• Return on Security
  • Posts
  • 💰 Security, Funded #123 - Signing Off '23 with a Bang: Cyber, and AI, and IoT, Oh My!

💰 Security, Funded #123 - Signing Off '23 with a Bang: Cyber, and AI, and IoT, Oh My!

A deep dive on cybersecurity funding and industry news from the week of December 4thth, 2023.

Author

Mike Privette
December 11, 2023 • Reading Time: 11 minutes

Hey there,

Happy Monday, and I hope you had a great weekend. In this week’s issue, we’ve got:

  • 🤝 From ASPM to IAM

  • 🔜 A 2023 sign-off & survey

  • 🔥 SentinelOne's moves and ZeroFox's mixed results

  • 🤘 Greatest hits, the importance of SSO, and SIEM futures

And that’s a wrap for 2023 for this newsletter!

I got to cap off this last week by doing my very first sponsorship of a security conference here in London for BSides London

Mike Privette on LinkedIn: #bsides #bsidesldn2023

www.linkedin.com/feed/update/urn:li:activity:7139182551906045952

Just a reminder that this is the last newsletter issue you’ll get from me in 2023. I’ll catch you all next year on Tuesday, January 2, 2024, since that Monday is New Year’s Day.

Don’t you worry, though, I’ll still be capturing all the happenings and crunching the numbers through the end of this year so you don’t miss a beat when we all come back in 2024.

Before you sign off for the year, would you mind doing me a huge favor? I’m always trying to improve this newsletter for you, and I want to make it the most valuable resource that I can. Would you please fill out this quick and anonymous end-of-year survey to help me out?

2023 Return on Security Feedback Survey

docs.google.com/forms/d/e/1FAIpQLSdlUXeD5KBmNS1JqgJFkrtCN7HoXq4kZylBHLau98j3AVlUNg/viewform?usp=sf_link

Have an upcoming deal to share? Looking for funding? Looking for companies to fund? Drop me a message at [email protected].

Onward to this week's issue.

🗣Sponsor

Close more enterprise deals

Automate security and privacy compliance

With a streamlined workflow and expert guidance, Secureframe automates the entire compliance process end-to-end. What makes Secureframe different?

  • Get audit-ready and achieve compliance in weeks, not months, with built-in remediation guidance and 100+ integrations.

  • Stay compliant with the latest regulations and requirements, including ISO 27001, GDPR, HIPAA, PCI, and other standards.

  • Automate responses to RFPs and security questionnaires with AI.

  • Trusted by hyper-growth organizations: AngelList, Ramp, Lob, Remote, and thousands of other businesses.

How are you going to spend your time the rest of the year?

Login or Subscribe to participate in polls.

Last week’s vibe check:
Which cybersecurity threat do you believe is most under-recognized in our industry?

In last week’s poll, most people saw IoT Device security and Deepfakes as the most under-recognized threats in our industry. My favorite comment from you all last week was

“Quantum is still a decent ways out, and deepfakes are pretty situational, while IoT risks are here now”

Just take a look at what’s happening around the world at our water and power facilities.

🔮 Earnings Reports

A section for notable earnings reports from public cybersecurity companies, be they “pure play” or hybrid companies.

  • SentinelOne ($S) - SentinelOne had a strong performance last quarter, increasing ARR by 43% YoY, driven in large part by its channel partnership expansion and success in the MSSP market, specifically at the SMB levels. This customer base shift also shifted customer payment frequency and revenue recognition.

    Of course, a SentinelOne earnings call wouldn’t be complete with the CEO bashing all of its competitors, calling them inferior, and a new phrase (which I shuddered at) of helping companies “move at the speed of AI” to secure their environments. Even with the over-the-top approach, SentinelOne shows adaptability, strong growth, and a forward-moving trajectory despite persistent macro challenges. Its stock jumped ~17% as a result.

  • ZeroFox ($ZFOX) - ZeroFox reported a mixed quarter, missing its earnings estimates, but raising its forward-looking guidance. The stock dropped ~17% as a result. You may remember that ZeroFox went IPO right at the bottom of the 2022 pit of despair (when everything stopped). All things considered, it’s doing quite well having to navigate its first baby steps as a public company on unsure ground.

    Also, a key highlight of their quarter was helping out Caesar’s Palace through their latest breach over the summer. ZeroFox sees the latest SEC regulations for public companies to disclose breaches in a more transparent way as a positive sign for their offerings and a potential uptick in demand among their largest customers.

