This Week: short on funding, long on research and analysis & RSAC Interviews – ESW #363
Full Audio
View Show IndexSegments
1. This Week: short on funding, long on research and analysis – ESW #363
Only one funding announcement this week, so we dive deep into Thoma Bravo's past and present portfolio. They recently announced a sale of Venafi to Cyberark and no one is quite sure how much of a hand they had in the LogRhythm/Exabeam merger, and whether or not they sold their stake in the process.
We also have a crazy stat Ross Haleliuk spotted in Bessemer's analysis: "13 out of 14 cybersecurity companies acquired in the past year for over $100M were from Israel". Is this an anomaly? Does it just mean that Israel wasn't shy about selling when the market was down? We discuss.
A number of new product announcements continue to trickle out post-RSA.
We'll also discuss Sam Altman and OpenAI's decision to use Scarlett Johansson's voice against her will and what it could mean for deepfakes, advanced social engineering techniques, and general big tech sliminess.
Do you know what a "product glorifier" is? How about a glowstacker? You will if you check out the second-to-last story in the show notes!
Announcements
Get ready for an electrifying experience at the 15th annual Identiverse! Join 3,000+ identity professionals at the ARIA Resort & Casino in Vegas on May 28-31, 2024, for 4 days packed with dynamic learning & collaboration. Don't miss out on keynote speakers including Denee Defiore, CSIO of United Airlines; Tucker Bryant, Entrepreneur and Former Googler; George Roberts, Director of Identity and Access Engineering at McDonald's and many more!
As a community member, receive 25% off your Identiverse 2024 tickets using code IDV24-SW25!
Register today: securityweekly.com/idv2024
Dive into cybersecurity with CyberRisk Alliance for exclusive insights from RSA Conference 2024. Explore executive interviews with industry leaders, uncovering visionary perspectives on threats and strategies. Delve into curated articles on trends and innovations, equipping yourself with essential knowledge for today's cyber landscape. Visit securityweekly.com/RSAC for expert guidance and inspiration in navigating cybersecurity challenges confidently.
Hosts
- 1. FUNDING: SOCRadar Secures $25.2M in Funding to Combat Multibillion-Dollar Cyber Security Threats
- 2. ACQUISITIONS: CyberArk acquires Venafi for $1.54B, integrating human and machine IAM
We're overdue for a chat about Thoma Bravo. They've been a key exit point for security companies for many years. Let's talk about their past and present portfolio!
ACQUIRED, NOT EXITED
- Darktrace: Acquired for $5.3 billion in 2024.
- Ping Identity: Taken private for $2.8B in 2022 and merged with ForgeRock in 2023
- SailPoint: Taken private for $6.9B in 2022 (damn, they bought a lot of identity players!)
- Proofpoint: Acquired for $12.3 billion in 2021.
- Intel 471: Acquired for ??? in 2021. Acquired SpiderFoot and Cyborg Security.
- Sophos: Acquired for $3.9 billion in 2020.
- ConnectWise: Acquired for ??? in 2019. Acquired Continuum, ITBoost, Service Leadership, SmileBack, and Wise-Sync
- Apptio: Acquired for $1.94 billion in 2018.
- Imprivata: Taken private for $544M in 2016. Acquired Xton Technologies in 2021
ACQUIRED AND NOT SURE
- LogRhythm: Acquired for ??? in 2018 and merged with Exabeam in 2024, but not sure if Thoma Bravo exited in the process.
ACQUIRED AND EXITED
- ForgeRock: Acquired for $2.3B in 2023 and merged with Ping Identity in 2023
- Venafi: Acquired for ??? in 2020, and sold to CyberArk for $1.54B in 2024
- Exostar: Acquired for ??? in 2020 and sold to Arlington Capital Partners for ??? in 2023
- Imperva: Acquired for $2.1 billion in 2019 and sold to Thales for $3.6 billion in 2023.
- Veracode: Acquired from Broadcom for $950M in 2019 and sold to TA Associates for $2.5B in 2022.
- Delinea: Acquired as Centrify for ??? in 2018. Spins out IDaaS business as Idaptive. Sells to TPG for ??? in 2021. TPG merges Centrify with Thycotic in 2021 and rebrands as Delinea in 2022. Acquires Fastpath in 2024.
- Barracuda Networks: Acquired for $1.6B in 2018. Acquires SKOUT Cybersecurity in 2021. Sells to KKR in 2022 for ???
- Continuum: Acquired in 2017 for ??? and merged with ConnectWise in 2019
- Bomgar: Acquired for ??? from TA Associates in 2016 and sold to Francisco Partners for ??? in 2018. FP combines it with BeyondTrust and rebrands to BeyondTrust
- DigiCert: Acquired in 2015 for ??? and sold to TA Associates and Clearlake Capital for ??? in 2019.
