Sign up for my newsletter to see more interviews with the biggest names in cybersecurity.

There are a lot of interesting things happening in endpoint security nowadays and I’ve been fascinated with the progression of the space. Antivirus products were created 30 or so years ago, and up until a few years ago, there had been little innovation in endpoint security. In the past few years however, there’s been a flood of activity and money is following the innovation. Earlier this year, Ianalyzed the venture capital flowing into cybersecurity and found that in 2015 (as of mid-August), endpoint security companies had received significantly more funding than any other cybersecurity sub-sector, with nearly $300 million.

Naturally, I’ve been eager to talk to some of the leaders shaping the innovation in endpoint security (see past interviews with founders of CrowdStrike,Bromium and Cylance) and that’s why I was very excited to talk to Tomer Weingarten, the CEO and Cofounder of SentinelOne. In the interview below, Tomer and I discuss the endpoint security market landscape, some of the differentiating features between providers, and the market penetration for next-gen endpoint security products.

Why is the EDR/next-gen endpoint space getting so much attention right now? AV technology has been the same for 20 years, what was the catalyst for innovation?

For that exact reason – there was zero innovation in the space, and clearly AV tech is not up to par with current attacks. Funnily enough, the resurgence of the endpoint space is also because a lot of the promising network based measures (think sandboxing) have failed to protect against even simple attacks, mostly because of their multiple deficiencies in dealing with evasion techniques and targeting techniques that are often used in attacks today. These methods ensure that the attack will run only on the end device that it wishes to compromise and no place else – causing it effectively to evade anything on the way to that target device (the endpoint). At that point it becomes clear – protection has to be on the endpoint if you want to stand a chance at detecting a stealthy attack.

You have some very well-funded competitors like CrowdStrike, Bit9 + Carbon Black, Cylance, Tanium, CounterTack and others. In the long term, can the market hold this many players?

The endpoint market is the biggest TAM in cyber security. A lot of these players are point solutions for different problems – CrowdStrike and Bit9CB will give you the visibility and response tools (aka EDR), but not really protection or prevention. Cylance will give you some prevention – but will be also very limited to file based attacks and not give you any visibility and response tools. Tanium’s focus is on manageability, patching and IOC searches.

Overall it’s a very fragmented market. Most of these guys are only complementary to AV, and cannot replace it. The only 2 companies that are actually flat out saying they can replace the traditional AV are us and Cylance, and out of these 2, only we have both EDR functionality AND the prevention piece required to replace the AV – and all of it is based on our own proprietary execution inspection engine for dynamic behavioral analysis.

We’re also the only next-gen vendor who actually got a third party certification and was tested for efficacy rates. I think the future will show that people will opt for more unified platforms for EPP rather than point solutions.

How do you differentiate yourself from all of this competition in the endpoint space?

I think you got a good idea from reading the stuff on the top – our ability to have one product that can cover both the EDR use case, but can also replace the AV and offer better prevention capabilities is unique. The other thing I’ll point out is, attacks today are much more than malware and files, and there multiple vectors of attack you ideally want to cover. We cover pretty much all vectors of attack, from the more traditional malware, to memory based exploitation, to script based attacks and live attackers. Our ability to be focused on code execution rather than on files, allows us to tackle attacks most other platforms cannot deal with. If you have a product that’s based on IOCs for detection – how do you detect attacks that leave no IOC? If you have a product that’s based on running ML on file scan for detection – how do you detect attacks that don’t use files or payloads? These are all attacks that are happening today, so you’d really want to opt for a better, more inclusive approach, and I think that’s one of the biggest strengths of our code execution inspection and behavior analysis – they cover all of it.

You sell both an EDR product and an EPP product. How are they different? How do they work together?

In our case the products are very similar. EDR is basically designed to be complementary to an AV, while EPP has everything that EDR has plus stand alone prevention capabilities that can replace an existing AV.

You’ve written about the benefit of next-gen endpoint solutions here, but do most of the corporations that you sell to understand the need for this? Are most of them still using traditional AV? What do you think the market penetration is like for EDR/next-gen EPP?

Its a good question. I would also say that to me – EDR is NOT next gen EPP. Next gen EPP must be able to replace a traditional EPP platform, must offer prevention, must tackle exploitation and must offer endpoint visibility. EDR vendors in most cases don’t even offer true detection capabilities, and are basically a visibility tool for an analyst to decide whether what he’s seeing is malicious or not, which obviously cannot replace a standalone, real time detection and mitigation engine.

I think most customers WANT to replace their AV. I don’t think they want to bolt EDR on top of it. They just want better protection–an AV that actually works–and that’s what we’re trying to give them. The way I think about it is, EDR is for the response team to react to a breach. Next-gen EPP is for the security team to have better defense mechanism to deflect advanced attacks and zero days. Both are required, but if next-gen EPP is doing its job correctly – you’ll have much less incidences to handle.

The News:

LookingGlass Announces Cyveillance Acquisition and $50 Million Funding

• Both companies provide threat intelligence solutions. The funding comes from PA-based NewSpring Capital.

Digital Guardian Raises $66 Million, Eyes an IPO

• Digital Guardian provides data loss prevention and endpoint detection and response. The round was led by LLR partners.

Trustlook Raises $17 Million Series A Round

• Trustlook provides mobile security for Android and claims to be the first mobile security product that protects against APTs.

Secret Code Found in Juniper’s Firewalls Shows Risk of Government Backdoors

• Juniper Networks announced on Thursday that it had found “unauthorized code” embedded in an operating system running some of its firewalls. This “backdoor” could allow a hacker to gain administrative access to systems running Juniper’s firewalls.

Banks Battle Staffers’ Vulnerability to Hacks

• More and more banks are sending out test phishing emails in an attempt to reduce employees’ vulnerability to attacks. JP Morgan plans to spend $500 million on cybersecurity this year. Wells Fargo CEO John Stumpf said of cybersecurity earlier this year “it’s the only expense where I ask if it’s enough.”

I was responsible for security at the time of the hack, says TalkTalk CEO Dido Harding

• Harding claimed responsibility for the hack at a parliamentary hearing earlier this week. When questioned on whether a CEO should be responsible for cybersecurity, Harding replied “security touches everyone in the company which is why I should be directly responsible for it,”

36 tech companies that could go public in 2016

• Illumio, Palantir, Okta, Tanium and Zscaler made the list.

Google Dedicates $1M In Research Grants To Keep Google Drive Safe

• The money will go to independent security researchers who can find security flaws in Google Drive.

Russia’s cyber-attack losses may reach $1 billion

• This is significantly higher than average global figures.