Darktrace Acquires Cado Security as AI Meets Cloud Forensics

Darktrace plans to purchase a cloud forensics and automation startup led by the former head of PwC’s incident response business to enhance the security of multi-cloud environments.

See Also: Risk-Based Authentication eBook: How Duo Can Reduce Risks for Hybrid Work

The Cambridge, England-based vendor said London-based Cado Security’s capabilities will complement Darktrace’s AI-driven analytics and behavioral detection expertise, according to Global Field CISO Max Heinemeyer. Bringing Cado’s forensic expertise and Darktrace’s AI and machine learning capabilities together will enhance the security of multi-cloud environments for companies in regulated industries.

“At Darktrace, we are extremely good, I would say, on the analytics side of the house, at using machine learning to analyze data, understand data, understand environments, and understand behaviors,” he said. “We can see that these two capabilities fit perfectly together. Cado’s great ability to get the data expertise and get the right access to the data, and our strength in the rest of the cloud products.”

Why Forensic Capabilities Are Critical in the Cloud

Cado Security was founded in 2020, employs 45 people, and has raised $31.5 million in three rounds of outside funding, having most recently completed a $20 million Series B funding round in March 2023 led by Eurazeo. The firm has been led since inception by James Campbell, who previously ran client-facing incident response for PwC and developed Australia’s cyber incident response and operations playbook (see: Cloud Is an Easy Conduit for Attackers).

Heinemeyer said Cado’s capability in accessing granular forensic data, such as disk-level access in cloud environments, and ability to normalize data from complex cloud setups offers a deeper understanding of incidents. This complements Darktrace’s self-learning AI, which Heinemeyer said can analyze vast quantities of data in real-time and identify patterns and anomalies to detect threats proactively.

“They’ve built something outstanding in the space of cloud forensics and automation, where they’ve made a name in their ability to gather data across complex, multi-cloud environments and get access to that data,” Heinemeyer told Information Security Media Group. “And they’ve done also detection and response in this space.”

The fragmentation of cloud security tools and the lack of deep forensic capabilities are major pain points for CISOs, with traditional tools often failing to provide the level of detailed data access required for effective investigations. By solving the intricate challenges of API integration, data normalization and cost efficiency across multi-cloud setups, Cato provides a foundation for deeper forensic investigations.

“It’s really about having optimized how to get the data, how to normalize it, how to consolidate it in such a way that it’s very cost efficient, very fast, very accessible and very useful in various other ways,” Heinemeyer said. “If I think about the synergies, it’s really about, ‘What can we do with their level of access and the pipelines they’re building out, integrating their detection mechanisms as well?'”

How Darktrace, Cado Security Will Come Together

Heinemeyer said Darktrace plans to incorporate Cado’s forensic capabilities into the company’s existing analytics tools, leverage Cado’s data pipelines for better access to multi-cloud data, and fuel automation for incident response to reduce the burden on cybersecurity teams. Together, the two companies can offer a solution that covers cybersecurity operations from detection to forensic analysis and response (see: Darktrace’s Nicole Eagan on How AI Predicts, Prevents Hacks).

“What we get with Cado now are more intricate ways of digging into forensic artifacts and getting access to a lot of very interesting raw data in the cloud,” Heinemeyer said. “That’s great for our analysts and the rest of Darktrace’s behavioral analytics to enhance investigations further. The more data we see, the better we can investigate, the better we can detect, and the faster we can respond.”

CISOs face challenges managing large numbers of disparate cybersecurity tools, and Heinemeyer said Darktrace aims to alleviate this burden by aligning with industry trends toward vendor consolidation and automation. By integrating Cado’s technology, he said Darktrace will enhance its ability to automate and consolidate cybersecurity processes, helping CISOs achieve greater efficiency and effectiveness.

“Success is when our CISOs say, ‘This brings me significant value,'” Heinemeyer said. “‘This helps me stop more cyberattacks. This makes my life easier. This helps me drive more value with my team. This augments my team.'”

This is just the second acquisition in Darktrace’s 13-year history, but Heinemeyer expects the company to embrace a more active stance on M&A with Thoma Bravo’s backing given the private equity firm’s commitment to accelerating R&D growth. Heinemeyer said Darktrace will prioritize companies with cutting-edge technology, innovative approaches, and a strong cultural fit when pursuing future M&A (see: Thoma Bravo to Buy Cybersecurity AI Firm Darktrace for $5.3B).

“We are definitely becoming more acquisitive, not because Thoma Bravo says we need to, but because they support us in our ambitions,” Heinemeyer said. “They’re a big partner in helping us achieve what we want to achieve.”