ForgeRock files for IPO as identity and access management business grows

ForgeRock filed its form S-1 with the Securities and Exchange Commission (SEC) this morning as the identity management provider takes the next step toward its IPO.

The company did not provide initial pricing for its shares, which will trade on the New York Stock Exchange under the symbol FORG. The IPO is being led by Morgan Stanley and J.P. Morgan Chase & Co., with the company being valued as high as $4 billion, according to Bloomberg, which is a significant uplift over the $730 million post-money value that PitchBook had for the company after its last round in 2020.

With the ever-increasing volume of cybersecurity attacks against organizations of all sizes, the need to secure and manage user identities is of growing importance. Based in San Francisco, ForgeRock has raised $233 million in funding across multiple rounds. The company’s last round was a $93.5 million Series E announced in April 2020, which was led by Riverwood Capital alongside Accenture Ventures. At that time, CEO Fran Rosch told TechCrunch that the round would be the last before an IPO, which was also what former CEO Mike Ellis told us after the startup’s $88 million Series D in September 2017.

While the timing of its IPO might have been unclear over the last few years, the company has been on a positive trajectory for growth. In its S-1, ForgeRock reported that as of June 30, its annual recurring revenue (ARR) was $155 million, representing 30% year-over-year growth. 

While revenue is growing, losses are narrowing as the company reported a $20 million net loss down from $36 million a year ago. There certainly is a whole lot of room to grow, as the company estimates that the total global addressable market for identity services to be worth $71 billion. 

Among the many competitors that ForgeRock faces is Okta, which went public in 2017 and has been growing in the years since. In March, Okta acquired cloud identity startup Auth0 for $6.5 billion in a deal that raised a few eyebrows. Another competitor is Ping Identity, which went public in 2019 and is also growing, reporting on August 4 that its ARR hit $279.6 million in its quarter ended June 30, for a 19% year-over-year gain. There have also been a few big exits in the space over the years, including Duo Security, which was acquired by Cisco for $2.35 billion in 2018.

“ForgeRock has a good access management tool and they continue to be a strong player in customer identity and access management (CIAM),” commented Michael Kelley, senior research director at Gartner.

Kelley noted that in 2020, ForgeRock converted most of its core access management services to a SaaS delivery model, which helped the company catch up with the rest of the market that already offered access management as SaaS. Also last year the company expanded into identity governance, introducing a brand new identity, governance and administration (IGA) product.

“I think one of the more interesting products that ForgeRock offers is ForgeRock Trees, which is a no-code/low-code orchestration tool for building complex authentication and authorization journeys for customers, which is particularly helpful in the CIAM market,” Kelly added.

ForgeRock was founded in 2010, but its roots go back even further to an open-source single sign-on project known as OpenSSO that was created by Sun Microsystems in 2005. When Oracle acquired Sun Microsystems in early 2010, a number of its open-source efforts were left to languish, which is what led a number of former Sun employees to start ForgeRock. 

Over the last decade, ForgeRock has expanded significantly beyond just providing a single sign-on to providing an identity platform that can handle consumer, enterprise and IoT use-cases. The company’s platform today handles identity and access management as well as identity governance.

The ability to scale is a key selling point that ForgeRock makes in the S-1, noting that its platform can handle over 60,000 user-based access transactions per second per customer. 

“As of June 30, 2021, we had four customers with 100 million or more licensed identities, the company stated in the S-1. “Our ability to serve mission-critical needs in complex environments for large customers enables us to grow our base of large customers and expand within each of them. “

 

#access-management, #cloud-applications, #duo-security, #exit, #forgerock, #identity-management, #initial-public-offering, #ipo, #okta, #ping-identity, #san-francisco, #security, #startups

Microsoft’s cyber startup spending spree continues with CloudKnox acquisition

Microsoft has acquired identity and access management (IAM) startup CloudKnox Security, the tech giant’s fourth cybersecurity acquisition this year.

The deal, the terms of which were not disclosed, is the latest cybersecurity acquisition by Microsoft, which just last week announced that it’s buying threat intelligence startup RiskIQ. The firm also recently acquired IoT security startups CyberX and Refirm Labs as it moved to beef up its security portfolio. Security is big business for Microsoft, which made more than $10 billion in security-related revenue in 2020 — a 40% increase from the year prior.

CloudKnox, which was founded in 2015 and emerged from stealth two years later, helps organizations to enforce least-privilege principles to reduce risk and help prevent security breaches. The startup had raised $22.8 million prior to the acquisition, with backing from ClearSky, Sorenson Ventures, Dell Technologies Capital, and Foundation Capital. 

The company’s activity-based authorization service will equip Azure Active Directory customers with “granular visibility, continuous monitoring and automated remediation for hybrid and multi-cloud permissions,” according to a blog post by Joy Chik, corporate vice president of identity at Microsoft. 

