8 ms·
Thats the kind of a company everyone wants to build in enterprise security. Incognito unicorns. There are many companies like these in security space. Another
by debarshri 2y ago
Thats the kind of a company everyone wants to build in enterprise security.
Incognito unicorns.
There are many companies like these in security space. Another company I can think of is Rubrik. All these large security companies under the radar success.
- 1oooqooq 2y agomost people here are also in security and still haven't heard. It's more likely backroom kickbacks (and/or mossad) than invisible unicorn.
- debarshri 2y agokickbacks, may be. I have seen the product. It is not so mossad-y. It fairly straight forward cloud, VM, kubernetes scans. Does it protect stuff? Somewhat. Is it the best product out there - no. Are CISOs happy? CSPM is mostly a checklist item in their bucket to things to do. It depends on what kind of security you are working in. Most of the people in CSPM, CNAPP world have heard their name. It is product built for cloud security/devsecops folks.
- manquer 2y ago> It is not so mossad-y. Would we (i.e. anyone not in the intelligence space) know how intelligence service-y software would look like ? . Aren't all such organizations trained and designed to be inconspicuous and in places we are unlikely to expect.
- alephnerd 2y agoMossad aren't the guys doing cyber ops in Israel. They're suave arsim (how else can you blend in Beirut or Tehran). Also, if you've worked with Israeli government cybersecurity teams, they aren't much different in caliber from the kind you'd find at the NSA, GCHQ, or Netherlands.
- manquer 2y ago> they aren't much different .. NSA, GCHQ, or Netherlands I (and most here) wouldn't really know what that caliber is in these other organizations either to compare What we do hear is of how the Hubble's tech stack is hand me down previous gen(i.e. 70s) spy satellites or exploits like Stuxnet, Pegasus or the recent pager supply chain attacks. On pure technical level those are all pretty impressive things well beyond what I or even anyone I may personally know do. There of course is definitely certain amount of propaganda that would project much higher capability than reality, being mindful of that misdirection and the visible evidence, we civilians can only reasonably conclude that we will never have a clue what these organizations can or cannot actually do.
- someperson 2y ago> They're suave arsim (how else can you blend in Beirut or Tehran). To save others looking up what 'suave arsim' meant: 1. suave -- a normal English the word for charming/confident 2. "arsim" [1] -- apparently a former ethnic slur for Mizrahi Jews [2] now repurposed to mean crude, loud and brash (which sound to me like the equivalent of the British slang term 'chav'). [1] https://en.wikipedia.org/wiki/Ars_(slang) https://en.wikipedia.org/wiki/Ars_(slang) [2] https://en.wikipedia.org/wiki/Mizrahi_Jews https://en.wikipedia.org/wiki/Mizrahi_Jews
- alephnerd 2y agoIt was a bad attempt at humor, but pretty much my point is there are a couple other cybersecurity/sigint specific units unrelated to Mossad. And "arsim" isn't as loaded a term anymore - everyone is mixed in Israel now because it's a melting pot. And saying "Mossad"-this/"Mossad"-that just feels like it's increasingly being used as a dogwhistle.
- posterguy 2y agoI mean, it is used as a substitution for 'Israel', but I don't see how that's a dogwhistle. Or do you mean antisemitic?
- 2y ago
- debarshri 2y agoWe would actually. Lot of the intelligence orgs. use COTS these days.
- jamesfinlayson 2y agoGhidra from the NSA at a glance looks and feels like normal software. AquaSec is built by an Isreali company and looks and feels much like any other SaaS product.
- valianteffort 2y ago100% the case
- heraldgeezer 2y ago[flagged]
- coliveira 2y agoBingo, a huge kickback to some "invisible" hands. They're probably already creating the new "unicorn" to sell to another FAANG company.
- kristopolous 2y agoIf a security firm could blackmail Google, what would that look like?
- genewitch 2y agoWhat could possibly be worth 36 billion? That we don't already know?
- kristopolous 2y agoThis is google. They've got everything. I use google password manager, wallet, biometrics to log into my google smartphone and google authenticator for my 2FA. I use google voice and maps, photos, youtube, search, docs, gmail and gemini for AI. Imagine if you found an authentication backdoor - a way to impersonate any account and you could start sucking down data. You do it for 5 billion people and charged google $6.40 per person not to put it on Tor. $32 billion would be a steal.
