As the number of IT breaches continues to rise, startups that are coming up with creative ways of tackling the issue are growing, too. In the latest development, Illumio — a startup that aims to secure enterprise computing environments beyond their firewall perimeters by covering processes and applications in data centers and public and private clouds — is today announcing that it has raised another $100 million.
At the same time, it’s also picking up some key partnerships as a route to growing its business. Its systems now work with NGINX and F5 load balancers for dynamic policy enforcement.
Led by BlackRock and Accel, the Series C round also had participation from Illumio’s previous high-profile backers. They include Formation 8, Andreessen Horowitz, General Catalyst, Microsoft Chairman John W. Thompson, Salesforce CEO Marc Benioff and Yahoo! co-founder Jerry Yang. Illumio and its investors are not commenting on valuation.
Like other security startups, Illumio did a lot of growing in the ground before making itself visible to all: founded in January 2013, it was in stealth mode for almost two years, until October 2014 — time that it used not only to sign up its first paying customers, but to also to continue improving its no-hardware, software-only solution, releasing some 14 versions of the product in that period and raising over $40 million, according to chief commercial officer Alan Cohen.
Illumio’s product stands out in the market for its approach in how it secures enterprise systems. To date, many solutions have taken the blacklisting approach and focused on a company’s firewall as a way of protecting what goes on behind it.
But as Illumio points out, only 20% of a business’s traffic is ever at that perimeter. “The other 80% stays in the data center, and that’s also where 90% of the breaches occur,” Cohen said in an interview. All those cases of illicit password phishing and malware worms are notable examples how a company can be breached inside the firewall.
To tackle this, Illumio doesn’t eschew firewall philosophy, but rather embraces it: it effectively wraps a firewall around every piece of a business’ IT systems, from applications through to computing processes, covering wherever those pieces of software may reside.
Furthermore, it’s built on a “whitelist” approach, which sits in contrast to blacklists and is growing in its use, adopted also by the likes of Bit9, for example. Whitelisting essentially blocks everything except what is specifically allowed to pass — or, in Cohen’s words, it’s security architecture that is “built by the paranoid, for the paranoid.”
Then, on top of this security system, Illumio offers its business customers a real-time snapshot of what is going on in the whole system, and its software alerts the customer when anything is amiss. Cohen likens these analytics to a kind of MRI, “illuminating where the problem areas may be.” (This isn’t, however, how the startup got its name. Cohen says it’s simply a reference to the ability to see everything in a system, and also the availability of the URL.)
Just as there is a growing number of security startups that are architecting solutions based on whitelists, there are a growing number of startups that are looking at better ways of securing beyond the perimeter, including the likes of VMWare and Cloud Passage.
All the same, Illumio has seen a lot of traction already. The Sunnyvale-based company has hundreds of current customers today that include the likes of Plantronics, NTT, Creative Artists Agency and Morgan Stanley.
While Illumio’s traction in the finance sector has brought it out to London faster than it planned to go — Cohen spoke to me in London while he and CEO and co-founder Andrew Rubin were here to visit customers — some of the Series C funding will be used to roll out more formally internationally. That includes opening an office in Asia by the end of the year, and doubling staff to about 200.
The early traction with enterprises was one of the reasons why investors are chipping in more now to help the company grow, even while it is already generating significant revenue.
“The wide range of investors supporting Illumio reflects the company’s strong traction with Fortune 500 customers, the innovation of its policy and enforcement approach, and the magnitude of the problem it solves,” said Thompson a statement. “The technology gap enterprises face in securing the interiors of their data centers and public cloud computing platforms is creating the proving ground to seize a once-in-a-generation opportunity to create a major new platform in the security space.”