- Blue Coat Systems: Acquired for $1.3 billion in 2012 and sold to Symantec for $4.65 billion in 2016.
- Tripwire: Acquired for ??? in 2011 and sold to Belden for $710 million in 2015.
- LANDESK: Acquired for ??? in 2010 and sold to Clearlake Capital for ??? in 2017. Clearlake combined it with HEAT Software to create Ivanti.
- SonicWall: Took private for $717M in 2010 and sold to Dell for $1.2B in 2012.
- Entrust: Acquired in 2009 for $124M and sold to Datacard for ??? in 2013.
Hungry for even more details? Check out Cole Grolmus's piece on Thoma Bravo here: https://strategyofsecurity.com/bravo-thoma-bravo/
- 3. MARKET ANALYSIS: Ross Haleliuk on LinkedIn: 13 out of 14 cybersecurity companies acquired in the past year for over $100M were from Israel.
From Ross's post:
"13 out of 14 cybersecurity companies acquired in the past year for over $100M were from Israel.
Bessemer recently published their 'Cybersecurity Trends in 2024' report. The report states that -
"Reflecting on the past year's acquisitions valued over $100 million, we observe two main trends: (1) most acquired companies had between 10 and 50 customers and were primarily targeted for their teams and products, and (2) the acquisition price for “product-only” companies has increased with a median of ~$200 million to $300 million over the past year."
One thing the report doesn't mention is that with the exception of Tessian which is based in the UK, all other startups are from Israel. Interestingly, the acquisition price for Tessian wasn't disclosed so even Bessemer ended up just putting '??' in place of one."
- 4. NEW COMPANIES: Guardz – The AI-Powered Cybersecurity and Cyberinsurance Provider
"tailored specifically for SMBs and their MSP partners"
- 5. NEW PRODUCTS: Cisco Hypershield: Reimagining Security
- 6. NEW PRODUCTS: Reveald Launches Epiphany Validation Engine to Enhance AI-Driven Cyber Resilience
I'm still getting used to CTEM instead of BAS, but I get very excited about any tech that lets defenders emulate attackers accurately, so that they can test the effectiveness of their controls.
- 7. AI ABUSE: What ScarJo v. ChatGPT Could Look Like in Court
In cybersecurity, it's important to try to anticipate what I call "abuse cases" - ways in which technology can be misused and abused, causing financial losses, reputational harm, or consumer/customer harm.
They're usually not demonstrated so explicitly by the founders of huge tech companies, but that's exactly what happened when Sam Altman decided to copy Scarlett Johansson's voice. Altman wanted to use the actress's voice for marketing, effectively reprising her role as the AI in the movie "Her".
He allegedly asked her to do some recordings for OpenAI last September, and she declined. Sam Altman found a way to use her voice anyway in an OpenAI demo, also tweeting "her" in case there was any uncertainty that the company's marketing was referencing the movie.
It's unclear if they used a voice actor soundalike, or generated her voice using AI (which seems more likely, given OpenAI's skillsets and access to AI tech), but regardless it created quite the debate when Johansson spoke out against the use of her voice without her consent.
The question now is, can they get away with it? If the answer is yes, then anyone's visual or audible likeness could simply be used for whatever by corporate entities, which doesn't seem like a great precedent to set. And can they weasel out of it by saying the likeness is a coincidence, or was unintended?
This precedent is exactly the concern in cybersecurity of executives being impersonated to pull off financial scams like BEC, or to fraudulently bypass identity verification measures.
Paul Graham wrote, "Though the most successful founders are usually good people, they tend to have a piratical gleam in their eye. They're not goody-two-shoes good. Morally they care about getting the big questions right but not about observing proprieties. That's why I'd use the word "naughty" rather than evil. They delight in breaking rules--but not rules that matter."
Do we think this is a rule that matters?
- 8. AI NEWS: Tech giants pledge AI safety commitments — including a ‘kill switch’ if they can’t mitigate risks
- 9. RESEARCH: A Third of CISOs Have Been Dismissed “Out of Hand” By the Board
- 10. RESEARCH: Last Week in GAI Security Research – 05/20/24
This is a great newsletter that summarizes GenAI research. I believe strongly that cybersecurity folks need to stay on top of the latest tech innovations and research, so that we can prepare ourselves and our people for What Comes Next.
There are some particularly interesting research papers in this week's edition.
- We continue to see purpose-built LLMs being trained. One paper focuses on LLMs that excel at steganalysis!
