VCs Cough Up $100M for Cybersecurity Startup Illumio

Illumio, a 2-year-old cybersecurity startup, last week announced it had raised US$100 million in a Series C round of financing, bringing its total funding over the past 27 months to more than $142 million.

New investors Accel Partners and BlackRock Funds joined Investors Formation 8, Andreessen Horowitz and General Catalyst in the round. Other investors include Microsoft Chairman John W. Thompson, who is an Illumio board member, as well as Salesforce CEO Marc Benioff and Yahoo cofounder Jerry Yang.

Illumio will use the fresh funds to meet demand for its Adaptive Security Platform software, to invest in R&D, to grow sales and marketing efforts, and to fuel international expansion.

What Illumio Offers

ASP wraps a layer of software security around every computing instance — whether servers, virtual machines or Linux containers — and then monitors the instances and adapts security continuously to the environment.

It instantly encrypts data in motion between any mix of Windows and Linux application workloads. Encryption is built into policies.

ASP also manages enforcement across applications, workloads and processes as they are provisioned, operated and moved in any data center or private or public cloud infrastructure.

The security moves with the workload, so security policies don’t have to be rewritten for migration.

Customers write policies in natural language, and ASP takes care of the technical details, including setting up IPsec connections.

“When you combine the number of people involved with handling multiple forms of data with the immaturity of data security systems and practices that are in place, there are … many opportunities for mistakes or intentional breaches to take place,” Protegrity CTO Ulf Mattsson told the E-Commerce Times.

Who Needs It

Illumio’s customers include financial services giant Morgan Stanley, Plantronics, NTT and Creative Artists Agency.

Using ASP let Morgan Stanley cut the number of rules controlling access and security to its more than 100,000 servers by about 90 percent, because it could eliminate redundant or dated rules, said Morgan Stanley COO Jim Rosenthal.

That right there is a critical aspect of security that would be dear to IT professionals’ hearts. It’s difficult to keep track of all the rules and policies written and to eliminate redundant or dated ones, especially those that may conflict with new ones.

ASP builds a live interactive map of all application traffic and displays any policy violations across customers’ data centers and clouds. It also lets them test security policies before implementation.

“One of the biggest issues in security today is visibility, especially across multiple cloud and virtualized environments,” said Frank Dickson, a research director at Frost & Sullivan.

ASP understands the relationship among application workloads.

That means it will warn users if a server that is managing machines on the production floor, for example, should attempt to access employee records, which might indicate a breach, Dickson told the E-Commerce Times.

That functionality lets users establish acceptable use parameters for data and helps to prevent unauthorized access.

Opportunities and Challenges

ASP offers fine-grained security, and “there is definitely a market for solutions like this,” Dickson said. “A lot of companies address this category of need; Catbird and Elastica are two startups that come to mind.”

That said, ASP is “yet another tool to learn and manage, adding more complexity to the environment,” Dickson pointed out. “Security complexity is killing us … . Security professionals are extremely [tight for] time and recruiting new security professionals is difficult.”

The security of the ASP platform itself may prove to be an issue.

“This is a software security solution and, like any software solution, it can be hacked,” said Jim McGregor, principal Analyst at Tirias Research.

“It’s ironic that most of the startups focusing on security are targeting the network and data center, where there already are many security standards and platforms,” he told the E-Commerce Times. “The real challenge is at the edge of the network and the security nodes — like the sensors and devices we are increasingly connecting to the network, and the applications that run both locally and on the cloud.”

ASP may protect data in transit, but it can’t defend against DDoS attacks or ransomware, for instance.

Finally, “The biggest challenge I see for this platform is that it doesn’t appear to be linked to hardware or other security solutions,” McGregor observed.

Layered security is a must, he said, and both hardware and software solutions need to be implemented.