Chik said that while organizations were reaping the benefits of cloud adoption, particularly as they embrace flexible working models, they often struggled to assess, prevent and enforce privileged access across hybrid and multi-cloud environments.

“CloudKnox offers complete visibility into privileged access,” Chik said. “It helps organizations right-size permissions and consistently enforce least-privilege principles to reduce risk, and it employs continuous analytics to help prevent security breaches and ensure compliance. This strengthens our comprehensive approach to cloud security.”

In addition to Azure Active Directory, Microsoft also plans to integrate CloudKnox with its other cloud security services including 365 Defender, Azure Defender, and Azure Sentinel.

Commenting on the deal, Balaji Parimi, CloudKnox founder and CEO, said: “By joining Microsoft, we can unlock new synergies and make it easier for our mutual customers to protect their multi-cloud and hybrid environments and strengthen their security posture.”

#access-management, #active-directory, #ceo, #cloud-computing, #cloud-infrastructure, #computer-security, #computing, #cyberx, #dell-technologies-capital, #foundation-capital, #microsoft, #palo-alto-networks, #riskiq, #security, #security-startups, #technology

RSA spins off fraud and risk intelligence unit as Outseer

RSA Security has spun out its fraud and risk intelligence business into a standalone company called Outseer that will double down on payment security tools amid an “unprecedented” rise in fraudulent transactions.

Led by CEO Reed Taussig, who was appointed head of RSA’s Anti-Fraud Business Unit last year after previously serving as CEO of ThreatMetrix, the new company will focus solely on fraud detection and management and payments authentication services.

Outseer will continue to operate under the RSA umbrella and will inherit three core services, which are already used by more than 6,000 financial institutions, from the company: Outseer Fraud Manager (formerly RSA Adaptive Authentication), a risk-based account monitoring service; 3-D Secure (formerly Adaptive Authentication for eCommerce), a card-not-present and digital payment authentication mapping service; and FraudAction, which detects and takes down phishing sites, dodgy apps and fraudulent social media pages.

Outseer says its product portfolio is supported by deep investments in data and science, including a global network of verified fraud and transaction data, and a risk engine that the company claims delivers 95% fraud detection rates.

Commenting on the spinout, Taussig said: “Outseer is the culmination of decades of science-driven innovation in anti-fraud and payments authentication solutions. As the digital economy continues to deepen, the Outseer mission to liberate the world from transactional fraud is essential. Our role as a revenue enabler for the global economy will only strengthen as every digital business continues to scale.”

RSA, meanwhile, will continue to focus on integrated risk management and security products, including Archer for risk management, NetWitness for threat detection and response, and SecureID for identity and access management (IAM) capabilities.

The spinout comes less than a year after private equity firm Symphony Technology Group (STG), which recently bought FireEye’s product business for $1.2 billion, acquired RSA Security from Dell Technologies for more than $2 billion. Dell had previously acquired RSA as part of its purchase of EMC in 2016.

It also comes amid a huge rise in online fraud fueled by the COVID-19 pandemic. The Federal Trade Commission said in March that more than 217,000 Americans had filed a coronavirus-related fraud report since January 2020, with losses to COVID-linked fraud totaling $382 million. Similarly, the Consumer Financial Protection Bureau fielded 542,300 fraud complaints in 2020, a 54% increase over 2019.

RSA said that with the COVID-19 pandemic having fueled “unprecedented” growth in fraudulent transactions, Outseer will focus its innovation on payments authentication, mapping to the EMV 3-D Secure 2.x payment standard, and incorporating new technology integrations across the payments and commerce ecosystem. 

“Outseer’s reason for being isn’t just focused on eliminating payments and account fraud,” Taussig added. “These fraudulent transactions are often the pretext for more sinister drug and human trafficking, terrorism, and other nefarious behavior. Outseer has the ability to help make the world a safer place.”

Valuation information for Outseer was not disclosed, nor were headcount figures mentioned in the spinout announcement. Outseer didn’t immediately respond to TechCrunch’s request for more information. 

#3-d, #access-management, #articles, #ceo, #consumer-financial-protection-bureau, #crime, #deception, #e-commerce, #emc, #emv, #federal-trade-commission, #fireeye, #fraud, #head, #identity-theft, #online-fraud, #payments, #phishing, #risk-management, #rsa-security, #security, #symphony-technology-group, #threatmetrix

Cycode raises $20M to secure DevOps pipelines

Israeli security startup Cycode, which specializes in helping enterprises secure their DevOps pipelines and prevent code tampering, today announced that it has raised a $20 million Series A funding round led by Insight Partners. Seed investor YL Ventures also participated in this round, which brings the total funding in the company to $24.6 million.

