James Berthoty’s Post

What would a $23BN WIZ deal mean for cybersecurity? Google is reportedly in talks to acquire a cybersecurity startup WIZ for a whooping $23BN implying >45x+ EV/revenues multiple. For background WIZ is one of the fastest growing cybersecurity businesses in one of the fastest growing cybersecurity areas, CNAPP - Cloud Native Application Protection Platform. CNAPP is a subset of Cloud Security a $10bn addressable market growing at 40%+ rate. Key public players in this market are Crowdstrike, Palo Alto, DataDog, SentinelOne. WIZ latest funding round was in May of this year at $11BN valuation with $350M ARR. The company today reportedly has $500M in ARR (unconfirmed). Some thoughts: (+) Positive for cybersecurity. Multiple is significantly higher than where public next-gen cybersecurity companies are trading today (many <10x) (+) Positive for some of the smaller players e.g., Sentinel One, Rubric that are trading at a discount. Maybe time to re-think if dealing with the public markets is the best route. (+) Good for CNAPP competitors - AWS, Azure may incentivize use of competitive products. (+) Great for WIZ - $23BN value created in 4 years sounds pretty good. Will propbably take a few years to get that type of valuation in the public markets. (=) OK deal for Google. The good news is that the company can cross sell and build out its exaisting cybersecurity portfolio and compete withe Microsoft. Google already has some good products in tangental areas like SecOps/SIEM (Google Chronicle), Monitoring/governance (Dataplex), Managed Services (Mandiant). The bad news is that its comes with a high price tag. Cybersecurity one of the fastest growing areas within software and we expect to see more M&A as establised players look to expand to some of the fastest growing areas like Cloud (CNAPP), Data Security etc. To get a lay of the land access our Cybersecurity Investing Primer Webinar here: https://hubs.li/Q02GPc7W0 #cybersecurity #technology

Microsoft is a giant… but it may be of the Goliath variety. After a targeted hack by Chinese operatives compromised the email accounts of prominent U.S. government officials, President Biden’s newly appointed Cyber Safety Review Board investigated Microsoft’s cybersecurity practices - and found them lacking. The Board uncovered, among other things, a culture of indifference towards stringent security protocols and a noticeable reluctance to share critical information about security breaches. With so many organizations using Microsoft’s cloud infrastructure, these revelations have prompted calls for a comprehensive overhaul in the company’s approach to cybersecurity and transparency. And that goes for everyone in the cloud computing industry, according to the Board. After concluding its review, the Board advocated for a greater emphasis on security and openness within the sector at large. Incidents like this recent one at Microsoft serve as a wakeup call to all tech behemoths: It’s your responsibility to ensure the digital safety of governments, businesses, and individuals by strengthening your defenses and fostering a culture of transparency and accountability.

So many cybersecurity firms selling a false sense of security. "Buy our tools and you will be secure". So many cloud providers claiming they have better security than any other company can provide. Truth is, none of us are secure. You need to treat everyday as a potential threat. But just a few thoughts: - Using a outsourcing partner means you place your eggs with a lot of other customers eggs. A lot of eggs in the same basket. And for a threat actor, thats a target more valuable than attacking a single customer (fewer eggs 😉) - Cloud services will be the new attack vector in 6-8 months. Imagine you can attack SaaS provider X and get 10.000 customers sensitive data. Its like a high-five. Are on-premise data centers more secure? No, but the value for a potential threat actor is lower. And threat actors are like companies, they want the most out of their investment. Unless they are aiming for a specific target, but then they are after specific sets of information and not to cause havoc or disturbances. Those attacks are usually not even noticed as the threat actor has no intention showing you they were there. Does that mean you can relax? No, not at all. Every day is a threat. And every day needs to be treated as such.

#Cyberattackers are strategic and methodical. They know their mission and they set forth to carry out their attacks in a sequential way in the hopes of going undetected. This predictable sequence of events is the targeted attack lifecycle. As an organization, it is crucial to protect your critical data and cyber assets from all threat actors throughout every stage of the targeted attack lifecycle. Check out this report from Mandiant (now part of Google Cloud) to understand why (and how) attackers bypass your application's defenses. At Intelliswift Software, we leverage Mandiant's eight phases to review a web application from top to bottom: 1. Discovery 2. Configuration management 3. Authentication 4. Authorization 5. Session management 6. Data validation 7. Error handling 8. Data protection Reach out to our #Security practice leaders to discuss how we can help you achieve your optimal security posture. Sreejith Chandran, Charles Benjamin, Sekhar Annambhotla Google Cloud, Google Cloud Partners #GoogleCloudNext https://lnkd.in/gKHpc9Jx

Clients/users fault mostly Getting updates files downloaded from mirror server and third party hosting sites/servers without verifying digital signatures and without calculating MD5 and Hashes of File with original Update. Cloud Strike Security team in due diligence must perform Cyber Intelligence to “ IDENTIFY and DETECT “ Catfishing and Impersonating attempt against their own Intellectual Property/Identity What did Miscreants catfisher got out of this activity: NOTHING rather loss of man hours failure and wastage of time. Damage Assessments: Only Cloud Stike can identify this via SR/CR from the users/clients but the Lesson Learnt to Users ( NEVER BYPASS YOUR SECURITY Infrastructures. NEVER Trust Third Parties ) Way Forward: Cloud Strike is well established and highly resourceful.

Reports that Google is set to hand over a record-shattering pile of cash for #cyber #startup Wiz Inc. represents a high-stakes bet on closing the gap to rival cloud technology providers. In many ways, the deal is as obvious as it is overdue. To get the process started, all Google would have needed to do is a quick search on “successful cyber security M&A strategies” and follow the highly profitable buy-and-build approach laid out by other tech giants. More for 451 Research clients: https://lnkd.in/gkFu5cSC

Reduce complexity and gain 24x7 monitoring, detection, and response against advanced cyber threats in your Microsoft stack. Learn more: https://ow.ly/yg1t50SekaG #EndCyberRisk