Blog Series | Part 5 | Value Creation Founders’ Series
Today, businesses are leveraging more and more SaaS applications across almost every team and every department. The business landscape is becoming hyper connected and the use of external vendors and third party integrations to enable faster execution and more collaboration is coming at the cost of a compromised security posture. Why? There is more emphasis being placed outside the organization to conduct business than ever before and growth is happening at such a rapid speed that monitoring new software and its impact on a company’s security posture becomes infeasible.
While this expansion in such applications/vendors is so important, a lack in visibility and management of those connections can have the opposite effect. It is becoming increasingly more difficult to understand what is communicating with what, how apps are interacting with one another and what data is flowing between different systems.
We saw this trend developing and its prioritization across security teams becoming higher, and after meeting the founders of Atmosec, we knew we had to invest. Founded by former Armis and Google executives, Atmosec is a SaaS cybersecurity startup platform that focuses on the connection between SaaS apps and alerts based on the behavior between the applications themselves – stopping any potential malicious bilateral movement.
Why did we invest? “We recognize a trend of cybersecurity professionals prioritizing Saas cybersecurity solutions.” said Kobi Samboursky, Founder and Managing Partner at Glilot Capital Partners. “Atmosec as a cybersecurity startup has developed a solution that bridges the gap in securing this SaaS ecosystem, protecting cloud-enabled businesses from increasingly advanced attacks on SaaS services.” Atmosec has entered the space at an opportune time as trends and pain points continue to develop and organizations connect to more and more applications.
Like any cybersecurity startup and portfolio company at Glilot, we’ve begun working with Atmosec via our data-driven Value Creation process to bring them design partners and first customers fast, while allowing them to truly test their product against the market. This strategic exposure has helped the team truly accelerate the Product-Market fit process.
Let’s hear what Aner has to say about today’s SaaS ecosystem.
Q: Let’s back up a step. How are organizations leveraging SaaS services today?
We’ve noticed a big increase in SaaS products used by organizations substantially over the past two years. Now, we are seeing more and more organizations leveraging the power of SaaS services by companies integrating and connecting different products together which both become part of an ecosystem and save work across organizations. Whether it be automatic payments, data insights or better communication, the systems themselves are not necessarily new but rather it is the way they are interacting with one another that is changing, ie. SaaS apps are communicating with other SaaS apps.
Q: Tell me about the security gaps that form with more SaaS intercommunication?
Aside from it being difficult to understand which apps are communicating with one another and how, a large piece that is accelerating this problem is that systems like Google, Slack and even Zapier allow users to connect themselves. What used to be spearheaded by the IT team is now able to be done by every user in an organization so there is no longer a single focal point that is privy to all data surrounding these applications. That’s where we are stepping in, to understand how these things are interacting and behaving so we can actually tell you if one of your API tokens gets stolen or abused.
Q: Great segway, where does Atmosec come in and can you share your founding vision?
Basically, we started thinking about what trends we were seeing in security in general and together honed in on the idea that it’s not only the increase in SaaS but actually the increase in connections. In validating that with CISOs, we are seeing that SaaS cybersecurity is going through a renaissance and we are actually facing a much larger problem than people realize. Why? Most companies in the last few years have all their services in SaaS, it is as if the main artery for security can’t be everything that is inside an organization communicating out but rather is from everywhere in the organization into the SaaS ecosystem.
Increased SaaS connectivity is just where the world is going and I expect that to only increase. When thinking about the maturity of the trend, we haven’t hit the peak yet but we are far enough along that the pain points are starting to show. We’re starting to see attackers understand these avenues as potential vulnerabilities. On the flip side, we have yet to reach the full complexity that this problem can create. What’s my thought process here? When creating a company it’s a good idea to be ahead of the curve, in terms of addressing a problem, so that once a CISO fully grasps that this is a major headache, I already have the solution to solve it.
Q: So this begs the question, how does Atmosec plan to solve this problem?
We’ve grouped our solution into three pillars, which are identifying the risk, understanding the behavior between all SaaS apps and then automatically preventing and protecting your ecosystem through automated security hygiene. It starts with the idea that you can’t see what you don’t know and then transforms into the idea that once you know something is there, it becomes about understanding if it is behaving correctly or not. For us, once we understand the connection, we understand its behavior.
Q: What are some of your design partners and customers saying?
A lot of feedback we’ve received is that up until now much of this process of understanding vulnerabilities has been manual for a CISO and his/her team. Whether it is understanding what is connected, what might be anomalous, trying to find an attack that may have gone unnoticed or just mapping out the ecosystem, a CISO could spend days to review and still find him or herself to be limited to major platforms rather gaining a full picture of business critical infrastructure.
With Atmosec, we are able to highlight places a CISO might not have a chance to look. Each time someone with an organization adds a new app or permission, we’re able to help that CISO understand this in real time and detect anomalies.
The last and most underrated piece is the automation of all these processes. Generally CISOs and security organizations are understaffed, both because it is hard to train people and because the amount of attention security has gotten over the last five years has grown exponentially. But with a new vendor, or any vendor, it is all about what you can take off in terms of workload so that our customers can focus their attention on key things that need their input.
Q: You’ve just come out of stealth, what’s on the roadmap?
Of course we want to focus on giving as much value to our customers as we can, this may mean supporting more systems. As we can continue getting more familiar with each system we’re able to offer more complicated and complex solutions to adhere to an even more sophisticated attack and understand how to more deeply secure these systems. This ultimately comes from understanding how these systems behave and react.
We also want to understand further how our customers are leveraging the system – what are they doing with the information, what are they taking to heart and what are the things they need to continue automating?
The last piece is of course building deeper trust. As our customers gain trust, they gain ease of mind and time to focus on other major issues.
We are so excited to join Atmosec’s journey as they help organizations grow and secure their SaaS ecosystem with confidence.
Thank you to Aner for the time and insights in how to better secure hyper connected companies.