Startups Build OC Into Front in Cybersecurity War

Early this year, Glenn Chisholm was contemplating leaving the chief technology officer role at security software maker Cylance Inc. in Irvine.

In Chicago, fellow security expert Ben Johnson, co-founder and CTO at Carbon Black, was having similar thoughts at his company.

The duo had been acquaintances for years in the tightknit security segment and had even explored ways to integrate product offerings for a time.

A mutual friend floated the idea of launching a startup. Both were warm to the idea, particularly Johnson, who was itching to leave behind Chicago’s frigid winters for a warmer climate.

Enter Matt Wolff, who left the chief data scientist role at Cylance in May in hopes of finding a better fit elsewhere. Wolff and Johnson had crossed paths earlier in their careers at the National Security Agency.

Within a few weeks, the trio established Obsidian Security at Newport Center, the latest entrant in Orange County’s emerging cybersecurity hub.

“It really fell into place,” Johnson said. “We’ve got a great foundation to build a company and product here.”

The software maker is developing a product suite that fuses security, artificial intelligence and hybrid-cloud technology.

Several other emerging and established players in the industry were already based here, particularly in Irvine, home to Cylance, CrowdStrike Inc., SecureAuth Corp. and Susteen Inc.

Building Blocks

Obsidian’s startup story illustrates how some clusters form around certain segments or emerging technologies.

Orange County is no stranger to the industry concentrations. Former engineers at Irvine-based video game publisher Blizzard Entertainment Inc. have spawned several gaming spinoffs, including Frostkeep Studios and Bonfire Studios Inc., both in Irvine.

Chipmaker Broadcom, which was acquired last year for $37 billion by Avago Technologies Inc. and renamed Broadcom Ltd., is another example. Former Broadcom engineering head Mohammad Tabatabai and private equity veteran Michael Hsu in 2014 launched Irvine startup Peri Inc., which has high hopes for its second-generation iPhone charger and speaker case as it works to expand accessory offerings and attract its first institutional investment round.

Nariman Yousefi, who helped establish Broadcom’s networking group, established ClariPhy Communications Inc. in 2002 in Irvine. The chipmaker was acquired in late 2015 for $277 million, plus debt, by Santa Clara-based Inphi Corp.

OC is also known for eye-related companies. The $72.5 billion sale about three years ago of Irvine-based Allergan, a granddaddy in the field, to Actavis PLC in Ireland, fueled an exodus of long-tenured employees who pursued new ventures.

Fred Ouyang, an Allergan scientist for about nine years, co-founded San Diego-based Alan Laboratories in March 2014 with business partners Yong Qiu and Min Xia.

Irvine-based WBR Laboratories Inc., which provides biological research products, was co-founded by Alex Lu, who worked as a scientist at Allergan for 12 years.

Fauad Hasan, former Allergan director of biologics manufacturing and development, co-founded drug company Bonti in Newport Beach (see story, page 7).

Scott Whitcup started two companies in 2015: Akrivista and Whitecap Biosciences, both based in Mission Viejo. Other Akrivista co-founders are Michael Garst, a former senior vice president at Allergan in chemical sciences, and Orest Olejnik, former senior vice president of Allergan’s Global Pharmaceutical Sciences division.

Whitcup was head of Allergan’s Ophthalmology Therapeutic Area for four years, followed by an 11-year stint as executive vice president of research and development. 

Obsidian is off to a good start, raising $9.5 million in a Series A funding round led by Silicon Valley venture capitalist Greylock Partners, which took two board seats as part of the transaction.

The founders said they were attracted to OC’s talent pool, beach lifestyle and close proximity to universities, airports and Silicon Valley.

“We’ll be focusing much more on hiring over the next four or five months,” Chisholm said.

Threats Fuel Growth

Cybersecurity is one of the hottest sectors in technology as high-profile breaches and hackings continue to plague corporations and governments around the world. Recent incidents include about 1.5 terabytes of data stolen from HBO’s corporate network being held for ransom; as many as 14 million Verizon customer records found on an unprotected Amazon server; and a portion of about 1.9 million Bell Canada customer records leaked online that had been stolen from the country’s largest telecom (see data analysis, page 16).

