Fig Safety emerges from stealth with $38M to assist safety groups cope with change

For enterprises, having the ability to examine information unlocks rather more than new methods to make cash. The fashionable enterprise tech stack is mind-bogglingly advanced — it employs dozens of instruments that work collectively and break issues in uniquely other ways, which is why having the ability to analyze information streams lets firms perceive when, the place, and why issues break.

However safety groups can’t wait till one thing’s damaged to repair it. To make use of a metaphor: an alarm that hasn’t gone off for some time can’t be trusted to be working. And the fashionable safety stack is so dense with instruments {that a} small change in a single instrument might have unpredictable downstream results that will compromise detection and response capabilities.

Fig Safety, a startup by veterans of Israel’s cyber and information intelligence models 8200 and Mamram, claims to assist safety groups cope with that by monitoring the safety stack to see if their guidelines, mitigation instruments, and detection and response capabilities are functioning or skewed off target by adjustments. The startup simply got here out of stealth with $38 million in seed and Collection A funding, TechCrunch has solely discovered.

In a nutshell, the startup’s tech traces information flows within the safety stack, from the origin at sources by way of information pipelines and information lakes to safety orchestration and automation response platforms, after which alerts safety groups when adjustments at any level have an effect on detection or response capabilities. The platform additionally permits firms to simulate how new fixes, patches, or adjustments might have an effect on their system earlier than they’re deployed.

“As an alternative of wanting on the information and tracing it ahead and seeing the place it finally ends up, we take a look at your detections as a result of that’s the factor that you want to work,” Fig’s CEO and co-founder, Gal Shafir (pictured above, middle), defined to TechCrunch. “Detection or response is the only supply of fact, after which we back-trace the well being and what must occur on the info to ensure that it to set off the detection when one thing occurs. After which we alert [the security team] if one thing has an inconsistency in actual time.”

Shafir mentioned Fig does this by sampling an organization’s information because it flows by way of totally different instruments within the infrastructure and understanding the way it adjustments by way of the pipeline. This lets the corporate create a “information lineage” that can be utilized to learn the way any upstream adjustments might break safety instruments downstream in actual time.

The startup says it connects with information hyperlinks and Safety Info and Occasion Administration (SIEM) programs to do all of this, which lets its tech be used with safety instruments and environments of all kinds.

Fig’s launch comes as enterprises evolve in actual time, particularly with C-suites being pressured to learn the way AI-powered instruments will help save prices, cut back human errors, and enhance effectivity. However the inflow of so many instruments has made the fashionable safety staff’s life even more durable. What sort of defenses ought to a CISO prioritize? What’s the correct safety posture to take as hackers use AI to mount more and more refined assaults?

Shafir, who led Google Cloud Safety’s world structure staff earlier than beginning Fig, says he noticed this uncertainty firsthand when assembly with prospects whereas pitching Google’s AI merchandise.

“The entire CISOs, whatever the staff dimension or the safety funds or the corporate dimension, have been saying, ‘Wait, I perceive that AI is admittedly cool, however I don’t know if I belief my detections proper now, how can I belief the AI that tells me that all the pieces is ok tomorrow if I don’t belief the info beneath it?’” 

That led Shafir and his co-founders, Nir Loya Dahan (CPO), and Roy Haimof (CTO) to the belief that they might remedy safety groups’ subject with understanding what’s occurring on the bottom.

“That was the second that we mentioned, okay, there’s an enormous downside that individuals perceive that exists, however there is no such thing as a resolution as a result of there’s so many distributors and sophisticated infrastructure, nearly by nature. That was the second for us to cease what we did and stop and go to construct Fig,” Shafir mentioned.

Shafir says since launching 8 months in the past, Fig now has giant enterprise prospects within the “low double-digits,” and expects that quantity to develop to 50 to 100 by the tip of the yr.

The startup will use the contemporary money to develop in North America and triple its headcount throughout engineering and go-to-market features.

Buyers within the funding rounds embody Team8 and Ten Eleven Ventures, in addition to safety professionals together with Doug Merritt (former CEO of Splunk), Rene Bonvanie (former CMO of Palo Alto Networks), and the founders of Demisto and Siemplify.