Sign up for my newsletter to see more interviews with the biggest names in cybersecurity.

This week I had the pleasure of talking to Caleb Sima, the Cofounder and Executive Chairman of Bluebox Security. Caleb was previously an entrepreneur in residence at Andreessen Horowitz (where he first started working on Bluebox) and was CEO of Armorize Technologies–a SaaS-based code security analysis company. Bluebox protects mobile applications and the data inside them. Bluebox has raised $27.5 million from A16Z, Tenaya, Queensbridge, and others.

You’ve said that enterprises should be focusing on mobile data management, rather than mobile device management. Why is this shift necessary? How are traditional MDM providers adopting to this new landscape?

I’ve seen the same cycles in any technology and mobile is no exception. Looking back when servers were coming out, we followed a process. First it was all about protecting the network with firewalls, then it was about protecting the server, then it moved to how to protect the applications on the server and finally it moved to protecting the data on the server. Mobile is just a repeat of this cycle. When mobile first came out the most logical and simple answer was to manage/protect the device. Lets learn from our past and shortcut this since we know where the puck is heading–the apps & data. As we move to watches, cars, tvs etc consuming content, managing devices moves out of your control. Moving ahead in the future, data will become what you own as it’s piped into a mesh network consisting of services, networks & servers that you don’t control. All providing solution to help you manage, filter, share & report that data. So as the industry shifts from the device mindset into the app mindset, look for us to make that same shift in a couple years from app to data.

I know that consumers tend to be unsatisfied with traditional MDM solutions but are enterprises (who are the actual buyers) also unsatisfied? How so?

Yes and no. MDM absolutely has great value for certain use cases. For example in an organization in which the devices are provided by the enterprise, MDM is a no-brainer. Great examples are educational facilities, medical & retail, where employees use the devices strictly for business purposes and many times may not have a direct owner but it is instead a tablet that is passed from user to user. When we start moving into the ‘extended enterprise’ or ‘byod’ realm, the rub starts coming in mostly around two areas, User privacy & Data security. In this instance the major pain points come from the users and from the security team. This is where MDM struggles and why many have started to turn towards protecting and managing apps versus devices in these use cases. Also another major source of pain that I have heard from customers are your typical enterprise integration and performance struggles–where the MDM product won’t handle large deployments w/out major investment.

You’ve received a lot of press for your “self-defending applications.” Can you explain what you mean by self-defending and how it works? Do you see your product as a sort of mobile data loss prevention product?

Self-defending is used to describe what an app must be in order to work in a zero trust model. The goal is to be able to run in malicious environments.

Would you say that the self-defending aspect is the biggest differentiator between BlueBox and other companies that provide sandboxing technology?

We provide three main functions for mobile applications; we secure, defend and respond.

Secure: Companies in this category include Good and Mocana. All of these companies have “wrappers,” meaning they will take any app and add a container and 9/10 times it encrypts data at rest. Additionally they provide capabilities like jailbreak detection and root detection. All of these companies are focused on enterprise BYOD apps.

Defend: Companies in this category include Arxan and Metaforic. These companies take jailbreak and root detection capabilities put them on steroids. These apps try to do everything they can to make it as hard as possible for hackers to hack the app. These companies are focused on consumer apps, not enterprise apps and the main use case is IP protection for enterprises providing content to individuals.

Respond: This is mobile threat intelligence. We know attackers will always attack your stuff and they will break in at some point. The key thing is being able to see them when they do it. These companies allow enterprises to see what has changed on a desktop or endpoint and determine whether that is malicious.

At Bluebox, we combine all of these into a single product and provide it for consumer or enterprise applications.

The News:

Mattermark’s Cyber Security Startups Vertical Overview

• The fastest growing companies according to Mattermark’s growth score(which tracks changes in website visitors, mobile downloads, social media metrics, employees, and publicly announced funding) include SkyHigh, Tenable, SumoLogic, Code42 and Bit9. The most active investors are BVP, Atlas, Khosla, Accel and A16Z. I actually downloaded Mattermark’s free trial, scrubbed the cybersecurity funding data, and am creating a report on 2014 and 2015 cyber funding that I’m really excited to share next week or the week after.

Cloud security sector leads cybersecurity mergers and acquisition report

• A look at the Q2 cybersecurity M&A.

IoT Startup Producing ‘First Ever’ Airborne IoT Security Product Following $9M Funding Round

• Bastille announced that it had raised money from Bessemer on Wednesday. The company plans to use the money to create an IoT security product that scans organizations’ airspaces to gain visibility into any device that produces airborne emissions.

Researchers Hack a Tesla, but Tesla has Already Released a Patch

• Lookout cofounder and CTO Kevin Mahaffey and CloudFlare’s Marc Rogers discovered that you could plug a laptop into a Model S and drive away with it. They also found that you could leave a Trojan on the car’s network, allowing you to cut the power remotely. Tesla remotely distributed a patch to every Model S on the road on Wednesday–pretty amazing when you compare this to Chrysler, who recently was forced to recall 1.4 million cars due to vulnerabilities.

‘Insane’ Acquisition Spree and Blue Coat’s Renaissance 

• Since it was taken private by Thoma Bravo in 2012, Blue Coat has acquired Crossbeam Systems (security for third party vendors), Netronome’s secure socket layer product line (its fastest growing business), and Solera Networks (network forensics) and just recently the CASB Perspecsys. The firm decided to sell itself in March to Bain Capital because unlike many of the other PE firms they had talked to, Bain was enthusiastic about Blue Coat’s aggressive acquisition strategy.

Startup Spotlight: BrightPoint Security’s Threat Intelligence Management

• The company, formerly known as Vorstack, enables organizations to share threat information with other companies and to choose which details to omit or disclose. The company has raised $8.4 million from EMC, Aligned Partners and TechOperators.

Proofpoint CEO On How To Keep Up With Rapidly Evolving Security Landscape

• CEO Gary Steele said that the fact that because they have a cloud model, their release cycles are every six weeks. This allows them to evolve in lockstep with the rapidly changing threat landscape. Steele also said that most of Proofpoint’s growth is coming from their advanced threat protection solutions and their solutions to protect against attacks coming from social media.