The Era of Self-Defending Applications

Enterprise security is a large and ever-increasing endeavor for organizations operating in public and private clouds. In spite of increased spend on security solutions, news of cyber breaches remains incessant.

One of the main reasons behind this is the increasing complexity of the cloud application stack and the expanding attack surface of an application in the multi-cloud era. To keep an application and its data secure, enterprises must secure not only the application, but also its compute infrastructure, the operating system, the network, the perimeter, and all the interactions between different personnel and the application. A single vulnerability in this gigantic attack surface is all that a potential attacker needs to compromise the complete system.

Today, we are excited to announce our investment in Fortanix which brings a fundamentally new approach to security for distributed, scale-out enterprise applications on any cloud.

A radically new approach to security - self-defending applications

Most organizations today work in a combination of clouds including private, public, and remote. Their level of control over the infrastructure varies widely depending on the type of the infrastructure. This presents a unique challenge to the security organizations since they need to secure the applications on all the infrastructure.

Fortanix starts with the realization that security in the cloud needs to be built from the ground up as opposed to bolt-on, pro-active as opposed to reactive and portable and decoupled from infrastructure as opposed to cloud specific. In addition, it needs to be delivered as a service for containerized applications as first class citizens.

The service protects an entire application from advanced attacks, including all types of zero-day bugs, firmware based attacks, advanced persistent threats, malware, and privilege escalation attacks on any untrusted cloud. In addition, a scale out, distributed systems architecture written from the grounds up provides complete security and privacy to the application, so much so, that even a malicious insider or the cloud infrastructure would not be able to compromise the application.

Their core technical approach is to make applications self-defending so that they can secure themselves even when infrastructure is compromised. Fortanix’s proprietary technology, Runtime Encryption, allows applications to run securely by encrypting all the data and code even during compute. This approach cuts the attack surface by many orders of magnitude by moving operating systems, root credentials, IT admins, and cloud providers outside the trust boundary.

Fortanix’s radically new approach associates security with the applications. Applications remain secure wherever they execute and security becomes decoupled from infrastructure. They are re-thinking cloud security taking into account the latest improvements in chip architecture and rethinking the computing software stack from the CPU to the application so that enterprise applications can operate with complete privacy and security on any cloud. 

A journey of a thousand miles with a highly special team

When we met Ambuj, Anand and Andy we found three long-term friends from IIT-Kanpur and MIT with deep innovative background in everything from transistor to cloud. The company has gathered a brilliant team of PhDs and security specialists with education from MIT, Stanford, Berkeley and IIT Kanpur and working experience at some of the most well-respected security companies. We are in awe of the bold vision of Fortanix of running every single critical application in a self-defending state. We couldn’t be more thrilled to back the Fortanix team and help them realize their vision of providing provable, portable, and preventive security to all applications!

Kittu Kolluri

Aditya Singh

NeoTribe Ventures

https://www.neotribe.vc