Safe Security, which provides a platform to measure cyber risk, today announced that it raised $33 million in a strategic investment from BT Group, the U.K.-based telecom provider. As a part of the investment, BT will be granted the exclusive rights to use and sell Safe Security products to organizations in the U.K. as it incorporates the platform into its wider portfolio. BT will also work with Safe Security to develop new products and with Safe’s customers to improve their cybersecurity postures, according to Safe Security CEO Saket Modi.

With the frequency of large-scale data breaches increasing — from 662 in 2010 to over 1,000 by 2020 — businesses are looking for ways to assess how vulnerable they might be. The cost of cyber crime is estimated to have reached just under $1 trillion in 2020 as criminals exploited the pandemic to target enterprises.

Safe Security, which is headquartered in Palo Alto, California, seeks to leverage AI to help organizations mitigate cyber risk in real time. It uses a scoring model that was built as a joint research project at MIT — one that runs cybersecurity sensor, external threat intelligence, and business data through an AI-powered engine to generate scores and the dollar value risk that an organization faces. The scores are calculated both at a macro and micro level and can be measured for particular lines of business as well as departments, Modi says.

“Safe Security was incubated from IIT Bombay in 2012 as a cybersecurity services company with my two other cofounders, Rahul Tyagi and Vidit Baxi,” Modi told VentureBeat via email. “We offered various cybersecurity services such as red teaming, vulnerability assessment, penetration testing and boardroom training and more to Fortune 500 companies [and governments] globally … In early 2020, we launched our cybersecurity & digital business risk quantification platform, Safe, and pioneered a new category of products in cybersecurity [that] brings a unique way to proactively manage, measure, and mitigate cyber risks. This enables security and risk management leaders to not only make cybersecurity an informed business decision, but also help them communicate more effectively with all stakeholders.”

Calculating risk

Modi asserts that while cyberattacks have evolved over the years, cybersecurity remains an opaque concept for most senior business leaders. Organizations often invest in products such as endpoint detection and response, antivirus, firewalls, and more without knowing the “before and after” impact of their breach likelihood, he says.

“Security and risk management leaders continue to evaluate cybersecurity through jargonized subjective measures and keep adding cybersecurity products to reactively respond to cyberattacks, rather than proactively defend them,” Modi said. “By contrast, the Safe platform provides a current and historic assessment of multiple threat vectors, including people, processes, technologies, and third parties — which is then quantified with a ‘breach likelihood score’ between 0 and 5 … The scoring algorithm is trained on data from cyber insurance claims and hack analyses from its research and analytics team, in collaboration with MIT and IIT Bombay.”

Safe has rivals in startups including VisibleRisk and Exabeam, as well as Viso Trust, SecurityScorecard, and RiskLens. But Modi says that the company’s revenue grew by 270% in the last year and is expected to grow “sixfold” over the next 12 months, fueled by clients investing in digital business risk quantification, third-party risk management, and insider threat analysis.

“The pandemic has significantly accelerated digitization across businesses globally and as organizations transform to a digitally native setup, cybersecurity becomes the number one priority,” Modi continued. “[For example, a] Fortune 50 fast-moving consumer goods company uses our platform to manage its third-party risks across suppliers and distributors where they combine the insights of questionnaire-based assessments with outside-in assessments and inside-out assessments to get a unified, real-time risk posture for all critical third parties in their environment. A Fortune 250 bank uses our platform to get a real-time cyber risk posture of its critical business units that contribute the most to its revenue. [And] one of the top five health care providers in the U.S. uses our platform to integrate all signals in regards to its insider threats such as phishing campaigns, device security, cybersecurity awareness campaigns, deep and dark web exposures, email gateway security and more to get a unified, real-time view of the breach likelihood of its 15,000 employees.”

Modi says that the proceeds from the funding round will be used to grow Safe’s U.S. revenue and triple the company’s spend on R&D. Beyond this, Safe plans to double its engineering team to over 200 people and grow its total headcount to over 300 by the end of 2021.