Personal blog of Yzmir Ramirez

As we get further along in the new way of working, the new normal if you will, finding more efficient ways to do just about everything is becoming paramount for companies looking at buying new software services. To that end, Comet.ml announced a $4.5 million investment today as it tries to build a more efficient machine learning platform.

The money came from existing investors Trilogy Equity Partners, Two Sigma Ventures and Founder’s Co-op. Today’s investment comes on top of an earlier $2.3 million seed.

“We provide a self-hosted and cloud-based meta machine learning platform, and we work with data science AI engineering teams to manage their work to try and explain and optimize their experiments and models,” company co-founder and CEO Gideon Mendels told TechCrunch.

In a growing field with lots of competitors, Mendels says his company’s ability to move easily between platforms is a key differentiator.

“We’re essentially infrastructure agnostic, so we work whether you’re training your models on your laptop, your private cluster or on many of the cloud providers. It doesn’t actually matter, and you can switch between them,” he explained.

The company has 10,000 users on its platform across a community product and a more advanced enterprise product that includes customers like Boeing, Google and Uber.

Mendels says Comet has been able to take advantage of the platform’s popularity to build models based on data customers have made publicly available. The first one involves predicting when a model begins to show training fatigue. The Comet model can see when this happening and signal data scientists to shut the model down 30% faster than this kind of fatigue would normally surface.

The company launched in Seattle at TechStars/Alexa in 2017. The community product debuted in 2018.

While most people probably would not think of New York as a hotbed for enterprise startups of any kind, it is actually quite active. When you stop to consider that the world’s biggest banks and financial services companies are located there, it would certainly make sense for security startups to concentrate on such a huge potential market — and it turns out, that’s the case.

According to Crunchbase, there are dozens of security startups based in the city with everything from biometrics and messaging security to identity, security scoring and graph-based analysis tools. Some established companies like Symphony, which was originally launched in the city (although it is now on the west coast), has raised almost $300 million. It was actually formed by a consortium of the world’s biggest financial services companies back in 2014 to create a secure unified messaging platform.

There is a reason such a broad-based ecosystem is based in a single place. The companies who want to discuss these kinds of solutions aren’t based in Silicon Valley. This isn’t typically a case of startups selling to other startups. It’s startups who have been established in New York because that’s where their primary customers are most likely to be.

In this article, we are looking at a few promising early-stage security startups based in Manhattan

Hypr: Decentralizing identity

Hypr is looking at decentralizing identity with the goal of making it much more difficult to steal credentials. As company co-founder and CEO George Avetisov puts it, the idea is to get rid of that credentials honeypot sitting on the servers at most large organizations, and moving the identity processing to the device.

“The goal of these companies in moving to decentralized authentication is to isolate account breaches to one person,” Avetisov explained. When you get rid of that centralized store, and move identity to the devices, you no longer have to worry about an Equifax scenario because the only thing hackers can get is the credentials on a single device — and that’s not typically worth the time and effort.

At its core, Hypr is an SDK. Developers can tap into the technology in their mobile app or website to force the authorization to the device. This could be using the fingerprint sensor on a phone or a security key like a Yubikey. Secondary authentication could include taking a picture. Over time, customers can delete the centralized storage as they shift to the Hypr method.

The company has raised $15 million and has 35 employees based in New York City.

Uplevel Security: Making connections with graph data

Uplevel’s founder Liz Maida began her career at Akamai where she learned about the value of large data sets and correlating that data to events to help customers understand what was going on behind the scenes. She took those lessons with her when she launched Uplevel Security in 2014. She had a vision of using a graph database to help analysts with differing skill sets understand the underlying connections between events.

“Let’s build a system that allows for correlation between machine intelligence and human intelligence,” she said. If the analyst agrees or disagrees, that information gets fed back into the graph, and the system learns over time the security events that most concern a given organization.

“What is exciting about [our approach] is you get a new alert and build a mini graph, then merge that into the historical data, and based on the network topology, you can start to decide if it’s malicious or not,” she said.

The company hopes that by providing a graphical view of the security data, it can help all levels of security analysts figure out the nature of the problem, select a proper course of action, and further build the understanding and connections for future similar events.

Maida said they took their time creating all aspects of the product, making the front end attractive, the underlying graph database and machine learning algorithms as useful as possible and allowing companies to get up and running quickly. Making it “self serve” was a priority, partly because they wanted customers digging in quickly and partly with only 10 people, they didn’t have the staff to do a lot of hand holding.

Security Scorecard: Offering a way to measure security

The founders of Security Scorecard met while working at the NYC ecommerce site, Gilt. For a time ecommerce and adtech ruled the startup scene in New York, but in recent times enterprise startups have really started to come on. Part of the reason for that is many people started at these foundational startups and when they started their own companies, they were looking to solve the kinds of enterprise problems they had encountered along the way. In the case of Security Scorecard, it was how could a CISO reasonably measure how secure a company they were buying services from was.

“Companies were doing business with third-party partners. If one of those companies gets hacked, you lose. How do you vett the security of companies you do business with” company co-founder and CEO Aleksandr Yampolskiy asked when they were forming the company.

They created a scoring system based on publicly available information, which wouldn’t require the companies being evaluated to participate. Armed with this data, they could apply a letter grade from A-F. As a former CISO at Gilt, it was certainly a paint point he felt personally. They knew some companies did undertake serious vetting, but it was usually via a questionnaire.

Security Scorecard was offering a way to capture security signals in an automated way and see at a glance just how well their vendors were doing. It doesn’t stop with the simple letter grade though, allowing you to dig into the company’s strengths and weaknesses and see how they compare to other companies in their peer groups and how they have performed over time.