- Using LLMs to detect particular types of DDoS attacks
- SMS spam setection with explainability analysis
- Cyber activity news alerting language model (CANAL)
- and several more!
I'll never have time to read them all - maybe an LLM can help me out?
- 11. DUMPSTER FIRES: University Suspends Students for AI Tool It Gave Them $10,000 Prize to Make
This won't be the last we see of unintended consequences, or uninformed parties celebrating AI for the wrong reasons, and then shunning it, also for the wrong reasons. What a mess this school created.
- 12. TUTORIAL: Chaotic Good: Resilience Stress Tests at the Edge
Learn how to chaos engineer, from the queen of security chaos herself, Kelly Shortridge!
- 13. POST MORTEMS: A Bird’s-eye view: IceID to Dagon Locker (The DFIR Report)
Y'all know me - I LOVE pulling actionable lessons out of threat intel or a breach post mortem. The excellent DFIR Report has a new post out, and it's worth your time to dig through. Casey Smith, over at Thinkst, dug into it and shares how to use Canaries and Canarytokens to detect the TTPs explored in the DFIR Report writeup.
- 14. ESSAYS: Glory to the Glorifier
A very fun writeup from Thinkst about how they developed a stand to display their physical canaries at conference booths. It sounds like a small thing, but it's a window into Thinkst's success and their "if we're going to do a thing, we're going to do it well" philosophy.
No, it has nothing to do with cybersecurity, but it has everything to do with what's wrong with many cybersecurity vendors out there. Most VC-funded startups optimize to delight the investor and the acquirer, but rarely the customer. The points are for hitting the finish line at [time] with [amount] of ARR. There are no points for a working product, happy customers, good customer retention, or even sustainable growth.
- 15. SQUIRREL: “The Great Data Heist” Salesforce AI Ads with Matthew McConaughey
2. Unified Identity Security, Identity is Under Attack & Identity is Security – Andre Durand, David Bradbury, Wendy Wu – ESW #363
The next generation of identity security is not about the popular idea of convergence, but of unification. A single, AI-driven solution that integrates PAM with identity security and access management is the clear path forward to manage and secure all enterprise data through a unified control point.
Segment Resources: • https://www.sailpoint.com/products/identity-security-cloud/atlas/ • https://www.sailpoint.com/press-releases/sailpoint-accelerates-innovation-with-its-identity-security-platform-sailpoint-atlas/ • https://www.sailpoint.com/press-releases/sailpoint-leads-identity-security-evolution-through-relentless-innovation/ • https://www.sailpoint.com/navigate/
This segment is sponsored by SailPoint. Visit https://securityweekly.com/sailpointrsac to learn more about them!
Over the past 15 years, identity has evolved from a perimeter-based security model with clear boundaries to one that is fluid, flexible, and permeates every aspect of digital business. Simultaneously, AI has infiltrated every enterprise, becoming a double-edged sword for defenders, and fueling fraud attacks across every sector.
In this interview, Ping Identity CEO Andre Durand will walk through the evolution of the identity attack surface, and the opportunity decentralized identity has to dramatically improve both security and experience by putting users in control. He'll also discuss the increasing threats to individuals and businesses, given the influx of AI, and why we should consider this the era of “verify more, trust less.”
This segment is sponsored by Ping Identity. Visit https://securityweekly.com/pingrsac to learn more about them!
As companies adopt new digital cloud technologies, cybercrime threats are on the rise and becoming more sophisticated. Identity has come under attack in today’s digital-first environment and is critical to ensure we can securely connect people to technology. Okta is on a mission to eliminate identity threats and clear the path for organizations to safely use any technology.
Segment Resources: https://www.okta.com/blog/2024/02/introducing-the-okta-secure-identity-commitment/
https://www.okta.com/products/okta-ai/
https://www.okta.com/blog/2024/02/okta-acquisition-advances-identity-powered-security/
This segment is sponsored by Okta. Visit https://securityweekly.com/oktarsac to learn more about them!
Sponsored By
Guests
Andre Durand is the founder and CEO of Ping Identity, a leading provider of enterprise identity security serving over half of the Fortune 100 and 3 billion identities worldwide. Thoma Bravo acquired Ping in 2022 then combined with ForgeRock in 2023 to offer more choice and flexibility to address the varied needs of customers worldwide. Prior to founding Ping Identity in 2002, Durand founded Jabber which was acquired by Cisco in 2008.
David Bradbury is the Chief Security Officer at Okta. He oversees security execution, and is responsible for a team navigating the evolving threat landscape to best protect employees and customers. He is also at the forefront of helping Okta’s customers adopt and accelerate Zero Trust security strategies.
