Categoria: Funding/M&A

PE Firm Francisco Partners to Take Sumo Logic Private in $1.7B Deal

Private equity firm Francisco Partners is acquiring cloud monitoring, log management and SIEM solutions provider Sumo Logic.

The post PE Firm Francisco Partners to Take Sumo Logic Private in $1.7B Deal appeared first on SecurityWeek.

Oligo Security Exits Stealth with $28M for AppSec, Open Source Security

Israeli startup Oligo Security raises $28 million to build technology to detect and mitigate open source code vulnerabilities.

The post Oligo Security Exits Stealth with $28M for AppSec, Open Source Security appeared first on SecurityWeek.

Zscaler to Acquire Israeli Startup Canonic Security

Zcaler plans to acquire Israeli startup Canonic Security to expand into the red-hot software supply chain security business.

The post Zscaler to Acquire Israeli Startup Canonic Security appeared first on SecurityWeek.

Cybersecurity M&A Roundup: 40 Deals Announced in January 2023

Forty cybersecurity-related M&A deals were announced in January 2023.

The post Cybersecurity M&A Roundup: 40 Deals Announced in January 2023 appeared first on SecurityWeek.

Security Awareness Training Startup Riot Raises $12 Million

Riot Security, a startup focused on security awareness training, has secured $12 million in a Series A funding round led by San Francisco-based VC fund Base10.

Riot’s SaaS-based platform provides personalized awareness programs that can be consistently sent to employees in order to foster cybersecurity culture within companies.

The programs are run through an interactive chatbot that integrates with Slack and Microsoft Teams, and the platform offers quick, immersive courses that generate user-specific content, along with regularly simulated phishing attacks to evaluate risks across employees.

Founded by Benjamin Netter, Riot emerged from the YCombinator startup accelerator and raised $3 million in their 2020 seed round. This Series A round brings the total amount raised by the company to $15 million.

Additional investors in the Series A round include existing investors Y Combinator, Funders Club and Founders Future, as well as angel investors such as Snyk founder Guy Podjarny, Duolingo co-founder Severin Hacker, Supercell co-founder lkka Paananen, Deel co-founder Alex Bouaziz, and Slack CPO Tamar Yehoshua.

The post Security Awareness Training Startup Riot Raises $12 Million appeared first on SecurityWeek.

VulnCheck Raises $3.2M Seed Round for Threat Intel

VulnCheck, a Massachusetts startup with ambitious plans in the vulnerability intelligence space, has attracted $3.2 million in seed-stage funding from several prominent investors.

The early-stage financing round was led by Sorensen Ventures and included equity stakes for In-Q-Tel, Lux Capital, and Aviso Ventures.

Based in Lexington, Mass., VulnCheck is building technology that promises exploit intelligence for vulnerability prioritization and an early-warning system for in-the-wild software exploitation activity.

Founded in 2021, VulnCheck is the brainchild of Anthony Bettini, former head of Tenable research and former founder and CEO of FlawCheck and Appthority.

The company has ambitious plans in a category that spans threat-intelligence, attack surface management, red-teaming and penetration testing.

VulnCheck is promising threat intelligence services to help organizations wade through the growing volume of publicly announced vulnerabilities and preemptively take action to stave off malicious hacker attacks.

Attack Surface Management Summit | Virtual Event – February 22, 2023

The VulnCheck offerings include:

VulnCheck Vulnerability Intelligence: a commercial alternative to the NIST National Vulnerability Database (NVD). VulnCheck claims its product includes more data, fields, sources, exploit and remediation intelligence, and provides data weeks earlier.

VulnCheck Exploit Intelligence: helps organizations track all of the world’s exploit proof-of-concept code, exploited in-the-wild information, and exploit metadata, including timelines, to focus remediation resources on the right vulnerabilities.

VulnCheck Initial Access Intelligence: provides organizations the detection artifacts, such as Snort or Suricata signatures, YARA rules, PCAPs, and private exploit PoCs, to defend against initial access vulnerabilities, recently exploited or likely to be soon.

The company and its investors are betting there’s revenue to be found in managing vulnerability and exploit data overload. The idea, according to VulnCheck, is to enrich vulnerability data with information about exploit activity to give security teams visibility and tools to prioritize remediation based on a real-time assessment of live exploitation.

The post VulnCheck Raises $3.2M Seed Round for Threat Intel appeared first on SecurityWeek.

Skybox Security Raises $50M, Hires New CEO

Skybox Security, a late-stage California startup in the security analytics space, has closed a $50 million financing round and hired a new chief executive.

