Cynomi Secures $37M for AI-Powered Virtual CISO Platform Targeting SMB Cybersecurity

Cynomi cinches $37M for its AI-based 'virtual CISO' for SMB cybersecurity | TechCrunch

Small and medium businesses are the newest targets for cybersecurity attacks, with 1 in 3 breached last year. SMBs are becoming more proactive in detecting and stopping these threats, and today a startup called Cynomi is announcing $37 million in funding to meet that demand. Insight Partners and Entrée Capital are co-leading the round, with previous backers Canaan, Flint Capital, and S16VC also participating. Cynomi previously raised around $23 million (including this seed round we covered in 2022). We understand from sources close to the deal that the valuation post-money is more than $140 million. London and Tel Aviv-based Cynomi was founded by CEO David Primor, a PhD who previously was the CTO and head of R&D of the Israeli Defense Forces; and COO Roy Azoulay, whose experience spans being a founder (his last company was one of the big innovators in deepfake detection) and a spotter of other founders (he started and led the first startup incubator at Oxford University, making a big return when an early portco, Onfido, sold for a big return). Their combined cyber and market-timing experience is playing out in an interesting way in this latest venture. Cynomi leans, at a basic level, into the trend of using AI-based agents and copilots to do complicated and high-volume work, but it's also pushing the boundaries of what we might expect those AIs to do. CEO Primor describes Cynomi's product not as a copilot but as a "virtual CISO" -- an automated, AI-based decision maker helping smaller organizations understand how to run their security operations. Around that, it's building from the ground up a number of actions and tools that the virtual CISO is capable of carrying out: it can assess a network, plan a set of security policies for the company in question, provide a remediation plan (but not yet remediation itself), track progress around a particular plan, run analytics to determine vulnerabilities across a network, provide recommendations to optimize a system, and then produce reports giving an overview of overall network status and health. All of this, in turn, is not sold directly by Cynomi to SMBs but via third parties like service providers that SMBs typically use for network connectivity and other managed services. The gap in the market that Cynomi is built upon is a very large one. Malicious hackers in the past focused exclusively on the more valuable target of larger businesses. But these days, using AI and other automated techniques, they have started to focus on the long tail in the market. SMBs are (by their nature) small but numerous, accounting for some 90% of all businesses globally, so tapping into them collectively, therefore, can be very lucrative pickings. SMBs themselves face some particular challenges, however, around budget and manpower, and that is where a product like Cynomi's comes in. "A virtual CISO service can start at $10,000 to $12,000 a year," notes Azoulay, the COO. "A human CISO would be about at least 10 to 15 times that. It's about having the knowledge and to be a sophisticated buyer in the sense of finding that CISO. It's also about having a CISO [be online] the full week, 52 weeks a year." And that formula, so far, has worked. Cynomi's business has seen its ARR triple in the last year, Primor said, with now more than 100 service provider and consultancies -- including big telcos like Deutsche Telekom -- reselling Cynomi's services to their tens of thousands of SMB customers. Some 80% of its customers are in the U.S. -- an intentional initial focus that it will be now widening to Europe and eventually other markets. The funding will be used for more R&D and business development because the startup believes there is an even bigger opportunity ahead than just virtual CISOs. "The cyber security consulting space is a $163 billion business, but we believe it doesn't really have an operating system," said Azoulay. "We believe Cynomi can be that operating system." There are dozens of cybersecurity companies out there targeting SMBs, and even a sizeable group that have identified service providers as their primary sales channel. They include the likes of Vanta, Cohere, Qualys, Coro, Bastion, Guardz. CyberSmart, Cowbell, and DataGuard. Philine Huizing, MD at Insight Partners, said that it's the "vCISO" hook that reeled it in as an investor. "We believe Cynomi is defining a new category with its vCISO platform," she said. Meanwhile, its focus on working with managed service providers to deliver the product means it can be tailored or augmented with whatever other services service providers are building or selling, to differentiate the service and keep it from being another commoditized offering. "MSPs can assess each client's unique risks, customize strategies by industry, and efficiently manage day-to-day interactions, making them more impactful," she added.

Cynomi nabs $37M for its AI-powered vCISO platform

Cynomi Ltd., a startup that uses artificial intelligence to improve companies' cybersecurity posture, has raised $37 million in funding to grow its market presence. The Series B round was announced today. Lead investors Insight Partners and Entrée Capital were joined by existing backers Flint Capital, S16VC and Canaan. The latter firm led Cynomi's previous $20 million raise last April. Israel-based Cynomi provides what it describes as a vCISO platform. A CISO, or chief information security officer, is a company's top cybersecurity executive. The term vCISO, in turn, refers to a type of consulting service that's provided by senior cybersecurity professionals to help enterprises lower the risk of breaches. Cynomi's platform makes it easier for companies to provide vCISO services. The software is geared mainly toward managed services providers and managed security service providers. Following its previous funding round last year, Cynomi disclosed that more than 100 such companies have adopted its platform. A service provider with a vCISO offering can use Cynomi to automatically map out vulnerabilities in customers' networks. The platform finds weak points using multiple methods. It generates questionnaires that customers of a vCISO service can fill to provide an overview of their cybersecurity posture. For added measure, Cynomi scans those customers' websites and other public-facing technology assets to find security issues. After mapping out the vulnerabilities in a company's network, the platform generates recommendations on how to fix them. It groups those suggestions by category to ease remediation. One set of tips might focus on improving a company's access controls, while another may provide pointers on reducing the risk of phishing. Cynomi ranks the cybersecurity suggestions it generates by urgency to help customers prioritize their work. A recommendation to fix a vulnerable production database, for example, might be placed above an alert about a development environment. It says that its AI generates a natural language explanation of each suggestion to ease administrations' work. The company positions its software as a way for service providers to more easily launch vCISO offerings. Service providers that already offer such an offering, meanwhile, can use Cynomi to boost operational efficiency. The platform's automation features promise to speed up some of the tasks involved in protecting a client organization's network. There's also a reporting toolkit that a service provider can use to update customers about their cybersecurity posture. According to Cynomi, its reporting features have other applications as well. The data that the platform collects about a company's cybersecurity posture can be used to negotiate more favorite rates with cyber insurance providers. The company says its latest funding round follows 12 months in which its annual recurring revenue tripled. The year before that, the company's sales more than quadrupled. It will use the new capital to grow its U.S. sales team and establish a bigger presence in Europe. Additionally, it plans to roll out new cybersecurity features powered by AI agents.