On 20 October 2026, Estonian startup Blackwall raised $100 million in a round led by the growth fund AVP, valuing it at about $2.2 billion and strengthening its standing as one of Estonia's newest unicorns, according to ERR News. Blackwall screens web traffic to separate malicious bots from legitimate visitors. ERR's report draws no link to NATO. It does quote Doris Põld, CEO of the Estonian Association of Information Technology and Telecommunications, who suggested that future growth might come from "combining technology and defense".
That caveat matters. Nothing in the reporting says Blackwall is a defence contractor, or that the Tallinn-based NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) had any role in the round. The more interesting story is what the deal says about the ecosystem around Estonia's security reputation.
The case for treating cyber as state business
The strongest argument for heavy state involvement in cyber is Estonia's own history. In 2007, after the relocation of the Bronze Soldier monument, Estonia suffered attacks widely described as the first cyber war. At the peak, 58 Estonian websites were offline at once. Markets alone did not prevent that. A country that depends on digital public services has a legitimate interest in coordinated national defence, and it cannot leave that to whichever vendor happens to be cheapest.
Estonia built that coordination. The CCDCOE was established in Tallinn in 2008, and it has run the Locked Shields live-fire exercise since 2010, per the same e-Estonia account. The state's Information System Authority (RIA) acts as the national cyber security centre. It runs the CERT-EE incident response unit and supervises critical infrastructure. These are public goods. Private firms will not supply them at the right scale, because the benefits are shared across the whole economy.
What Blackwall actually adds
Blackwall's product is a different kind of defence. Filtering bot traffic is the unglamorous layer that decides whether a bank, retailer or government portal stays up during a flood of automated requests. It is also a commercial product that customers across many countries will pay for, which is not true of a national CERT.
The distinction is useful for policy. Public bodies like RIA and the CCDCOE build capability, run exercises and share threat knowledge. A company like Blackwall turns similar operational knowledge into a product that sells globally. The round is evidence that the second step can happen in Estonia. We should not overstate the link, though. The ERR report does not say Blackwall's founders came out of the public system, and we have not verified that they did. The deal shows demand and investor confidence. It does not show that state cyber institutions caused the success.
The risk of over-reading the defence angle
It is tempting to read the Põld comment as a recipe for a national defence-tech strategy, with the state steering venture money toward security. The evidence for that is thin. One round, reported in one outlet, is not a trend. Industrial policy built on a single unicorn tends to reward the firms best at navigating procurement, not the ones with the best products.
There is also a free-expression and open-internet dimension. Bot filtering sits in the path of every visitor to a protected site. Systems that decide who is "legitimate" make errors, and those errors fall on real users, including people using privacy tools, shared networks or assistive technology. Good practice here is not heavy regulation. It means transparency about error rates, a way to appeal a block, and procurement that does not lock public services into one opaque scoring system.
What proportionate policy looks like
Three principles follow from the evidence we do have.
- Keep public defence and commercial products separate. RIA and the CCDCOE should keep doing what markets underprovide: incident response, exercises and shared situational awareness. Direct subsidy for products that already attract $100 million in private capital is hard to justify.
- Use procurement to widen the market. Public agencies can be early, demanding customers without picking winners. Open standards and short contracts let new entrants compete with a unicorn.
- Mind compliance costs. Cyber rules that bind small firms, such as incident reporting and audit duties, should scale with risk. Startups that spend their first years on paperwork do not become the next Blackwall.
What to watch
Two questions will show whether this round is a signal or a one-off. First, whether other Estonian security firms raise comparable growth capital in the next year. Second, whether the defence link Põld described becomes concrete, through products sold to allied militaries or critical-infrastructure operators. Neither is established by the ERR report.
For now, the defensible conclusion is modest but useful. Estonia spent two decades building public cyber capacity after 2007. A private firm in the same country has now raised unicorn-scale money for a cyber product. Policymakers should protect the conditions that let both exist: strong public defence, open procurement, and light-touch rules for the companies that sell to the world.