SGNL hooks $30 million to incorporate new identity security based on Zero Stand privileges

Security experts often describe identity as a “new perimeter” in the world of security. In the world of cloud services where network assets and apps are broadly and in scope, the biggest vulnerabilities often leak and cause login credentials.

Called Startup sgnl We have built a new approach that we believe is excellent at ensuring the way identity is used to access apps and more. This is based on a new concept of zero-standing privileges where user access is conditional rather than “standing”. $30 million behind strong growth.

Series A funding is led by BrightMind Partners, a new VC focused on cybersecurity (we haven’t announced their first fund yet, which is expected to be later this year). Strategic investors Microsoft (via M12) and Cisco Investments and Costanoa are also involved. He led the SGNL seed round in 2022.

SGNL is currently raising $42 million and has not disclosed the valuation, but the company is definitely growing. It claims to have “multiple” major enterprise customers, including those with “major media, entertainment and technology operations,” and uses SGNL to streamline access management across the cloud environment.

Although startups do not disclose their customer list, please note that there are better plugs with the use of technologies like SGNL, ​​the kind of example of violations that arise from the identity attitude hole. MGM ($100M), T-Mobile ($350M), AT&T, Microsoftand Caesars.

SGNL was the brainchild of Scott Kriz (CEO) and Erik Gustavson (CPO), and previously co-founded another identity access management company called Bitium. Google acquired its startup in 2017 And there, he and his team are not only developing directory services for products such as Google Workspace and Google Cloud Platform, but also building and maintaining identity access management for the company itself, particularly how Google employees can access the data. It was entrusted with. .

So Kriz and Gustavson saw a gap in how identity services were managed across the enterprise identity access tools of the time.

“I realized that in essence there is a solution that is not only unique in Google but across the industry, but also lost to identity security,” he said. “We wanted businesses to reach places where they didn’t have standing access.”

In short, ID access requires a level of context. Not only passwords for each app, but access permissions are required. “But even in the (service) that was being done, there was one Octa, Microsoft was another. They were very good at opening the doors. They weren’t very good at it. It was about closing that door.”

In other words, when one situation changes – not only is the employment situation most obvious, but access has not been closed, such as whether a particular job has been completed. It created potential vulnerabilities that malicious actors exploit.

Kriz said several factors have prevented security companies from closing their access to the past. The first was the lack of agreement between standard vendors. The breakthrough for that came from another former Googler called Atul Tulshibagwale. CAEP (Continuous Access Evaluation Protocol). This underpins SGNL’s platform. CAEP has been adopted by the OpenID Foundation, and Tulshibagwale is currently the CTO of SGNL.

“It’s not unique to us, but we’re people you know and now it’s adopted by Microsoft, Apple, Cisco and big companies,” says Kriz.

The second development specific to SGNL is how we built what Kriz describes as the “rich context” used to build access management. This essentially allows businesses to set multiple access policies as well as many more criteria that they need to meet in order for someone to access a particular app or other data. .

SGNL was created not only as a structure of how access is allowed (or closed) but also as something that describes as a “data fabric” that allows individual data sources to function without relying on the latest version. Kriz points out that one of its customers has 400,000 employees and 30,000 roles within AWS, which helps reduce the six policies (and the multiple conditions associated with them). I did. (For the AI ​​by that name, we use AI to build and manage this data fabric.)

Along with many startups, there are more big companies on zero standing privileges, including Cyberart and Sailpoint. But it doesn’t stop investors.

“I love the fact that they founded and left the company and spent quite a bit of time on Google. They’re very important. They understand how big companies work. ” said Stephen Ward, one of the founders of Brightmind (and he himself was a former CISO who was a former Homedepot and former government security specialist). “It’s not about popular ventures, but with this big idea, you can create a big moat just by building a platform.”