Researchers at Richmond, Va.-based Risk Based Security tracked 4,149 data breaches last year that compromised more than 4.2 billion records, more than four times the record set in 2013.

The incidents, which bring bad publicity and big bills from cleaning up the mess, are creating more corporate demand for expert help, fueling the creation of new companies and growth of existing ones.

CrowdStrike raised $100 million in May in its latest funding round, the second time the security software maker has hit the benchmark. Established in 2011 by former executives of McAfee Inc. and Networks in Motion Inc., it has raised $248 million, and its valuation eclipses $1 billion, the company said.

Proceeds from the latest round will fund global expansion and help meet demand for its CrowdStrike Falcon product for endpoint protection.

The software maker’s revenue has zoomed well past $50 million from hundreds of government agencies and Fortune 500 customers that pay a monthly subscription for cloud-based software services.

SecureAuth’s subscription software, which verifies the identity of employees allowed access to physical and virtual networks, and links users to particular devices on the network, has received strong demand from the law enforcement and medical sectors.

Susteen, which is involved in some of the country’s top forensic investigations, is testing a robotic arm to unlock the most common types of mobile phones used in crimes. The company contends it can break into any throwaway phone with a four-digit password in 17 hours and can unlock a six-digit pin in a few days. 

CrowdStrike and Cylance, which hit the $100 million funding benchmark last year, are among the most watched technology companies in OC. The Business Journal last month reported that Cylance is entering the consumer market after building a strong base of enterprise customers that helped it pass $81 million in revenue in the 12 months through June 2016, up a whopping 1,996% from two years earlier.

The leap won it the top spot among midsized companies—those between $10 million and $100 million in annual sales—on the Business Journal’s fastest-growing private companies list last year.

Forbes recently ranked Cylance No. 17 among the top 100 cloud companies in the U.S. based on sales growth and market share.

It’s raised $177 million since its 2012 inception.

Other New Players

Obsidian isn’t the only startup in the security segment with room to run.

Veracity Industrial Networks has raised about $2.5 million since its 2014 inception. Chief backers include Hollencrest Capital Management in Newport Beach and chipmaker Microsemi Corp., which houses the company at its Aliso Viejo headquarters.

“Cybersecurity is becoming more and more important throughout our industrial networks,” Steven Litchfield, chief strategy officer at Microsemi, said in an email. “Critical infrastructure is at risk around the world and Veracity has the solutions to provide safe, secure and resilient operations of these critical control systems. This technology is very complementary to many of our own solutions that are addressing security needs in infrastructure today.”

Veracity is in a pilot program with switch maker Schweitzer Engineering Laboratories to supply the Washington state manufacturer with a turn-key software platform that secures devices at a network in a day or two rather than replacing and upgrading them throughout the network end point, which can take 18 months.

“We’ve started to solve the problem of security for industrial networks,” said Chief Executive Paul Myer. “And the advantage is all we have to do is upgrade switch infrastructure.”

The message appears to be resonating.

Veracity is in line for nearly half of a

$4 million project awarded to Schweitzer by the U.S. Department of Energy for its Chess Master project to secure industrial control systems. Partners Ameren Corp. and Sempra Energy are providing test cases for a commercial product.

The project is designed to research, develop, test, and commercialize security validations. It’s an extension of the Watchdog project, which focused on using industrial software-designed networks for cybersecurity.

The networks essentially centralize setup, configuration and control of a network, providing an opportunity for Veracity to repurpose switch infrastructure to optimize, secure and manage every device and communication on the network, thereby significantly improving reliability and resiliency of the infrastructure, according to Myer.  

Software-designed networks will revolutionize industrial control systems, he said, “making them configurable, agile and secure.”

The overarching mission is to leverage those types of networks to secure the U.S. electric power grid.

Veracity estimates it will finish its part of the project in about a year. Plans are to soon target transportation, manufacturing and petrochemical customers.

The company employs 12 and has a development office in Atlanta. It’s looking to secure a Series A funding round of about $8 million, Myer said.

“We are focusing on the switch customer in the power space in the near term, but we are being opportunistic.”