Azure Vulns, Vendor Layoff’s, Rob Lee, & Bye Bye Internet Explorer – ESW #277

Vanta raises a $110M Series B to automate SOC 2, ISO, PCI and other compliance efforts

Immuta raises a $100M Series E for secure data access (an everything-old-is-new-again market that’s exploding)

Everyone's reaction, basically: "$100M for a VPN?". I'm sure this is somewhat unfair, but $100M and $1B+ funding definitely seems like a stretch in the seller-saturated and unproven market fit that is the SASE/ZTNA space.

AppOmni is part of what I've been calling the CASBv2 market - focused on discovering and managing security concerns around corporate and shadow SaaS use.

YAAE (Yet Another Azure Escape)

Microsoft Purview appears to be a collection of DLP and NLP functionality that aims to detect compliance or policy issues in data. The existing list of Purview classifications is what you'd expect to find in any DLP product: a pile of regex for detecting PII or financial data for nearly every country on earth: https://docs.microsoft.com/en-us/azure/purview/supported-classifications The NLP bit, which is on Microsoft's roadmap (which doesn't necessarily mean it will ever hit production) is a bit more troubling though. Classifiers include: - Leavers: people planning to leave the organization - Sexual harassment - Corporate sabotage: intentional destruction of corporate assets - Gifts and entertainment: accepting bribes - Money laundering - Stock manipulation - Unauthorized disclosure - Workplace collusion: price fixing, sharing of trade secrets, etc We know DLP is traditionally insanely false-positive prone. If these NLP classifiers are anywhere near that same level of false positives, these classifiers could easily be abused, misunderstood, and misused. False positives are a bit more dangerous when they're inaccurately pointing a finger at an employee.

OneTrust laying off 25% of its workforce, around 950 employees. The largest cybersecurity layoff we've seen this year, but unlikely to be the last...

ID.me lays off 130 employees

https://www.calcalistech.com/ctechnews/article/s1zg60v005

2 months after Automox's first round of layoffs (11% of its workforce) comes its second round (rumored to be an additional 75-100 employees).

Around 37 employees laid off by Deep Instinct

The title's suggestion that somehow, cybersecurity markets should be connected to trends in cybercrime and not actual business market forces is totally wrong, but that's just the age we live in these days. Clickbait. Before we even get to the article proper, the key points admit that these layoffs are due to market forces that have nothing to do with cybercrime trends or ransomware trends. Is there irony in the fact that the cybersecurity market has enjoyed a meteoric rise in value that matches the rise in cybercrime profits? Probably. We might want to look into that.

Competitors complain that Dragos's founder manipulated government efforts to organize and standardize efforts to shore up the defenses of critical infrastructure providers. It is a contentious topic. To those of us used to "vendors vendoring", we're not terribly surprised. Vendors have been trying to insert sales pitches for their products into standards and legislation since cybersecurity standards and legislation have existed. I wouldn't be surprised if some vendors have employees dedicated for this specific purpose - getting on standards review panels, donating their 'expertise', and participating in rounds of comments on standards before they're finalized. Perhaps what makes this situation different is that cybersecurity vendors focused on critical infrastructure are still relatively new, and the folks on the federal side dealing with vendors aren't experienced in spotting and filtering out vendors' attempts to slide in subtle sales pitches. It's an area that deserves more scrutiny and transparency, as self-serving language in standards are more likely to hamper security efforts more than help them, in a holistic sense.

https://nypost.com/2022/06/12/google-engineer-blake-lemoine-claims-ai-bot-became-sentient/

We all know a loss of support doesn't mean much - many enterprises will still have niche needs for Internet Explorer far beyond today's end of support date. They're either unable (e.g. due to third party requirements) or unwilling to pay down the tech debt that puts them in this position, but the chance that continued IE use will bite them will continue to increase with time. For now, we'll celebrate IE's 27 year run with some of the most entertaining Twitter tributes to one of the original browsers that allowed us to navigate the Internet.