The 10 Hottest AI Security Companies You Need To Know

From identifying traits that numerous threats share to taking on well-camouflaged malware to telling organizations how to allocate security resources, here’s a look at what 10 hot AI security companies are doing.

A Double-Edged Sword

Artificial intelligence is a double-edged sword when it comes to cybersecurity, with defenders using it to respond to and predict threats and attackers using it to launch even more refined attacks. For example, AI algorithms can send ‘spear phishing’ tweets (personalized tweets sent to targeted users to trick them into sharing sensitive information) six times faster than a human and with twice the success.

The enlargement of attack surface and the increased sophistication of attacks has made AI a key weapon in thwarting cyberattacks, Capgemini found. Cyber analysts are finding it increasingly difficult to effectively monitor current levels of data volume, velocity, and variety across firewalls, prompting organizations to turn to artificial intelligence.

[RELATED: Artificial Intelligence Week 2021]

In fact, Capgemini found that 61 percent of organizations acknowledge they wouldn’t be able to identify critical threats without AI. The increases in cyberattacks that can quickly compromise critical operations within an enterprise also require enhanced capabilities that can best be provided through AI, according to Capgemini.

From identifying fundamental traits that numerous threats share to classifying and responding to well-camouflaged malware to advising how organizations should allocate security resources, here’s a look at how 10 AI security companies are making the world a safer place.

Awake Security

Awake Security combines artificial intelligence with human expertise to autonomously hunt for both insider and external attacker behaviors. The network detection and response (NDR) provider - which is now part of Arista - delivers triage, digital forensics and incident response capabilities across the campus, data center, Internet of Things, operational technology, and cloud networks.

Awake deeply analyzes billions of network communications to autonomously discover, profile and classify every device, user, and application across any network. Using a multi-dimensional ensemble machine learning approach, Awake then models complex adversarial behaviors and detects threats by connecting the dots across entities, time, protocols, and attack stages.

The company’s high fidelity threat hunting offering uncovers complex threats with low false positives and negatives, while Awake’s situational awareness tool discovers, profiles, and tracks devices, users and applications using AI-based fingerprinting. And Awake’s autonomous security technology automates triage, investigation, and response skills.

Balbix

Balbix’s BreachControl platform uses AI-powered observations and analysis to deliver continuous risk predictions, risk-based vulnerability management, and proactive control of breaches. The platform helps make cybersecurity teams more efficient and more effective at the many jobs they must do to maintain a strong security posture – everything from keeping systems patched to preventing ransomware.

BreachControl has a deep understanding of configuration and usage details for an organization’s extended enterprise inventory and can provide deep context around business criticality of each asset and user. Balbix intimately understands the various security products and processes organizations have deployed as part of their overall breach risk mitigation plan.

Balbix also offers prescriptive insights into how organizations might best configure and enhance their security controls and processes to improve their cyber-resilience without negatively impacting business operations. The company’s visualizations and reports explain calculations and recommendations and contain relevant info for users, security operations, CISO, auditors, CIO, CEO, and board members.

BlackBerry

BlackBerry Protect is an artificial intelligence-based endpoint protection platform that blocks breaches and provides added controls for safeguarding against sophisticated cyberthreats. The platform does this without user or admin intervention, a cloud connection, signatures, heuristics, or sandboxes required.

AI detects and prevents attacks before they can execute, preventing BlackBerry customers from opening URLs or visiting spoofing pages mimicking those of legitimate websites. BlackBerry’s resilient AI model prevents zero-day payloads from executing, while the company’s field-proven AI inspects any application attempting to execute on an endpoint before it executes.

BlackBerry Protect also leverages AI to automatically detect and stop malicious URLs, including those with embedded phishing elements. The company’s AI-driven security endpoint offering proactively delivers protection, detection, and response, integrated mobile threat defense, continuous authentication, and adaptive risk scoring, according to BlackBerry.

Blue Hexagon

Blue Hexagon’s deep learning models automatically analyze millions of traits within payloads, protocols, and headers to identify threats in less than a second. Using deep learning-based artificial intelligence, the company said its cloud security and network detection and response (NDR) technology enables detection of a wide variety of known and unknown file-based and protocol-based threats.

By applying deep learning to the complete inspection of headers and payloads, Blue Hexagon said it can identify cloud misconfigurations and defend cloud assets at runtime without the burden of deploying and managing agents. When applied to network traffic, Blue Hexagon can intelligently make decisions on whether traffic is malicious and enable response in quasi-real time.

The company’s technology can analyze cloud configurations, network traffic, cloud storage activity, and the entire threat kill chain in real time. Its agentless artificial intelligence works right out of the box, with no need for re-architecturing, baselining, signatures, or sandboxing. Blue Hexagon said its technology can thwart zero-day exploits, ransomware, lateral movements, C2, and exfiltration.

