Proposed Acquisition Aims to Merge Internal Risk Data With External Threat Signals
Dataminr plans to buy an intelligence management vendor led by the former head of Symantec’s enterprise security business to deliver client-tailored intelligence through agentic artificial intelligence.
See Also: The Rise of Agentic Commerce: Building Secure, Trusted Payments for the AI-Driven Economy
The New York-based threat and risk intelligence firm said its proposed $290 million buy of Washington D.C.-area ThreatConnect will provide contextual, predictive and actionable intelligence that is uniquely tailored to clients’ internal environments, said founder and CEO Ted Bailey. The deal combines Dataminr’s strength in public data signal detection with ThreatConnect’s expertise in internal data landscapes.
“When the two products coexisted, we found a number of customers saying the opportunity for building new products off of this integration would be truly game-changing,” Bailey told Information Security Media Group. “And we started a serious discussion about not just a strategic partnership, but rather becoming one.”
ThreatConnect, founded in 2011, employs 170 people and has been owned since June 2019 by growth equity firm PSG. The company has been led since March 2022 by Balaji Yelamanchili, who led Symantec’s enterprise security business unit for three-and-a-half years, oversaw Oracle’s business analytics and big data practice for four-and-a-half years, and spent seven years at storage titan EMC (see: Dataminr Raises $85M to Advance Predictive, Agentic AI Tools).
From Generic Event Detection to Context-Aware Briefings
Several CISOs who were using Dataminr for cyber risk detection through its Pulse platform began requesting integration with ThreatConnect, and the connection helped customers address long-standing gaps in their cyber risk management workflows. Dataminr recognized the potential wasn’t just for a joint product, but for fusing external and internal signals into a new solution with contextual awareness.
“In the last few months, we had already built and deployed an integration of Dataminr into ThreatConnect that was up and running, and some customers had started to reap the benefit of and derive significant value from it,” Bailey said. “What we realized was that that value was extremely significant.”
Buying ThreatConnect will help Dataminr move from generic event detection to personalized, context-aware briefings and recommendations that reflect the specific needs and environment of each client, Bailey said. AI agents independently gather insights, analyze data and then synthesize their findings into a unified intelligence output, tailored to the client’s internal systems, priorities and structure, he said.
“That is a surface area that can be, instead of general to the event, be written out, customized and adapted to the particular customer,” Bailey said. “Our AI platform can integrate all of that internal data and our agents can access those environments such that what the customer sees from Dataminr’s perspective is written for them, taking those things into consideration.”
Bailey said Dataminr’s roots are in news, social media, sensors and open source, where it built one of the most powerful event detection platforms in the world. But it didn’t have embedded expertise in the internal architectures of enterprise environments, which is an area where ThreatConnect excels. Bailey views the combination of these skillsets as essential for accelerating Dataminr’s road map.
“I see the Dataminr plus ThreatConnect unification as not just a product unification, but very much about their team, a team that is very mission-oriented and really passionate about innovation,” Bailey said. “Integrating the product and the new DNA of ThreatConnect in terms of knowledge of that internal data landscape is as big of a win for Dataminr.”
Why Dataminr Deploys Multiple AI Agents in Parallel
Public data environments where Dataminr excels are vast and diverse, and Bailey said the key challenge in this space is finding the rare but critical signal hidden in large volumes of noise. Conversely, internal data environments where ThreatConnect excels are more structured and specific, and the challenge is understanding which internal events are significant and how they relate to one another, he said.
“When you’re dealing with an internal data landscape, a lot of the challenge is more about prioritization and synchronization,” Bailey said. “When you talk about the two together and why they’re so valuable, when you discover one of these very small patterns out in the physical digital landscape and bring it into the internal data landscape, you can really have a nirvana data correlation moment.”
In Dataminr’s architecture, multiple AI agents are deployed in parallel, with some looking for relevant context and others looking for risk implications, while still even more seek the next-best actions or response recommendations. This enables Dataminr to go beyond merely stating “what happened” to articulating what it means, what the customer should do and eventually, “How can we help you respond?” he said.
“The thing that is fundamentally unique about agents is they are goal-oriented, not task-oriented,” Bailey said. “So, you can say to an agent, ‘Go find the most relevant context.’ Or you can ask an agent, ‘What should the customer do next in these particular aspects?’ and then the fleet of agents go out and about on their semi-autonomous journey to try to figure that all out.”
The combined Dataminr-ThreatConnect platform is uniquely suited to serve this expanded CISO role, with the former providing real-time alerts across physical and digital domains, while the latter offers deep internal threat intelligence management, he said. Together, they offer a unified, multi-vector risk intelligence system that helps CISOs operate with a holistic view of threats across the enterprise.
“Many of the leading CISOs are now also being charged with overseeing physical threats, digital threats, as well as more classic cyberthreats,” Bailey said. “The two products together are a way for the CISO to unify the different threat vectors in a way that allows them to expand their remit and take on more of a broader risk intelligence landscape.”