Aqua Security

Aqua Security is an Israeli cloud-native application protection company, founded in 2015. In 2021, Aqua Security reached a $1B valuation. It is home to the research team, Aqua Nautilus, focused on cybersecurity research of the cloud native ecosystem. In 2023, the U.S. Army signed with Aqua Security a multimillion-dollar contract for cyber protection services to enhance cloud expansion, zero-trust implementation, and secure software development. The company initially focused on container workload protection and added serverless and VMs in 2017 to achieve comprehensive Cloud Workload Protection Platform (CWPP) capabilities.
In September 2016, the company raised $9 million in Series A funding led by Microsoft Ventures. Previous investors TLV Partners and Shlomo Kramer also participated in the round, bringing Aqua's total investment to date to $13.5 million. It was followed by a $25 million series B funding in 2017. In the spring of 2017 the company opened its Boston office.
Aqua Security raised $62 million in 2019 in funding led by Insight Partners, with participation from Lightspeed Venture Partners, M12 (), TLV Partners, and Shlomo Kramer.
Aqua raised $30 million in a series D round closed in May 2020. In 2021, Aqua was a finalist in Application Security for the 2021 CISO Choice Awards and received the Duns 100 List Award among the Top 6 Best Startups to Work for in 2021. The company was featured in the 2021 CRN Emerging Vendors as a Security Vendor and was named 'Best in Show' in Software Development in The 2021 SD Times 100.
In June 2022 Aqua Security and the Center for Internet Security (CIS) released the first formal guidelines for software supply chain security. CIS Software Supply Chain Security Guide provides enterprises with foundational recommendations for securing the software supply chain against threat actors. In 2023, Aqua received Frost & Sullivan Best Practices, Intellyx Digital Innovator Award, and the 2023 CISO Choice Awards for Cloud Workload Protection Platform.
In 2023, the U.S. Army signed with Aqua Security a multimillion-dollar contract for cyber protection services to enhance cloud expansion, zero-trust implementation, and secure software development.
In January 2024, the company raised $60 million, extending its Series E round of funding to $195 million. In May of the same year, the company introduced new capabilities designed to secure the development and operation of generative AI applications utilizing Large Language Models (LLMs). In 2024, the company was listed in the Fortune Cyber 60 CRN Cloud 100 and named among Built In's Best Workplaces.
The company's global headquarters is located in Ramat Gan, Israel, with US headquarters in Boston, Massachusetts, and R&D Center in Hyderabad, India. Dror Davidoff is the CEO of the company, and Amir Jerbi is CTO.
Acquisitions
In 2019 Aqua Security acquired CloudSploit, a cloud security posture management company, which tracks and enforces practices on the security of user and service accounts on public cloud platforms such as GitHub, AWS and Microsoft Azure. It acquired Darkbit in 2021. Darkbit founders, Brad Geesaman and Josh Larsen joined Aqua Security team. The company acquired Argon, a startup with capabilities for securing the software supply chain in December 2021. The same year, Aqua acquired tfsec, an open-source security scanner for Infrastructure as Code (IaC). The acquisition brought integration of tfsec into Aqua Trivy, adding IaC security scanning capabilities. Tfsec's co-founders also joined Aqua following the acquisition.
Threat research
Aqua Security's research team Aqua Nautilus focuses on cybersecurity research of the cloud native ecosystem. It specializes in discovery of new vulnerabilities, threats, and attacks targeting containers, Kubernetes, serverless computing, and public cloud infrastructure to develop methods and tools to address them. The team publishes security researches, surveys and threat alerts, including “Phantom Secrets: Undetected Secrets Expose Major Corporations” a 2024 research, that showed underlying processes within Git-based Source Code Management systems (SCMs) cause code to remain accessible even after being deleted or overwritten, continuing to expose previously leaked secrets. Another 2024 research “Kinsing Exposed: From Myth to Architecture - A Complete Cybersecurity Chronicle,” provided research into the ongoing threat from Kinsing malware. “Snap Trap: The Hidden Dangers Within Ubuntu’s Package Suggestion System” research discover that a logic flaw between 'command-not-found' package suggestion system and the snap package repository could enable attackers to promote malicious Linux packages to users. Aqua Nautilus analyzed a sample of 1% of GitHub repositories and found that about 37,000 of them are vulnerable to RepoJacking, including the repositories of companies such as Google and Lyft. The 2023 research from Aqua Nautilus collected honeypot data over a six-month period and showed that more than 50 percent of the attacks focused on defense evasion.
Platform
Aqua's Cloud Native Application Protection Platform (CNAPP) provides unified security for cloud native applications throughout their lifecycle. It combines shift-left security with runtime protection and posture management to defend against known and unknown threats. Aqua's threat research team, Nautilus, enhances the platform with insights to guard against zero-day threats using advanced behavioral detection. Aqua's platform is scalable in large deployments, securing environments across on-premises, multi-cloud, and hybrid configurations.
Open source products
Aqua Security has an open-source development team responsible for several open-source tools, the most popular of which are security scanner Trivy and Tracee. Trivy Vulnerability Scanner was acquired by Aqua open source team in 2019. Teppei Fukuda, the developer behind Trivy, joined the Aqua Security team after the acquisition. Other tools include Kube-bench, Kube-hunter, and chain-bench.

Main Menu

See Also

Main Menu