Darktrace

The Darktrace Immune System can identify in real time what’s truly dangerous or malicious across email and cloud services, industrial systems, and the corporate network. It allows security teams to move away from a multitude of siloed point products that offer limited visibility and toward a single AI ‘brain’ that benefits from enterprise-wide context and leaves attackers with nowhere to hide.

Darktrace’s Enterprise Immune System learns normal ‘patterns of life’ to discover unpredictable cyber-threats, while delivering complete visibility from cloud and collaboration tools to endpoints and the corporate network. And Cyber AI Analyst automatically stitches together disparate security events into a single security incident and communicates its findings in the form of a concise, digestible narrative.

Meanwhile, Antigena Network delivers autonomous protection of critical data and operations around the clock, interrupting attacks across cloud services, IoT and the corporate network with surgical precision. And Antigena Email uses Darktrace’s core artificial intelligence to stop the most advanced email threats, and works effectively everywhere from 10-person charities to multinational corporations.

Fortinet

Fortinet’s FortiAI is designed for short-staffed Security Operation Center (SOC) teams to defend against advanced persistent threats by identifying, classifying, and responding to malware including those well camouflaged. FortiAI harnesses deep learning technologies to assist organizations in an automated response to remediate different breeds of synthesized AI and non-AI-based threats.

FortiAI’s Virtual Security Analyst augments an organizations’ Security Operations (SecOps) by mimicking an experienced Security Analyst to investigate threats and surface malware outbreaks. Fortinet’s mature artificial intelligence can apply more than six million malware features to achieve sub-second verdicts and has the capability to learn new features.

The product’s on-premise learning reduces false positives by analyzing an organization’s specific traffic and adapting to newly disguised threats. FortiAI scientifically analyzes zero days including fileless threats and classifies them into more than 20 malware attack scenarios and works in tandem with FortiGate firewalls to automatically quarantine attacks.

IBM Security

Organizations can gain complete threat coverage, prioritize alerts, and speed up investigations using artificial intelligence with IBM Security’s QRadar Advisor. By examining the confidence level for each attack progression, analysts can validate the threat, visualize how the attack has occurred and is progressing, and uncover what tactics can still possibly occur.

IBM Security’s QRadar Advisor applies cognitive reasoning to identify the likely threat and connect threat entities related to the original incident such as malicious files, suspicious IP addresses, and rogue entities to draw relationships among these entities. The tool automatically taps into Watson for Cyber Security to apply external unstructured data including threat intelligence feeds, websites, and forums.

By analyzing the local environment, IBM’s QRadar Advisor recommends which new investigations should be escalated to assist the analyst with driving quicker and more decisive escalations. QRadar Advisor can identify investigations with the greatest risk, run multiple investigations at the same time, and sort and filter through the data to quickly understand where organizations should focus their attention.

Securiti

Securiti’s artificial intelligence-driven PrivacyOps platform enables privacy by design by continuously scanning and monitoring data against non-compliance as it relates to subject rights, data residency or security controls. Classification, risk monitoring and policy-based alerts and remediation offer end-to-end security while processing personal data, Securiti said.

The company’s technology can discover, classify, and label hundreds of sensitive data elements in multicloud and self-managed structured and unstructured data systems at petabyte scale. Securiti can search and visualize distribution of sensitive data elements in an organization’s structured and unstructured data systems and synchronize those with third-party data catalogs to populate metadata.

Securiti can additionally identify data risk hotspots in an organization’s environment with a clear breakdown of risk drivers such as specific data elements, data locations, and user residencies. The company monitors security posture associated with an organization’s cloud assets, enables policies that resolve security risks, and prioritizes and remediates risk in assets with specific sensitive data elements.

Sentry

Sentry is an artificial intelligence-powered video analytics solution for public safety and physical security. The company’s security-specialized neural network understands context to support security personnel more efficiently as they go about their daily work.

The company applies the latest artificial intelligence technology to develop specific algorithms for security use cases and offers advanced identity management through single sign-on and integration with Enterprise Mobility Management providers.

Sentry integrates seamlessly with existing security systems and delivers real-time alerts for critical events, eliminating the need for constant monitoring. The company offers actionable insights for businesses through custom reports and provides organizations with insights around Camera status and System Health analytics.

Vectra

Vectra uses artificial intelligence to improve detection and response over time, eliminating false positives so organizations can focus on real threats. The company’s automated threat detection and response platform blends human expertise with data science and machine learning techniques, delivering a continuous cycle of threat intelligence based on cutting-edge research and learning models.

The company can identify the fundamental traits that threats share, flag what is normal and abnormal in the local network and connect disparate events to reveal the larger attack narrative. Vectra begins by detecting and analyzing as many threats as possible to identify what they have in common, which requires a large-scale analysis of malicious traffic and the expertise to decide what truly matters.

Vectra’s local learning models look for indicators of important phases of an attack or attack techniques, such as that an attacker is exploring the network, evaluating hosts for attack, or using stolen credentials. The company’s model tracks events through the cyberattack kill chain, correlating them to specific hosts that show signs of threat behaviors and assimilating them into an up-to-the-moment risk score.