Dark web intelligence, bio-authorization and even plain old cloud security: Cybersecurity commands a futuristic and slightly dystopian-sounding lexicon. One term that may well become more familiar is deception technology. It’s a small but growing field that has sparked the interest of some of the largest multinational companies.
Israeli startup illusive networks, which is the way they spell it – no capital letters for a deception technology firm, and Germany-based pharmaceutical and life sciences company Merck KGaA, Tuesday announced a deal for the use of illusive’s “Deception Everywhere” cybersecurity technology.
Merck, a company with over $15 billion in net sales last year, has an extensive network to protect that stretches across six continents and has intellectual property worth millions. A 2015 Ponemon Institute study found that together with the financial services industry, pharmaceutical companies suffer the highest cost from data breaches.
Companies such as illusive don’t come into play at the first, most basic level of defenses against cyber threats, explains Merck’s Branden Newman, head of business technology security.
“The idea is that if an advanced attacker makes it past these standardized controls, there is a next level of protection that really protects our crown jewels,” says Newman, who used to work for the U.S. Army Cyber Command. This level is where illusive fits in, as well as on the level of the continuous monitoring the system undergoes.
Illusive networks is the first company to come out of Israel’s team8, the cybersecurity startup incubator set up by of veterans of the Israeli military’s Unit 8200, says illusive’s founder and CEO Ofer Israeli. He explains that the deception technology developed by illusive is really attractive to high-risk clients, like those in the financial services and pharmaceutical industries
“The types of attacks that we are catching and that we have been built to mitigate are really those low probability high-impact attacks. The ones that won’t hit you every day but when they do hit you it can go to tens and hundreds of millions of dollars,” says Israeli.
The value of the deal has not been disclosed but Merck’s Newman says that the extra layer of protection afforded by illusive does not come at a huge price. “Monetarily it’s a relatively a low investment compared to the overall the security portfolio.”
That’s partly because deception technology is not yet as widespread as more standardized cybersecurity solutions. Gartner research estimates that by next year one in ten companies will deploy deception technology and various reports estimate the market for it by 2021 to be between $1.33 billion and $1.7 billion.
There are several reasons why Merck went for illusive over two or three other candidates, says Newman. Among those are the Israeli technology’s “proactive approach” and “ease of deployment” that obviates the need for a mass install across Merck’s systems.
He likens the technology to a corridor with lots of doors. If attackers enter the corridor, they don’t know which door to go through and if they even lightly jar one, the system is alerted.
Merck keeps a close tab on Israeli cybersecurity startups, says Newman. “We have a very close connection to the U.S. startup scene but we also do keep an eye on the Israeli startup scene, particularly in the cybersecurity area because they have a very strong cybersecurity startup scene.”
In the meantime, illusive has spread its wings beyond Israel, especially in terms of sales and marketing, says Ofer Israeli. “From an R&D perspective, Israel is a perfect fit. For sales and marketing there’s a much clearer fit in other portions of the world such as the United States,” says Israeli.
The company has gathered more than $30 million from early investors, including Microsoft Ventures, Cisco, Citi Ventures and NEA.