One of the hottest new developments in generative AI is “copilots” for cybersecurity. Microsoft has one. Google too. He also does Vicarius the vulnerability remediation platform: recently launched a text-generating AI tool, vuln_GPT, that helps write detection and remediation scripts for system breaches.
Perhaps it was Vicarius's trend following that caught investors' attention, as well as (I'd bet) the startup's five-fold year-over-year growth. Vicarius co-founder and CEO Michael Assraf says the company's customer base recently included 400 brands, including PepsiCo, Hewlett Packard Enterprise and Equinix.
Regardless of what put Vicarius on backers' radar, the company recently closed a $30 million Series B round led by Bright Pixel Capital with participation from AllegisCyber Capital, AlleyCorp, and Strait Capital. The round, which doubles Vicarius' previous valuation (a valuation Assraf unfortunately declined to disclose) brings Vicarius' total raised to ~$56,7 million, the bulk of which Assraf says goes toward to advance Vicarius' product roadmap and double the size of its 43-person Team.
Vicarius automates much of the workload of discovery, prioritization and remediation that impacts security and IT teams,” Assraf said. “As an early adopter of product-led growth, Vicarius’ self-service model changes the buyer’s paradigm for cybersecurity solutions by enabling customers to transparently try and find value…before they buy.”
Vicarius was founded several years ago by Assraf, Yossi Ze'evi, and Roi Cohen, who noticed (at least the way Assraf tells it) that attackers were reusing the same "blocks" to carry out cyberattacks.
"Those building blocks are operating system and third-party APIs provided by compiled software libraries and the operating systems themselves," Assraf said. “The main idea of Vicarius was to build an intelligent permissions manager for APIs at the system level.”
Image credits: Vicarius
Today, Vicarius scans applications for vulnerabilities and alerts customers about them. When no patch is available, Vicarius applies what Assraf calls "in-memory protection," which apparently protects the application without the need for a software update (although I'm a bit skeptical).
Vicarius also offers access to a community of security vulnerability researchers where researchers can share fix and detection scripts and be rewarded for doing so with a virtual currency, as well as a community data set that Vicarius uses to train the vuln_GPT mentioned above. Vuln_GPT, by the way, does not run completely unattended: Assraf says that all AI-generated scripts are "validated" before being sent to Vicarius clients. Customers can give feedback on a module's scripts.
“We want to emphasize that Vicarius seeks to lead AI-based vulnerability remediation at any stage,” Assraf said, “from detection to prioritization to proactive remediation.”
Vicarius is ambitious, to be sure, with plans to allow security researchers in its community to spend their money on products, launch educational courses, and integrate the Vicarius platform with existing system release platforms like ServiceNow and Jira. The startup also aims to grow in new markets, particularly Asia Pacific, while expanding into markets it currently operates in, including North America and Europe.
"For years, companies have been struggling with implementing vulnerability management processes that require too many tools and create too many alerts and too much work for overstretched security teams," Assraf said. “While most security processes advanced one or two generations, management of the vulnerability remediation cycle lagged behind, exposing companies to cyber risks. As a result, customers are looking for a single platform that consolidates, customizes and scales the vulnerability remediation process.”