Cycode’s focus was squarely on securing source code in its early days, but thanks to the advent of infrastructure as code (IaC), policies as code and similar processes, it has expanded its scope. In this context, it’s worth noting that Cycode’s tools are language and use case agnostic. To its tools, code is code.

“This ‘everything as code’ notion creates an opportunity because the code repositories, they become a single source of truth of what the operation should look like and how everything should function, Cycode CTO and co-founder Ronin Slavin told me. “So if we look at that and we understand it — the next phase is to verify this is indeed what’s happening, and then whenever something deviates from it, it’s probably something that you should look at and investigate.”

Cycode Dashboard

Cycode Dashboard. Image Credits: Cycode

The company’s service already provides the tools for managing code governance, leak detection, secret detection and access management. Recently it added its features for securing code that defines a business’ infrastructure; looking ahead, the team plans to add features like drift detection, integrity monitoring and alert prioritization.

“Cycode is here to protect the entire CI/CD pipeline — the development infrastructure — from end to end, from code to cloud,” Cycode CEO and co-founder Lior Levy told me.

“If we look at the landscape today, we can say that existing solutions in the market are kind of siloed, just like the DevOps stages used to be,” Levy explained. “They don’t really see the bigger picture, they don’t look at the pipeline from a holistic perspective. Essentially, this is causing them to generate thousands of alerts, which amplifies the problem even further, because not only don’t you get a holistic view, but also the noise level that comes from those thousands of alerts causes a lot of valuable time to get wasted on chasing down some irrelevant issues.”

What Cycode wants to do then is to break down these silos and integrate the relevant data from across a company’s CI/CD infrastructure, starting with the source code itself, which ideally allows the company to anticipate issues early on in the software life cycle. To do so, Cycode can pull in data from services like GitHub, GitLab, Bitbucket and Jenkins (among others) and scan it for security issues. Later this year, the company plans to integrate data from third-party security tools like Snyk and Checkmarx as well.

“The problem of protecting CI/CD tools like GitHub, Jenkins and AWS is a gap for virtually every enterprise,” said Jon Rosenbaum, principal at Insight Partners, who will join Cycode’s board of directors. “Cycode secures CI/CD pipelines in an elegant, developer-centric manner. This positions the company to be a leader within the new breed of application security companies — those that are rapidly expanding the market with solutions which secure every release without sacrificing velocity.”

The company plans to use the new funding to accelerate its R&D efforts, and expand its sales and marketing teams. Levy and Slavin expect that the company will grow to about 65 employees this year, spread between the development team in Israel and its sales and marketing operations in the U.S.

#access-management, #agile-software-development, #aws, #bitbucket, #checkmarx, #continuous-integration, #cycode, #devops, #enterprise, #funding, #fundings-exits, #github, #gitlab, #insight-partners, #israel, #jenkins, #recent-funding, #security, #security-tools, #software-development, #software-engineering, #startups, #tc, #united-states, #version-control, #yl-ventures

Pitching access management on the fly, Los Angeles-based Britive raises $5.4 million

It seems Los Angeles is becoming an enterprise software hotspot.

LA saw its first big enterprise exit in recent memory with the recent acquisition of Signal Sciences for $775 million, and less than a month later a hometown startup, Britive has raised $5.4 million from LA’s own venture fund, Upfront Ventures and a clutch of security experts.

For chief executive Artyom Poghosyan and chief technology officer Alex Gudanis, Britive is simply the latest initiative in a decades-long effort to reshape security technology.

Both Poghosyan and Gudanis have long histories in identity and access management, back in 2009 Poghosyan founded Advancive Technology Solutions, which was acquired by Optiv in 2015 to bulk up its identity access management service.

Now, he and Gudanis are trying to solve the issues of identity access management that the new, ubiquitous cloud computing model presents for security officers and developers.

“When Optiv acquired us, we were already seeing interesting and strong signals in the technolog space about the disruption that was being driven by cloud technologies,” said Poghosyan.

Those cloud technologies presented new challenges for the kind of privileged access management technologies that Poghosyan had developed.

The solution that Britive pitches is a dynamic model for granting permissions for access, Poghosyan said. Instead of granting permanent access to, there re policy-based pre authorizations that a company can set up defined for specific tasks and roles.

Based on a developer’s role and work, they can request and receive access automatically based on the specific parameters defined by a company or security officer.

The company already has over a dozen customers using its technology after launching merely two years ago. It’s a customer base that includes one of the world’s largest carmakers and a global clothing brand — companies Poghosyan declined to identify, citing contractual obligations.

The company charges based on the number of users who are requesting permission for access, Poghosyan said.

As more companies move to remote work in the COVID-19 era and distributed teams become the norm, streamlining the provisioning and access management process for companies is going to become even more important.