The San Jose company announced Wednesday that former Digital Guardian CEO Mordecai (Mo) Rosen will take the reins at Skybox and manage the company through a new financing round that brings the total raised to $335 million.

The private equity-backed Skybox said investors in the latest round include CVC Growth Funds, Pantheon, and J.P. Morgan.

Skybox has built and marketed a security analytics platform that helps defenders with security policy and vulnerability management tooling. The company’s product suite includes tools for firewall management, automated change management, network assurance, vulnerability control and threat intelligence.

With a new chief executive on board, the company said the plan is to find revenues in the Skybox Cloud Edition, a software-as-a-service product for managing security policy in hybrid multi-vendor environments.

Before joining Skybox, Rosen worked as president and chief executive at data loss prevention software firm Digital Guardian.

The post Skybox Security Raises $50M, Hires New CEO appeared first on SecurityWeek.

Software Supply Chain Security Firm Lineaje Raises $7 Million

Software supply chain security startup Lineaje today announced that it has raised $7 million in a seed funding round led by Tenable Ventures.

Dreamit Ventures and Veear Capital also participated in the investment round, along with various angel investors.

Founded in 2021, the Saratoga, California-based company helps organizations secure their software supply chain, regardless of whether they are the developers, suppliers, or users of software.

Lineaje’s SB0M360 software supply chain management solution can identify all the components of software, along with their dependencies, to assess the supply chain authenticity and identify potential compromise.

Lineaje’s platform manages over 150,000 software bills of materials (SBOMs) across custom applications, open source software, commercial off-the-shelf (COTS) solutions, mobile applications, and containers.

The company is also assisting Tenable Ventures in building shareable data models to improve runtime security and mitigate weaknesses in deployed software.

The funding will allow Lineaje to accelerate go-to-market operations, expand its employee base, and invest in research and development.

The post Software Supply Chain Security Firm Lineaje Raises $7 Million appeared first on SecurityWeek.

ICS Cybersecurity Firm Opscura Launches With $9.4 Million in Series A Funding

Industrial control systems (ICS) cybersecurity company Opscura announced its launch on Tuesday with $9.4 million in Series A funding.

Opscura is a new brand and the company has a new global management team, but it’s not new in the ICS cybersecurity sector. The company was founded in Spain as Enigmedia and it has been around for more than a decade.

Enigmedia co-founders Gerard Vidal and Carlos Tomás will serve as CTO and VP of engineering at Opscura, respectively. David Hatchell has been named Opscura’s CEO.

The new funding round, led by Anzu Partners with participation from Dreamit and Mundi Ventures, will be used for the company’s growth and expansion in the United States.

Opscura provides solutions designed to protect industrial networks by isolating, cloaking and authenticating sensitive assets and data in operational technology (OT) networks. Its cloaking technology obscures deep OT Level 2 network and Layer 2 data without disrupting operations.

The company says its solutions enable organizations to gain deep OT visibility, provide access control capabilities between IT and OT networks, provide protection for critical legacy endpoints, and help reduce the OT attack surface.

Opscura says its solutions are designed to complement the offerings of companies such as Nozomi Networks, Claroty and Fortinet.

The ICS security firm claims to have customers in the transportation, renewable energy, government, manufacturing and chemical sectors.

The post ICS Cybersecurity Firm Opscura Launches With $9.4 Million in Series A Funding appeared first on SecurityWeek.

SecurityWeek Analysis: Over 450 Cybersecurity M&A Deals Announced in 2022

MSSPs took the lead in cybersecurity M&A in 2022 with twice as many deals as in 2021

An analysis conducted by SecurityWeek shows that more than 450 cybersecurity-related mergers and acquisitions were announced in 2022.

In 2022, we tracked a total of 455 deals, compared to 435 in 2021. The US and UK continue to lead in terms of the number of deals, but Israel and Australia were overtaken last year by Canada and Germany.

The number of deals involving companies from the United States increased from 341 to 358, and the UK dropped from 70 to 61 deals.

As for regional data, North America and Europe continue to lead with roughly the same number of M&As as in the previous year. The number of deals involving companies in Asia and Oceania dropped compared to 2021, but M&A activity more than doubled in Latin America.

Financial details of the transaction were disclosed in 62 cases in 2022, significantly less than the 88 deals that had financial terms disclosed in 2021.

In 2022, we saw transactions totaling more than $63 billion in disclosed deal value. Ten companies were acquired for more than $1 billion, roughly the same as in 2021. The most significant deal for the cybersecurity industry was Google’s acquisition of Mandiant.