- saagarjha 2y agoDo you think you could get away with doing that?
- no-reply 2y agoIf you have alumni at senior positions internally, it shouldn't be that hard to strike a deal. Old but relevant - https://scheerpost.com/2022/11/01/revealed-the-former-israeli-spies-working-in-top-jobs-at-google-facebook-and-microsoft/ https://scheerpost.com/2022/11/01/revealed-the-former-israel...
- saagarjha 2y agoFor $32 billion?
- selcuka 2y agoIt's cheaper to, well, you know.
- alephnerd 2y ago> most people here are also in security No they aren't. I've been a cybersecurity SWE, PM, and VC for a decade at this point and I've almost never found any relevant security or enterprise SaaS related content on HN. For a hot second (around 2018-2019) there was solid conversations around eBPF, io_uring, or cloud posture management, but that doesn't happen on here anymore. Same with MLOps and ML Infra as well - almost no one on here understands Infiniband, RDMA, or BLAS The tech industry is MASSIVE - and most people are only clued into their own little niche. And according to HN, the only tech companies that exist are FAANG, Nvidia, Tesla, TSMC, and BYD.
- powvans 2y agoI vaguely remember this hot second you refer to. What is the HN equivalent where those conversations are happening today?
- alephnerd 2y agoLobste.rs for technical stuff. But most security related conversations by security SMEs aren't happening online anymore. We have specific user conferences and regional user groups now.
- genewitch 2y agoCool, any in central Louisiana? Poland? That'll teach the AI!
- alephnerd 2y agoThe cybersecurity industry is almost entirely located in the Bay, Seattle, Tel Aviv, and Blr/Hyd, so the really active user groups are mostly in those cities. Cybersecurity goes hand-in-hand with IT, DBA, Networking, DevOps, and OS/Systems Programming - all functions that were previously looked down upon over the last 15-20 years. Furthermore, most American CS programs made OS internals, Computer Architecture, or Distributed Systems optional, so the junior portion of the ecosystem doesn't exist in the US anymore.
- heraldgeezer 2y ago[flagged]
- alephnerd 2y agoIt's for any country or heritage that isn't American or Northern European. A lot of really racist or xenophobic takes on HN.
- heraldgeezer 2y agoDon't try and "both sides" this.
- alephnerd 2y agoI'm not trying to "both sides" jack. And it's not like you could tell the difference between Zohar Argov or Amitabh Bachchan.
- heraldgeezer 2y agoOkay you edited. I feel like the majority of anti-jew sentiment is from pro-palestine arab people and adjacent. At least In my country. They really believe "jews run the world" once you debate them enough they admit it and there is no changing of their minds.
- alephnerd 2y ago> Okay you edited. Yep. Realized the confusion! > I feel like the majority of anti-jew sentiment is from pro-palestine arab people and adjacent Most people haven't met an Israeli or traveled to Israel. Also, most users on HN are Americans or Northern European who overwhelmingly use Reddit, so everyone has some weird fringe mentality about one side or the other. Honestly, most Israelis and Arabs act the same - I mean most Israelis are Mizrahi and normal/collquial Hebrew is heavily Arabic based (where else will you here people say "Yalla" in every other sentence)
- 2y ago
- jdgoesmarching 2y agoSecurity is a big field. I’m in the CSPM space and Wiz is a major player here, I actually had a bit of an existential crisis about what we were building when I first saw a demo of their platform. Most of their competitors, like Palo Alto, have a very convoluted offering from gluing together several acquisitions. Wiz is very cohesive with a much nicer API and great UX, which is very underrated in the security space imo. I have zero trust in Google’s promise to keep supporting the tool for multiple clouds or maintain the high quality of product design that makes Wiz great. It’s great for my job security, but I’d call it a net loss for the industry.
- debarshri 2y agoCSPM is very crowded space. There are quite some new and emerging providers. Wiz out of the scene opens up new opportunities.
