Startup Virsec Systems says it can eliminate the need for most cybersecurity tools

Having dwelt largely in the shadows for the past six years, cybersecurity startup Virsec Systems Inc. is now doing some flag-waving about its claim that it has developed a radical new approach to protection that can render most other security products unnecessary.

Led by a team of cybersecurity veterans, the company says it can detect attacks by understanding the intended behavior of software and identifying and blocking irregularities in a few milliseconds.

The company has been awarded 45 patents, filed for dozens more and boasts a large base of early enterprise-class customers in government, military, insurance, telecommunications and healthcare. Its board includes former EMC Corp. Chairman Mike Ruettgers, former Cisco Systems Inc. Chief Executive John Chambers and former CIA Director George Tenet.

CEO Dave Furneaux, whose more than 140 venture investments have focused heavily on the cyber realm, said the industry is stuck in a response and recovery cycle that is failing to stop the growing fusillade of cyberattacks. “It’s insanity to expect we should keep doing things in the same way,” he said. “The attacks still get through. Even if a vulnerability is known, there’s a lag time to remediate it, the job is manually intensive and it’s hard to hire people.”

Virsec comes at the problem by embedding a read-only application called AppMap into memory to provide what it calls deterministic protection. The software analyzes running code to learn what permutations the software can invoke and then monitors the full operating stack to detect deviations from intended outcomes and stop them instantly.

“We don’t touch the software, but we map at a very low level to understand its behavior,” Furneaux said, comparing the process to that of a GPS navigation system that understands a map and can navigate from point to point.

Do no harm

“It’s a do-no-harm implementation that does not affect performance,” said David Reilly, former chief information officer of Bank Of America Corp.’s global banking and markets division and an adviser to the company. “It works across static or dynamic environments. The mapping is so quick that it can handle containers, cloud native environments, air-gapped servers and data centers.”

The company says its software can stop 100% of attacks, including zero-day or previously unknown exploits, ransomware, malware and vulnerability exploits like the catastrophic Log4j exploit without patching. In a test with the U. S. Department of Defense involving 218 ethical hackers and 14,300 hacking attempts, the DOD said Virsec was “the first security platform ever tested with perfect results,” according to the company.

“We’ve done red team testing with every one of our production customers and they haven’t experienced an attack,” Furneaux said. “We don’t care if it’s a known or unknown vulnerability; we’ll protect you.”

The end of alerts

Virsec says its software can fix 95% of the 25 most dangerous weaknesses identified by The MITRE Corp. The 5% it can’t foil relate to missing authorizations, incorrect permissions and authentication errors. Virsec is up-front about what it can’t stop, including account hijacks, misconfigurations and network attacks such as distributed denial-of-service.

Although the company’s approach doesn’t obviate the need for other security tools, it can significantly reduce the number of discrete products needed in the security operations center and all but eliminate alerts and responses, according to Furneaux. “We’re not trying to tell the world you don’t have to use conventional protections but companies that have confidence in our approach can reduce the need for tools and people,” he said.

Virsec spent $35 million developing its core protection engine and seating initial customer installations. It raised $100 million last summer to bring its total funding to $137 million. “We’re very well-capitalized and growing extremely fast,” Furneaux said.