Undoubtedly, that’s why Britive was able to land investors like Upfront Ventures and why their partner, Kara Nortman is joining the company’s board of directors. It’s also the reason the company was able to attract some of LA’s leading enterprise executives to back the company, including Andrew Peterson, CEO of Signal Sciences and Dave Cole, CEO of Open Raven.

 

#access-management, #ceo, #chief-technology-officer, #dave-cole, #identity-access-management, #kara-nortman, #los-angeles, #signal-sciences, #tc

‘One day we were in the office and the next we were working from home’

Ryan Easter couldn’t believe he was being asked to run a pandemic business continuity test.

It was late October, 2019 and Easter, IT Director and a principal at Johnson Investment Counsel, was being asked by regulators to ensure that their employees could work from home with the same capabilities they had in the office. In addition, the company needed to evaluate situations where up to 50% of personnel were impacted by a virus and unable to work, forcing others to pick up their internal functions and workload.

“I honestly thought that it was going to be a waste of time,” said Easter. “I never imagined that we would have had to put our pandemic plan into action. But because we had a tested strategy already in place, we didn’t miss a beat when COVID-19 struck.”

In the months leading up to the initial test, Johnson Investment Counsel developed a work anywhere blueprint with their technology partner Evolve IP. The plan covered a wide variety of integrated technologies including voice services, collaboration, virtual desktops, disaster recovery and remote office connectivity.

“Having a strategy where our work anywhere services were integrated together was one of the keys to our success,” said Easter. “We manage about $13 billion in assets for clients across the United States and provide comprehensive wealth and investment management to individual and institutional investors. We have our own line of mutual funds, a state-chartered trust company, a proprietary charitable gift fund, with research analysts and traders covering both equity and fixed income markets. Duct taping one-off solutions wasn’t going to cut it.”

Easter continued, “It was imperative that our advisors could communicate with clients, collaborate with each other and operate the business seamlessly. That included ensuring we could make real-time trades and provide all of our other client services.”

Five months later, the novel coronavirus hit the United States and Johnson Investment Counsel’s blueprint test got real.

#access-management, #cloud-applications, #cloud-computing, #collaboration-tools, #column, #communications-tools, #crm, #enterprise, #extra-crunch, #mobile-device-management, #saas, #security, #startups, #thin-clients, #vpn, #work

6 CISOs share their game plans for a post-pandemic world

Like all business leaders, chief information security officers (CISOs) have shifted their roles quickly and dramatically during the COVID-19 pandemic, but many have had to fight fires they never expected.

Most importantly, they’ve had to ensure corporate networks remain secure even with 100% of employees suddenly working from home. Controllers are moving millions between corporate accounts from their living rooms, HR managers are sharing employees’ personal information from their kitchen tables and tens of millions of workers are accessing company data using personal laptops and phones.

This unprecedented situation reveals once and for all that security is not only about preventing breaches, but also about ensuring fundamental business continuity.

While it might take time, everyone agrees the pandemic will end. But how will the cybersecurity sector look in a post-COVID-19 world? What type of software will CISOs want to buy in the near future, and two years down the road?

To find out, I asked six of the world’s leading CISOs to share their experiences during the pandemic and their plans for the future, providing insights on how cybersecurity companies should develop and market their solutions to emerge stronger:

The security sector will experience challenges, but also opportunities

The good news is, many CISOs believe that cybersecurity will weather the economic storm better than other enterprise software sectors. That’s because security has become even more top of mind during the pandemic; with the vast majority of corporate employees now working remotely, a secure network has never been more paramount, said Rinki Sethi, CISO at Rubrik. “Many security teams are now focused on ensuring they have controls in place for a completely remote workforce, so endpoint and network security, as well as identity and access management, are more important than ever,” said Sethi. “Additionally, business continuity and disaster recovery planning are critical right now — the ability to respond to a security incident and have a robust plan to recover from it is top priority for most security teams, and will continue to be for a long time.”

That’s not to say all security companies will necessarily thrive during this current economic crisis. Adrian Ludwig, CISO at Atlassian, notes that an overall decline in IT budgets will impact security spending. But the silver lining is that some companies will be acquired. “I expect we will see consolidation in the cybersecurity markets, and that most new investments by IT departments will be in basic infrastructure to facilitate work-from-home,” said Ludwig. “Less well-capitalized cybersecurity companies may want to begin thinking about potential exit opportunities sooner rather than later.”

#access-management, #chief-information-security-officer, #ciso, #column, #computer-security, #coronavirus, #covid-19, #cybersecurity, #cyberwarfare, #enterprise, #extra-crunch, #market-analysis, #security, #security-software, #servicemax, #startups, #work, #zero-trust