Thoma Bravo acquired S a ilPoint, Ping Identity, and Forgerock for more than $1 billion, and reportedly sold Barracuda Networks for $4 billion. Vista Equity Partners acquired two companies for over $1 billion: KnowBe4 and Citrix (Citrix was acquired with Evergreen Coast Capital).

Other major deals include Kaseya’s acquisition of Datto, Carlyle Group’s acquisition of ManTech International, and AMD’s acquisition of Pensando.

Roughly the same number of companies as in 2021 was acquired for millions of dollars, but the number of deals for tens and hundreds of millions has dropped from 64 to 38.

As for the types of companies involved in 2022’s cybersecurity M&A deals, managed security services providers (MSSPs) lead by far, with over 150 deals, more than double compared to 2021. Many MSSPs are looking to buy other managed services providers as part of their expansion efforts.

In addition, a recent survey showed that many MSPs are focusing on growing their cybersecurity practices, with many planning to invest in threat intelligence, detection and response, real-time attack visibility, and forensics and incident response.

SecurityWeek is tracking MSSP deals separately. While it’s important to keep track of these transactions as they play a significant role in the cybersecurity industry, we are currently tracking them separately in an effort to get a better view of the other categories.

Deals in the governance, risk and compliance (GRC) category come in second place, with 58 mergers and acquisitions announced in 2022 involving these types of companies. It’s worth noting that GRC exceeded MSSP in 2021, when nearly 80 transactions were announced.

Companies providing network security and identity-related services were, just like in 2021, the third and fourth most common in cybersecurity deals, but the number of deals related to data protection nearly doubled, moving from the tenth position on the chart to the fifth.

Even in the first half of 2022 it was clear that data protection would be in the M&A spotlight, with the number of deals announced in H1 reaching the same level as in the entire 2021.

The number of deals involving government contractors dropped slightly in 2022 compared to 2021, from 43 to 36, but it remained one of the top types of transactions. This includes Carlyle Group’s acquisition of ManTech International for $4.2 billion.

The US government continues to invest in improving its cyber capabilities. As a result, IT and cybersecurity contractors are scrambling to extend and enhance their capabilities through strategic acquisitions that can pay off down the line.

The data collected by SecurityWeek shows that private equity (PE) companies continue to bet big on cybersecurity, with 18 of the mergers and acquisitions announced in 2022 involving PE firms, approximately the same as in the previous year.

PE firms have acquired companies specializing in cloud security, data protection, threat intelligence, risk management, application security, identity, network security, security operations center (SOC), mobile security, secure access, and managed services.

Three of the 2022 cybersecurity M&A deals involved a special purpose acquisition company (SPAC).

There were more than 10 deals for each of the following types of companies: cloud (32), application (24), specialized (22), consulting (21), incident response (20), training (20), threat intelligence (17), and web and email (16).

The ‘specialized’ category includes companies that provide highly focused security services. The list includes — but is not limited to — blockchain, quantum, payment, PR, healthcare, hardware, education, certification, design and automotive.

We are seeing a similar start in terms of the number of M&A deals in 2023. On one hand, the global economic slowdown may lead to a drop in the number of deals in 2023 as companies may be more cautious and delay expansions fueled by acquisitions. On the other hand, we predict that some firms will be keeping a close eye on the market in hopes of buying startups with promising technologies at a discount.

Monthly summaries of 2022 cybersecurity M&A deals: January, February, March, April, May, June, July, August, September, October, November, December.

Methodology: The data was collected from news distribution services, Google and pitches from PR companies. The data includes companies that issued press releases announcing or mentioning acquisitions, as well as deals that have been privately reported to SecurityWeek. All deals that had a cybersecurity component have been taken into account for this study. Mergers and acquisitions that did not have an English-language announcement may not be included. The data could also include deals that may have not been completed after they were announced.

The GRC category includes governance, compliance, risk management, audit, assessment, vulnerability management, penetration testing, attack surface management, and cyber insurance. Network security includes endpoint security, MDR, XDR, NDR, and SASE. Identity includes IAM, PAM, secure access, authentication, authorization and fraud. Incident response includes SOAR, SIEM, SOC, and forensics. ‘Other (specialized)’ includes hardware, blockchain, quantum, payment, healthcare, PR, education, certification, design, and automotive. Data protection includes encryption/cryptography, VPN, privacy and backup. MSSP includes cybersecurity solution distributors and companies that provide security services but do not develop their own products or solutions.

The post SecurityWeek Analysis: Over 450 Cybersecurity M&A Deals Announced in 2022 appeared first on SecurityWeek.