Forecasts of a years-long economic downturn aren't stopping cybersecurity investment funds from pouring money into both early- and late-stage security startups — at least for now.

The big picture: As the country awaits a potential economic recession, venture capital deals have started to dry up and startup valuations have shrunk. Still, cyber venture capitalists tell Axios their firms are eager to invest.

• Meanwhile, following two years of sky-high investment activity, some cybersecurity sector investing has slowed, with the number of early-stage deals decreasing 21% between the third quarter last year and the same period this year, according to PitchBook data shared with Axios.

State of play: Four venture capitalists tell Axios their firms are still interested in both early- and late-stage security startups. However, some are shifting to specific product types or asking different financing questions to better protect their investments.

• Christopher Steed, chief investment officer and managing director at cyber investment fund Paladin Capital Group, tells Axios his firm is in "buy mode" for late-seed and Series A cyber startups. Paladin recently raised a $372 million fund.
• Hank Thomas, CEO and co-founder of early-stage investment firm Strategic Cyber Ventures, says his firm is focusing more on cybersecurity companies that provide human-focused solutions, like training programs, as well as products for critical infrastructure companies.
• Morgan Kyauk, a partner at NightDragon, which invests in late-stage companies, says his firm is asking more about what contingency plans their investments have for two years from now if the "financing environment hasn't changed."

Between the lines: Investors anticipate that market demand for new cybersecurity products will continue into a possible recession — justifying continued investor interest in cybersecurity.

• More than half of cybersecurity professionals said in an ISACA survey earlier this year that they anticipate their companies' cyber budgets to increase in the next year.
• The biggest cyber investment opportunities lie in cloud security, software-as-a-service and artificial intelligence tools, says Asheem Chandna, a general partner at Greylock Partners.
• "I do think that despite the [cybersecurity] sector being overfunded, the sector is tremendously ripe for innovation and there are many, many new opportunities," Chandna says.

The intrigue: A forthcoming recession could inspire cybersecurity professionals to turn to entrepreneurship after facing layoffs, Steed says, sparking continued VC interest.

• Thomas points to the example of bitcoin. The digital asset was born out of the 2008 economic recession and is now mentioned in "every fifth conversation" on business-focused TV networks, he says.

What's next: Investors still expect the bear market to catch up to the cybersecurity sector eventually and have been advising their companies accordingly.

• Several investors advise cyber startups to put an emphasis on cutting costs, hiring less and getting as close to breaking even as possible.
• Thomas says some of his consumer-facing companies are also starting to stockpile cash to ensure they have some on hand for future product launches.

Company boards are struggling to get on the same page with lead security executives on how susceptible their organizations are to cyberattacks, according to a new survey.

Driving the news: Email security company Proofpoint and MIT Sloan School of Management's cyber program released a survey Tuesday detailing how 600 board directors worldwide view the cyber threats facing their companies.

• The survey was conducted Aug. 11–22 this year.
• Respondents came from companies with at least 5,000 employees across a range of sectors, such as tech, manufacturing, financial services and retail.

By the numbers: While nearly seven in 10 board members said they see eye to eye with their chief information security officers on cyber threats, only 51% of CISOs felt the same way.

• 65% of board members worldwide said their organizations are at risk of a "material" cyberattack in the next year, compared to 48% of CISOs.
• In the U.S., that discrepancy was higher: 78% of board members said they're at risk, compared to 34% of CISOs.
• Roughly three in four board members globally also believe their organizations have "adequately invested" in cybersecurity.
• 41% of board members believe business email compromises are the biggest threat to their industry this year, compared to 30% of CISOs.

Why it matters: Competing perceptions of the threat landscape could make it difficult for CISOs to get board members to support their plans for securing their organizations.

The big picture: Regulators are considering placing more pressure on board members to understand company cybersecurity plans after a string of high-profile breaches.

• Under proposed SEC rules, company boards of directors would be responsible for conducting oversight of cybersecurity risks.

A ransomware gang published thousands of files about students and employees of the Los Angeles Unified School District over the weekend after the district refused to pay a ransom following last month's attack.

Driving the news: L.A. Unified Superintendent Alberto M. Carvalho confirmed in a tweet Sunday that "a criminal organization" had released the data set.

• Ransomware gang Vice Society, which has claimed responsibility for the ransomware attack, published the apparent leak on its dark web site.
• The district and law enforcement set up an incident response hotline to help anyone affected by the data leak.
• L.A. Unified is the country's second-largest school district, with more than 1,000 schools and 600,000 students.

What they're saying: "Based on what we know today, we are able to confirm that the release was actually more limited than we originally anticipated," Carvalho said during a press conference late Monday, per ABC7.

• He added that officials believe only information stored on one personal computer was accessed and student information was limited to attendance and academic records from 2013–2016.

Catch up quick: For about a month, L.A. Unified has been responding to and recovering from the "significant disruption" to its digital infrastructure.

• Carvalho told the Los Angeles Times on Friday that the district would not pay a ransom to prevent the hackers from leaking any stolen data, saying paying wasn't a guarantee that the hackers wouldn't leak the information anyway.

Threat level: Researchers at Check Point Software Technologies tell Axios that the data leak "appears to be massive," including more than 248,000 files containing Social Security numbers, contracts, employment tax forms, invoices, passports and more.

• The data trove also appears to include health information, COVID-19 test data, previous conviction reports and psychological assessments of students, according to TechCrunch.

The big picture: L.A. Unified joins a growing list of schools that have faced a ransomware attack this year, according to publicly available data.

• The FBI, the Cybersecurity and Infrastructure Security Agency, and the Multi-State Information Sharing and Analysis Center warned last month that Vice Society has been "disproportionately targeting the education sector."

@ D.C.

🗳 Biden administration officials say they haven't yet seen foreign hackers targeting U.S. election systems this year leading up to the midterms. (Wall Street Journal)

📩 The Office of the National Cyber Director is collecting feedback to help inform its forthcoming national cyber workforce strategy. (White House)

🔎 The Cybersecurity and Infrastructure Security Agency is requiring all federal agencies to develop cybersecurity plans that better alert agencies to recently discovered security flaws and scans network assets once a week. (CISA)

@ Industry

🤝 CIOs and CISOs are starting to work more closely together as the cyber threat landscape intensifies. (Wall Street Journal)

💸 Data security startup Securiti has raised a $75 million Series C round led by Owl Rock Capital. (TechCrunch)

@ Hackers and hacks

🗝 Microsoft released guidelines for mitigating recently discovered high-risk security vulnerabilities, but researchers are able to bypass the fix. (BleepingComputer)

🍎 Recently obtained emails paint a picture of how schools have been responding to ransomware attacks in the last two years. (Vice)

📲 A new report says a potential government spyware campaign targeted Mexican journalists and human rights activists between 2019 and 2021, after Mexico's president promised to stop all spyware abuses. (Citizen Lab)

The first dispatch from October's Cybersecurity Awareness Month:

• Rob Joyce, director of cybersecurity at the National Security Agency, shared not one, but two memes already.
• The earnest tweets offering tips and insights about what the month can truthfully accomplish are rolling in.
• And the journalists are already tired.