It also gives customers the ability to see how they compare to peers in their own industry and use the number to brag about their security position or conversely, they could use it to ask for more budget to improve it.

The company launched in 2013 and has raised over $62 million, according to Crunchbase. Today, they have 130 employees and 400 enterprise customers.

If you’re an enterprise security startup, you need to be where the biggest companies in the world do business. That’s in New York City, and that’s precisely why these three companies, and dozens of others have chosen to call it home.

When you think about critical infrastructure, DNS or domain naming services might not pop into your head, but what is more important than making sure your website opens quickly and efficiently for your users. NS1 is a New York City startup trying to bring software smarts and automation to the DNS space.

“We’re a DNS and [Internet] traffic management technology company. We sit in a critical path. Companies point domains at our platforms,” company CEO and co-founder Kris Beevers told TechCrunch. That means when you type in the domain name like Google.com, you go to Google and you go there fast. It’s basic internet plumbing, but it’s essential.

Beevers cut his teeth as head of engineering at Voxel, a cloud infrastructure company that was acquired by Internap in 2012 for $35 million. He and his NS1 co-founders saw an opening in the DNS space and launched the company in 2013 with a set of software-defined DNS services. The startup was able to take advantage of the New York startup ecosystem early on to drive some business, even before they went looking for funding, but one incident really helped put the company on the map and effectively double its business.

That event occurred in almost exactly two years ago in 2016. One of NS1’s primary competitors, Dyn, a New Hampshire-based DNS company was the victim of a massive DDoS attack that took down the service for hours. When critical infrastructure like your domain name server goes away, you see the consequences pretty starkly and suddenly customers realized they didn’t just need this service, they needed redundancy in case the primary service went down — and with that attack, NS1’s business effectively doubled overnight.

Suddenly everyone who owned one, needed another for redundancy. One competitor’s misfortune turned out to be highly beneficial for NS1, who turned out to be in the right place at the right time with the right solution. Dyn was actually acquired by Oracle later that year.

“DNS had been around since 1983. The first 20 years were very boring with no commercial ecosystem,” Beevers said. Even when it went commercial in the early 2000s, nobody was looking at this as a software problem. “We saw everyone in this space was a hardware or networking vendor. Nobody was a software company. Nobody had thought about automation or how automation fit into the stack. And nobody saw the big infrastructure trends,” Beevers explained.

They got their start in the adtech startup space that was booming in NYC when they launched in 2013. These companies were willing to take a chance with an unknown startup, partly because they were looking for any edge they could get, and partly because they knew Beevers from his days at Voxall so he wasn’t a completely unknown quantity.

“Our ability around dynamic traffic management and performance reliability gave those ad companies [an advantage].They were able to take a chance on us. If we have a bad day, a customer can’t operate. We had limited infrastructure. They placed a bet on us because of the [positive] impact we had on their business.”

Today the company is growing fast, has raised close to $50 million and has close to 100 employees. While the bulk of those folks are in NYC, they have also opened offices in San Francisco, Londonderry, NH, the UK and Singapore.

Beevers says the Dyn incident in many ways brought the industry closer together. While they compete, they still need to cooperate to keep the domain system up and running. “We compete and are comrades in the internet mess. We will all fall apart if we don’t work together,” he said. As it turned out, being part of the whole New York infrastructure community didn’t hurt either.

Every startup needs a little skill and a little luck. BigID, a NYC-based data governance solution has been blessed with both. The company, which helps customers identify sensitive data in big data stores, launched at just about the same time that the EU announced the GDPR data privacy regulations. Today, the company is having trouble keeping up with the business.

While you can’t discount that timing element, you have to have a product that actually solves a problem and BigID appears to meet that criteria. “This how the market is changing by having and demanding more technology-based controls over how data is being used,” company CEO and co-founder Dimitri Sirota told TechCrunch.

Sirota’s company enables customers to identify the most sensitive data from among vast stores of data. In fact, he says some customers have hundreds of millions of users, but their unique advantage is having built the solution more recently. That provides a modern architecture that can scale to meet these big data requirements, while identifying the data that requires your attention in a way that legacy systems just aren’t prepared to do.

“When we first started talking about this [in 2016] people didn’t grok it. They didn’t understand why you would need a privacy-centric approach. Even after 2016 when GDPR passed, most people didn’t see this. [Today] we are seeing a secular change. The assets they collect are valuable, but also incredibly toxic,” he said. It is the responsibility of the data owner to identify and protect the personal data under their purview under the GDPR rules, and that creates a data double-edged sword because you don’t want to be fined for failing to comply.

GDPR is a set of data privacy regulations that are set to take effect in the European Union at the end of May. Companies have to comply with these rules or could face stiff fines. The thing is GDPR could be just the beginning. The company is seeing similar data privacy regulations in Canada, Australia, China and Japan. Something akin go this could also be coming to the United States after Facebook CEO, Mark Zuckerberg appeared before Congress earlier this month. At the very least we could see state-level privacy laws in the US, Sirota said.

Sirota says there are challenges getting funded as a NYC startup because there hadn’t been a strong big enterprise ecosystem in place until recently, but that’s changing. “Starting an enterprise company in New York is challenging. Ed Sim from Boldstart [A New York City early stage VC firm that invests in enterprise startups] has helped educate through investment and partnerships. More challenging, but it’s reaching a new level now,” he said.

The company launched in 2016 and has raised $16.1 million to date. It scored the bulk of that in a $14 million round at the end of January. Just this week at the RSAC Sandbox competition at the RSA Conference in San Francisco, BigID was named the Most Innovative Startup in a big recognition of the work they are doing around GDPR.