Prior to Okta, David was the Senior Vice President and Chief Security Officer at Symantec where he oversaw all cyber security and physical security programs. He has an international reputation for leading and delivering cybersecurity at scale. David has worked across the globe from his native Australia to the UK and the US, leading highly regarded security teams at some of the world’s largest banks including ABN AMRO, Barclays, Morgan Stanley and the Commonwealth Bank of Australia.
David has a Bachelor’s Degree in Computer Science from the University of Sydney.
Wendy Wu is the CMO at SailPoint, bringing over 23 years of experience in B2B enterprise marketing. Prior to joining in 2021, she was Vice President of Marketing at Box, where she led the global demand generation team to fuel the growth of the business as a leading content cloud platform. Before Box, Wendy spent eight years at Google Cloud. While there, she built the demand generation team for the Google Cloud Platform, eventually scaling the global marketing programs to support a multi-billion-dollar business. Before Google, Wendy held various product marketing and marketing leadership roles at Microsoft and other global companies.
Hosts
3. Secure Code From the Start, Security Validation & Platformization – Maxime Lamothe-Brassard, Volkan Ertürk, Chris Hatter – ESW #363
Qwiet AI provides real time detection of security vulnerabilities in code along with the best AI generated fixes to aid developers in finding and fixing their code with the addition of AI AutoFix.
This segment is sponsored by Qwiet AI. Visit https://securityweekly.com/qwietrsac to learn more about them!
With scores of security tools implemented, configured, and integrated security teams are overwhelmed while knowing there is still a possibility for a breach. As they work to prioritize threat exposures, it is imperative for organizations to have a clear, context-rich, and up-to-date view of their security posture. Picus Security CTO and Co-founder, Volkan Ertürk, explains how consistent security validation allows security teams to pinpoint gaps, prioritize, and quantify risk so they can reduce threat exposure.
Segment Resources: Picus Red Report 2024: https://www.picussecurity.com/hubfs/Red%20Report%202024/Picus-RedReport-2024.pdf
This segment is sponsored by Picus Security. Visit https://www.securityweekly.com/picusrsac to learn more about them!
Platformization could mean reduction in innovation, reduction in the ability to be flexible, and less competition. But it doesn't have to be this way. Like the IT industry, there are ways for the cybersecurity industry to platformize, but also to have this become a net benefit to the industry as a whole.
Segment Resources: Navigating the SecOps Cloud Platform webinar recording: https://www.youtube.com/watch?v=MbzvLX-W2KY
Recon Infosec Case Study: https://info.limacharlie.io/hubfs/Case%20Studies/LimaCharlieReconInfosecMSSPCase_Study.pdf
Blumira Case Study: https://info.limacharlie.io/hubfs/Case%20Studies/LimaCharlieBlumiraCase_Study.pdf
This segment is sponsored by LimaCharlie. Visit https://securityweekly.com/limacharliersac to learn more about them!
Sponsored By
Guests
Maxime began his career in cybersecurity working for the Canadian Security Establishment (CSE). CSE is Canada’s national cryptologic agency, providing the Government of Canada with information technology security and foreign
signals intelligence. As part of the Canadian Intelligence apparatus, Maxime worked in positions ranging from the development of cyber defense technologies, Counter Computer Network Exploitation, and Counter Intelligence.
After leaving the government, Maxime provided direct help to private and public organizations in matters of cyber defense. He was an early employee at Crowdstrike, then worked for Google where he eventually landed in Google X. Maxime left Google X – where he was a founding member of Chronicle Security – in 2018 to found LimaCharlie.
Volkan Ertürk is the Co-founder and CTO of Picus Security. Volkan has more than 20 years of business and technical leadership experience in IT security. He has advised several enterprises and government agencies on security audits, policy and process development, and architecture topics before founding Picus Security. He also worked as cyber defense specialist and instructor at the NATO Science for Peace and Security program.
Volkan holds B.S. in Mathematics and M.S. in Information Systems; thesis on continuous security monitoring. He is a Ph.D. candidate in Information Security.
Chris Hatter serves as the COO/CISO of Qwiet.AI, an AI-powered AppSec platform. Additionally, Chris is an Operating Partner at NumberOneAI where he provides technical leadership to portfolio companies within the incubator.
He has over a decade of experience in cybersecurity strategies, managing threats and vulnerabilities, risk assessment, cyber resilience, legal and compliance issues, and crisis management. Prior to his current roles at Qwiet and N1AI, Chris served as the Global CISO for Nielsen, at the time, a global technology and data company that operated in over 150 countries with 80,000+ employees.
Chris holds a Bachelor of Business Administration in Management Information Systems from the University of South Florida and sits on the university’s advisory board of cybersecurity for executives.
Hosts