Funding Rounds Rebound, Bitwarden Password Management, Cymulate, & Ethereum’s Merge – ESW #288

$100M Series B led by PSG, with Battery Ventures. I'm not sure I see enough market for all these password managers to capture. I'd love it if we saw market saturation on both the consumer and enterprise side, but I've been underwhelmed with adoption so far. More and more companies are requiring password database use, so that's a good sign, I think. How does the competition's war chests compare? Let's look at the most recent funding rounds for each: 1Password: $620M Series C in Jan 2022 Dashlane: $110M Series D in May 2019 Keeper Security: $60M PE round in August 2020 LastPass: Recently spun back out of PE-land; $200M revenue in 2021

$70M Series D led by One Peak. Total raised is $141M with a ~$500M valuation. 200 employees, 500 paying customers. Sounds like the Breach and Attack Simulation (BAS) term is out and "Extended Security Posture Management" is in.

$60M strategic growth investment from Francisco Partners. The company's ROAR (Risk Observation, Assessment, and Remediation) platform appears to be a GRC tool, estimating risk and tracking compliance activities

$40M Series B led by Thomvest Ventures. Creator of the Cilium project, which is apparently the default in several managed Kubernetes offerings from GCP and AWS. Also behind eBPF as well??

$40M in debt financing. MDR platform.

$34M Series A led by SignalFire. Data Security Posture Management (DSPM).

$22M Series A (?) led by Insight Partners. SaaS Security (aka CASB v2)

$20M Series B led by Pelion Venture Partners. Total funding at $40M. DSPM

$10M Seed from YL Ventures, Tiger Global, and angels. SOAR v2 - the founders are ex-Siemplify. SOAR v1 was difficult to implement and develop for, which led to this second round of automation/orchestration startups. I presume Opus would be competing with the likes of Rapid7 and Tines.

$6.4M Seed, led by FirstMark Capital and Golden Ventures. Compliance automation, questionnaire assistance, accelerate SOC 2, etc...

German, PE-backed Hornetsecurity is consolidating MSSPs with at least 5 firms acquired so far, and planning more with this financing.

The world of AI art feels like it has exploded overnight. The results range from unbelievable to grotesque. As these tools are rapidly adopted and begin to cross over from hobbyist oddities to commercially useful, there are some tough questions. Should for-profit AI art services be required to pay the artists and respect the copyrights of works that their AI models were trained on? Is the output of an AI art tool really "art" and can it be sold as such? What happens when AI art tools are trained on AI art that trained on AI art that trained on AI art? Is the process of creating a prompt for one of these tools an artistic endeavor? At least one website things so: PromptBase is a marketplace where people can sell the prompts they used to create specific images. This marketplace is an eye opening collection of what these tools are truly capable of. Photorealistic people, clipart, icons, logos, stock photos. Redbubble, Shutterstock, Getty, Fiverr, and the rest of the entire media asset and creation industry must either be very nervous or very litigious right now.

1. No dev environment - engineers test in PROD 2. No one knows what data they have or where it is 3. No central logging capabilities 4. Management is aware of issues, but prioritizes growth over security anyway 5. FTC is being misled 6. 80% of Twitter's user base is outside the US, but has no ability to monitor or review non-english tweets 7. Foreign agents are active in Twitter, but Twitter looks the other way 8. Twitter is reactionary & trails 10 years behind industry best practice 9. Twitter doesn't and can't remove user data, because they don't understand how it's all stored (potential violation of GDPR and CCPA) 10. Twitter employees can manipulate bank account info for large 3rd party advertisers

He also stands to profit from the actual whistleblowing complaint, if it results in fines against Twitter. It is all worth having yourself and family come under attack by armies of lawyers and investment advising firms?

Our very own Katie Teitler has a new newsletter on Substack that you should check out!

We covered this over on Business Security Weekly episode 276, so we won't duplicate the effort here. You should go check that episode out though! https://securityweekly.com/bsw276

Always worth a scroll, Momentum Cyber has some great stats and information on the latest market happenings.

Votiro sanitizes files, messages, and other content. As they've expanded beyond file sanitization, they needed a term that was more inclusive of the new ground they're covering: Zero Trust Content Security. I understand the attraction - Zero Trust is one of the hottest buzzwords right now (https://swagitda.com/blog/posts/infosec-buzzword-bingo-2022/). They're using Zero Trust as a metaphor though, which will only further dilute and confuse literal uses of the Zero Trust term. Good work for industry analysts though, as buyers will turn to them to translate all the latest vendor-speak. I suppose Zero Trust Content Security is better than the long version: API-First Content Disarm and Reconstruction (CDR) Software-as-a-Service.

A nice read from Bessemer on security recommendations for high growth startups, with some commentary from seven well known security leaders (Lenny Zeltser, Kathy Wang, Cassio Goldschmidt, Erik Bataller, Emilio Escobar, Talha Tariq, and Jason Chan). The five security principles proposed are: 1. Build a cybersecurity culture 2. Invest in identity 3. Secure your cloud and development environment 4. Manage your data assets and environment 5. Monitor your third-party risk

This is just one cyber insurance provider I stumbled across the other day, but I found their coverage highlights interesting and revealing. Probably should have occurred to me sooner that the latest cyber insurance product updates can provide a window into trends in attacks and breaches, but here we are. Some of the more notable highlights include: - Cryptojacking coverage - Bricking coverage - Invoice manipulation coverage - Social engineering coverage Their cyber insurance calculators are interesting as well, and a lot of fun to play around with: https://www.at-bay.com/cyber-risk-calculators/

https://arstechnica.com/gadgets/2022/09/usb-c-naming-to-somehow-get-worse-with-usb4-version-2-0/