📸 YTD Snapshot

A rolling 12-week chart to compare funding and acquisitions each week between 2022 and 2023.

We’ve got a continuation of typical seasonality in the funding industry as the year winds down. Only a few weeks left for those last-minute tax write-off investments!

This late the in year bumped happened last year with a few more acquisitions than normal screeching across the finish line. At this point, we are just ~5% shy of matching 2022’s M&A activity. 🍿 

💰 Funding Summary

  • 12 companies raised $155.4M across 11 unique product categories

  • 7 companies were acquired or had a merger event for $1.8M across 5 unique product categories

🧩 Funding By Product Category

  • $40.0M for Application Security Posture Management (ASPM) across 1 deal

  • $30.0M for Data Privacy across 1 deal

  • $22.0M for Identity and Access Management (IAM) across 1 deal

  • $16.2M for Connected and Autonomous Vehicle Security (CAVS) across 1 deal

  • $16.0M for Professional Services across 1 deal

  • $12.8M for Data Protection across 2 deals

  • $7.2M for Data Security Posture Management (DSPM) across 1 deal

  • $5.0M for Fraud and Financial Crime Protection across 1 deal

  • $3.2M for Cybersecurity Program Management across 1 deal

  • $3.1M for Software Supply Chain Security across 1 deal

  • An undisclosed amount for Security Awareness across 1 deal

🏢 Funding By Company

🗣Sponsor

Should security engineers care about transitive supply chain vulnerabilities?

The 2020 GitHub Octoverse report disclosed that the average amount of indirect (transitive) dependencies for a JavaScript project on GitHub, with an average of 10 direct dependencies, is 683 total dependencies. Welcome to the world of transitive dependencies!

In this blog post, Kyle Kelly, Semgrep Security Researcher, discusses transitive dependencies, prioritizing risks based on exploitability, and why today’s issues aren’t going anywhere anytime soon.

🌎 Funding By Country

  • $91.4M for United States across 6 deals

  • $30.0M for Israel across 1 deal

  • $28.1M for France across 2 deals

  • $5.0M for Czech Republic across 1 deal

  • $883.8K for United Kingdom across 1 deal

  • An undisclosed amount for Italy across 1 deal

🤝 Mergers & Acquisitions

  • Semnet, a Singapore-based managed security services provider (MSSP), was acquired by GSTechnologies for $1.8M. (more)

  • Bluecube, a United Kingdom-based managed security services provider (MSSP), was acquired by Ecko for an undisclosed amount. (more)

  • Connexta, a Germany-based professional services firm focused on IT and cybersecurity consulting, was acquired by Fremman Capital for an undisclosed amount. (more)

  • Infosec Learning, a United States-based cybersecurity training and education platform, was acquired by ACI Learning for an undisclosed amount. (more)

  • Mainline Information Systems, a United States-based managed security services provider (MSSP), was acquired by H.I.G. Capital for an undisclosed amount. (more)

  • Rafft, an Israel-based platform for orchestrating and securing cloud development environments, was acquired by Wiz for an undisclosed amount. (more)

  • WireWheel, a United States-based data loss prevention (DLP) platform, was acquired by Osano for an undisclosed amount. (more)

📚 Great Reads

  • SSOTax - A community-driven, open-source project that aims to highlight the importance of Single Sign-On (SSO) as a fundamental and necessary security feature for companies that SSO should not be treated as a premium feature.

  • *How to Reduce Incoming Security Questionnaires and Accelerate the Sales Cycle - Turn the needless friction of security questionnaires on its head and ensure time does not kill your deals.

  • The SIEM Alternatives Fallacies - This post examines the common logical fallacies presented by providers marketing their products as alternatives to Security Information and Event Management (SIEM) systems.

  • Return on Security Greatest Hits - Some light holiday downtime reading - A curated list of the most popular blog posts at Return on Security about cybersecurity investing, starting a business, career advancement, and more.

*Sponsored content and/or affiliate link.

🧪 Labs

Peak Gen AI usage is for trolling, and I had way too much fun making these.

Have an upcoming deal to share? Looking for funding? Looking for companies to fund? Drop me a message at [email protected].

How was this week's newsletter?

Login or Subscribe to participate in polls.

Join the conversation

or to participate.