ESW at BlackHat and the weekly enterprise security news – ESW #419

Ayman Elsawah

1. DFIR: From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira
2. STREISAND EFFECT: Google tool misused to scrub tech CEO’s shady past from search

   It seems like every time someone hires a "reputation fixing" firm, it just makes things worse.

   Sure, sue a journalist telling the truth in an attempt to keep them quiet. The EFF and anyone else that cares about SLAPP will have something to say on that topic.

   A secondary benefit of reading up on this one is how important it is to thoroughly understand the potential abuse cases against software tools - especially powerful ones that can edit Google Search results!

3. DRAMA: Some people are defending Perplexity after Cloudflare ‘named and shamed’ it

   Adrian: Cloudflare and Perplexity have taken off the gloves. Cloudflare accused Perplexity of scraping websites that have requested to not be scraped. Cloudflare makes tools and has services designed to block AI bots and agents.

   Perplexity fired back that Cloudflare doesn't know what they're talking about and isn't distinguishing between an agent browsing a website on behalf of a user and a bot scraping data for model training.

4. TRENDS: AI slop and fake reports are coming for your bug bounty programs

   Adrian: We all saw this coming, right? RIGHT???

5. TRENDS: Vibe Coding: When Everyone’s a Developer, Who Secures the Code?
6. WHOOPSIES: Exclusive: Google is indexing ChatGPT conversations, potentially exposing sensitive user data

   Adrian: What a mess! Folks found tens of thousands of ChatGPT chats publicly exposed and discoverable via search engines. Over 100,000 were found to be backed up by Archive.org. Most of these have been cleaned up by now, but some very sensitive information was out there for days, weeks, months, and perhaps years.

   ChatGPT's sharing option appeared a year or two ago, and like sharing functions in Google Docs, M365, and Notion, it seemed to create an "anyone with the link" resource to access the chat session. In all other systems that generate these links, search indexing is off by default. Unfortunately, this option was the opposite in ChatGPT.

   I also blogged about it if you want more details, or want to know how to unshare your chats: https://defendersinitiative.substack.com/p/chatgpt-shares-are-indexable?r=74yjk

Jackie McGuire

1. ANALYSIS: SACR’s AI SOC Market Landscape

   A massive writeup on AI SOC platforms

2. SUPPLY CHAIN: NVIDIA says no backdoors, kill switches, or spyware in its chips after China accusations

   Adrian: In a topic that just refuses to ever go away, NVIDIA is reiterating that they will never put back doors into their products, after China summons company officials to discuss security concerns regarding chips made specifically for the Chinese market.

3. FUNDING and M&A courtesy of the Security, Funded newsletter, issue #205 – Back in Black(jack)

   The Vibe Check

   This week's vibe check asks, "What’s your real security operating model?"

   The options included panic-driven planning, spreadsheets, CTRL-F in a PDF, and "It Depends" 2.0.

   The winner, by a landslide was, "It Depends 2.0"!

   Funding

   It is an absolutely massive week for funding, with over half a billion US dollars dropped across over 2 dozen companies from 8 countries and 18 different product categories. We can't discuss them all, but there sure were a lot of AI SecOps fundings in the news! For links to more info on each of these fundings, check out the episode of Security, Funded linked above!

   There are so many of these fundings, we're going to just categorize a select few.

   First, the SecOps startups (mostly GenAI-focused):

   1. Blink Ops, an Israel-based low-code security automation platform, raised a $50.0M Series B from O.G. Venture Partners.
   2. Legion Security, a United States-based AI-assisted security operations center workflow platform, raised a $38.0M Series A from Coatue.
   3. Dropzone AI, a United States-based AI-agent-enabled security operations platform, raised a $37.0M Series B from Theory Ventures.
   4. Prophet Security, a United States-based AI-assisted security operations platform, raised a $30.0M Series A from Accel.
   5. Command Zero, a United States-based security operations and investigation platform, raised a $10.0M Seed from Crosspoint Capital Partners, SE Ventures, and Okta Ventures.
   6. Reach Security, a United States-based security operations AI copilot platform, raised a $10.0M Series A from M12 - Microsoft's Venture Fund.
   7. Nebulock, a United States-based agentic threat hunting and security operations, raised a $18.5M Seed from Bain Capital Ventures.
   8. RunReveal, a United States-based security analytics and observability platform, raised a $7.0M Seed from Costanoa Ventures.
   9. Tonic Security, an Israel-based AI agent-driven security operations platform, raised a $7.0M Seed from Hetz Ventures.
   10. North Pole Security, a United States-based endpoint detection and response platform for MacOS, raised a $4.0M Seed from Andreessen Horowitz.

   Next, the AI security platforms:

   1. Noma, an Israel-based data and AI pipeline security platform, raised a $100.0M Series B from Evolution Equity Partners.
   2. Promptfoo, a United States-based open-source platform for identifying and fixing vulnerabilities in AI applications, raised a $18.4M Series A from Insight Partners.
   3. Cyata, an Israel-based agentic AI governance and security platform, raised a $8.5M Seed from TLV Partners.

   Other interesting fundings included:

   • Safe Security, a United States-based cyber risk quantification and management platform, raised a $70.0M Series C from Avataar Venture Partners.
   • Wallarm, a United States-based API security company, [raised a $55.0M Series C from Toba Capital.
   • Seal Security, a United States-based threat prioritization platform using LLMs to prioritize patching, raised a $13.0M Series A from Vertex Ventures Israel.
   • Root Evidence, a United States-based vulnerability risk and prioritization platform, raised a $12.5M Seed from Ballistic Ventures.
   • Corridor raises $5.4M seed round led by Conviction and hires Alex Stamos as security leader. They released a snazzy video for the launch as well.

   Acquisitions

   • SentinelOne buys two-year-old GenAI cyber startup Prompt for $250M. This is the third major acquisition we've seen in the AI security space, with Cisco picking up Robust Intelligence a year ago, and Palo Alto picking up Protect AI last month. There are more interesting targets in this market, so don't expect the acquisitions here to slow down.
4. ESSAYS: Why SOC Analysts Ignore Your Playbooks

   This is a great example of how, often when efforts to solve problems fail, it's because you didn't properly understand the problem or the processes related to that problem.

5. NEW FEATURES: From Exposure Whack-a-Mole to Autonomous Cyber Risk Management: Meet Agentic AI on the Qualys Platform

   Adrian: the problem I have with a lot of these AI announcements is that it seems like the company asked, "where can we shoehorn AI into our product", rather than, "what are the core issues our customers need us to solve"?

   Would you rather have 98% less nonsense vulnerabilities in your results, or a dozen new AI agents?