Bronze	Silver	Gold
Actor Start (apify-actor-start)	$0.02	$0.02	$0.02	$0.02
Qualified Funding Lead (qualified_funding_lead)	$0.05	$0.045	$0.04	$0.0335

Worked at the live Free-tier price:

• 6 qualified funding leads: $0.02 start + 6 × $0.05 = $0.32
• 25 qualified funding leads: $0.02 start + 25 × $0.05 = $1.27
• 40 qualified funding leads: $0.02 start + 40 × $0.05 = $2.02

A run that delivers zero rows charges the $0.02 start fee only. A BLOCKED run (source refused) fails loud and charges no value event. The start fee is charged once per GB of run memory; the default run memory is 1024 MB.

Yield on the sample run: NORMAL: 6 Cybersecurity leads from 21 name matches among 549 Form D search hits in the last 30 days (21 fetched, 15 dropped by the technology/first-sale rules, 0 funds/non-matches). billable=6. maxRecords is a hard ceiling on what is delivered and billed, never a target.

⚖️ Legal & ToS

This actor reads public, logged-out pages and feeds published by www.sec.gov. It collects only what the source publishes to any visitor, identifies itself, and does not access accounts, private data or anything behind authentication. Use the output in line with the source's terms and your local law; the intended use is B2B research and monitoring.

❓ FAQ

Q: Do I need an API key or a login?
A: No. The source (www.sec.gov) is read logged-out; the input schema has no key field and the actor carries no secrets.

Q: Why did my run return 0 rows?
A: Read the run's status message. GENUINE_EMPTY means the source was read and had nothing in scope for your input; BLOCKED means the source refused and the run failed without billing a value event — retry later or narrow the input. A zero-row run bills the start fee only.

Q: How many rows can one run return?
A: Up to maxRecords (default 40). Raise the cap for a bigger run; you pay per delivered row.

Q: How fresh is the data?
A: Every run reads the source live at run time; nothing is cached between runs. Put it on a schedule for a continuous feed.

Q: What formats can I export?
A: The dataset downloads as JSON, CSV, Excel, XML or RSS from the run's Dataset tab or the Apify API, and any run can push to a webhook or integration.

Q: How is this different from the other startup funding leads actors?
A: Same output shape and billing model; this one covers www.sec.gov. The siblings under Related Actors cover the other sources or slices — run several on one schedule for a combined feed.

Q: Are there rate limits?
A: The actor paces itself against the source; there is no per-buyer limit beyond your Apify plan's concurrency.

🆘 Troubleshooting

• Run FAILED with BLOCKED → the source refused the request or changed its page shape → nothing was billed beyond the start fee; retry after a while, and if it persists open an Issue with the run id.
• Status says CAPPED → your cap (maxRecords) was reached → raise it for a bigger run.
• Input validation error on start → a field is outside the schema's allowed values → start from the Quick start block and change one field at a time.
• Run TIMED-OUT → a very wide request on a slow day → raise the run timeout in Run options or narrow the input; what was delivered before the timeout is still in the dataset.

🔗 Related Actors

• AI Funding Leads — AI funding leads straight from SEC Form D, the notice a company files with the SEC within 15 days of the first sale in a Regulation D private placeme…
• Biotech Funding Leads — Biotech & health funding leads from SEC Form D: one row per new Form D filed by a Health Care-group issuer (Biotechnology, Pharmaceuticals, Other Hea…
• Climate-Tech Funding Leads — Climate & clean-energy funding leads from SEC Form D: one row per new Form D filed by an Energy Conservation, Environmental Services, Electric Utilit…
• European Startup Funding Rounds Scraper — Scrape European startup funding rounds from EU-Startups' public feed: company, amount, stage, investors and date. One record per result. Pay per resu…
• Fintech Funding Leads — Fintech & financial-services funding leads from SEC Form D: one row per new Form D filed by a Commercial Banking, Insurance, Investment Banking or Ot…
• SEC Form D New Raises Scraper — Scrape new SEC Form D private placement filings: issuer, amount raised, industry, investors and filing date. Every run returns the current records as…
• 🏢 About NexGen Watch — NexGen Watch is a catalog of more than 300 public data actors built on official sources, pay-per-result. Browse the catalog at apify.com/nexgenwatch.

⭐ Found this useful?

If this actor saved you a manual check, a quick review on the Apify Store helps other teams find it. Feature request or a source that changed? Open it from the Issues tab — every one is read.