Secret Double Octopus, Furbies, and Too Much Data! – ESW #347

$33M Series A led by Evolution Equity Partners, bringing total funding to $40M. Salesforce, Tapestry, and Zscaler also participated.

They provide "adaptive and autonomous identity security solutions". AI is also mentioned.

$30M Series B led by Bright Pixel, bringing total funding to $56M. Vuln mgmt is still hanging around. It isn't really getting much easier or quicker, but there's still money to be made off Qualys, Rapid7, and Tenable's scraps.

$15M Series C, led by BGV. Focused on passwordless tech. Was an innovation sandbox finalist, if I recall correctly.

Avalor does "Next-gen Unified Vulnerability Management". Avalar hasn't even hit my radar - are they really worth this much?

It looks like they do more than just vuln mgmt - perhaps a JupiterOne or Axonius competitor? Is there really room in the market for companies like Vicarius and Avalor? We still have a raft of vuln mgmt laggards (Rapid7, Qualys, Tenable, etc), which, in their neglect, gave rise to a new generation of vuln mgmt startups (Vulcan Cyber, Nucleus). In other words, vuln mgmt is near 100% saturation, but is ripe for disruption, so why isn't it happening? Surely not for lack of startups in the space, new or old.

New passwordless vendor.

"PRE Security is leading the transition into the next era of AI cybersecurity with a new model: Predict & Prevent™. By introducing PREdictions to your existing cybersecurity toolset, you can preempt and prevent incidents before they happen."

"Turn on these experimental AI features to organize your tabs, create custom themes and get help with writing on the web"

Mike Privette put together a real-time tracker for public cybersecurity companies. It's pretty basic, but works!

A great discussion about how hard it is to define what qualifies as a "public cybersecurity company". The full list is 71 companies, but with a few caveats...

"Despite continued advances in SecOps tech, data overload remains an issue. On average, more than half (54%) of security alerts go uninvestigated in a typical day - the first time since we've been asking the question that this number has gone over 50%. Nearly 30% of respondents tell us they cannot investigate more than three-fourths of alerts."

It's just fundamentally the wrong approach - SecOps folks are set up to fail. SOCs are a symptom of the problem, not a solution.

Super useful database of breach information with lots of references. I'll be digging into this for sure!

Haroon Meer and Ross Haleliuk had an interesting debate on LinkedIn last week - well worth digging through the arguments, counter-arguments, and comments.

A few things in last week's Cyber Why caught my attention:

• Carta, SaaS for cap table management, appears to have crossed the streams, and shut down part of their business as a result
• Startup Unicorns get redefined as $3B+ valuation???

By my count, there are 44 cybersecurity unicorns right now (I use CBInsight's data). If we move the bar up to $3B, that number goes down to 15. The other problem is that NONE of the unicorns on this list have seen a new valuation since valuations took a beating in mid-2022. We saw Cybereason lose an order of magnitude in value, and Snyk (rumored to) lose 50%, so it's anyone's guess as to which companies are or are not a unicorn on this list.

An essay from me, published on Tyler's substack, The Cyber Why.

Once upon a time, we defined networks we controlled as "private" and thought of them as "trusted". Anything outside our networks was "open", "public", and "untrusted". These days, we know that our private, trusted networks are quite vulnerable.

Because PCI is very slow to evolve, it still embraces this idea of data in transit being more vulnerable on the public Internet than in your private network (or a more secure DMZ within it). Put another way, is Bob from Accounting an easier target than one of Verizon's tier 1 routers?

My girlfriend mentioned to me that we're going to be seeing a lot of these in the near future. The inventors of the Internet and most of the software, standards, protocols, and designs that power today's computing devices are mostly still alive today, but are getting up there in age.

It must be surreal for them, to have created things that seemed niche and ultra-nerdy in the beginning, but became the basis for what is essentially considered an essential utility for much of the world today.

This is the result of votes from ProductHunt users/fans, and it's worth a browse. A lot of these tools are worth checking out, just for personal use and productivity.

It's also useful to see what new products are probably being used within your organization right now, or will be in the near future!

First we find out our phones really are listening to us. Now we find out that a lot of those ads that make apps "free" are being used to track our location.

I feel like I've seen this movie already.

404 Media is just killing it with funny stuff, serious stuff, and everything in between.

DISCLOSURE: I'm a paid subscriber and have collaborated with most of the 404 Media founders and staff when they were back at Vice Motherboard.