- rockskon 2y agoOpportunity for opportunity sake isn't a virtue if it gets rid of one of the few providers that was any good.
- deleted 2y ago[deleted]
- Sohcahtoa82 2y ago> Wiz is very cohesive with a much nicer API and great UX I actually don't care for Wiz's UX. If you're a manager and just want to get an idea of what your security posture looks like, it's great. They have a million dashboards for you. But if you're an AppSec Engineer that just wants to see which EC2 instances have which CVEs, it's kind of a pain in the pass and takes way too many clicks.
- vvram 2y agoHow would you like to consume that information?
- ryanSrich 2y agoIf you're in security and you haven't at least heard of Wiz, I have doubts about what you actually do. I'm not saying you have to be a CSPM expert, but not even hearing about Wiz, when they are the largest CSPM, is somewhat concerning.
- aleph_minus_one 2y ago> If you're in security and you haven't at least heard of Wiz, I have doubts about what you actually do. IT security a very wide field. For example, a lot of positions in IT security are actually about compliance (i.e. lots of documentation), and ensuring the rollout of all necessary application patches in the whole company.
- marcus0x62 2y agoCompliance and patch/vulnerability management teams are a major constituency for CSPM tools.
- ramraj07 2y agoI know diabetologists in India who didn't hear about Ozempic till late 2024. Sometimes the simpler explanation is the correct one.
- assanineass 2y ago[dead]
- msm_ 2y agoI am in security for many years now, my main focus is reverse engineering (but I did many diverse things, including cryptography, some exploit development and the opposite, AV work, I did R&D in security automation and some development of security tools and engines). I never even looked at a CSPM, and from my point of view[1] CSPMs are a tool only relevant for a small part of security teams focused on enterprise cloud security. Today is the first time I heard of Wiz. edit Actually my partner works in policy/compliance/legal side of security, and I'm pretty sure she never heard of Wiz too. [1] I wrote this only to stress how different people in the same field can see things differently.
- casey2 2y ago[flagged]
- hluska 2y agoTwo things: 1.) Most people here are likely not in security. 2.) I’m only adjacent to security but have heard of Wiz. If you work in security and haven’t, are you sure you’re good enough to subject us to your opinion?
- msm_ 2y ago>2.) I’m only adjacent to security but have heard of Wiz. If you work in security and haven’t, are you sure you’re good enough to subject us to your opinion? For some reason I picked this hill to die on in this thread. I work in IT security for a long time, and I have never heard of Wiz. My focus is malware reverse engineering and adjacent subfields. I have no interest in anything Cloud. "are you sure you’re good enough to subject us to your opinion" feels a bit dismissive.
- myth_drannon 2y agoYa, Mossad's primary task is enterprise sales for Israeli tech.
- kobayashi 2y agoThat is totally unfounded. Their book of business is huge. You think Google is paying 32B of shareholder dollars because of a foreign intelligence agency? Keep your conspiracism to yourself.
- rabidonrails 2y agoWiz is a private company but the street's assumption is $1B/ARR over the next year or so.
- api 2y agoHN is not the entire industry. Not even close. It’s a small subset.
- startupsfail 2y agoThe article talks about Trump inserting himself into larger deals, there is no reason to think this one is an exception. I’d also bet on this being more of a kickback, rather than an invisible unicorn. Between a visible elephant (Trump/Israel) and an invisible unicorn, betting on an elephant is more reasonable.
- udev4096 2y agoRubrik had pretty bad breaches in the past: https://www.bleepingcomputer.com/news/security/rubrik-rotates-authentication-keys-after-log-server-breach/ https://www.bleepingcomputer.com/news/security/rubrik-rotate... https://www.bleepingcomputer.com/news/security/rubrik-confirms-data-theft-in-goanywhere-zero-day-attack/ https://www.bleepingcomputer.com/news/security/rubrik-confir... This one is straight up embarrassing: https://techcrunch.com/2019/01/29/rubrik-data-leak/ https://techcrunch.com/2019/01/29/rubrik-data-leak/ > The exposed server wasn’t protected with a password, allowing access to anyone who knew where to find the server. So much about "zero trust", at this point it's nothing but a marketing term and has lost it's true meaning