Infoblox Buys Axur to Expand Cyberthreat Takedown Power

Infoblox plans to buy a Brazilian digital risk protection services firm to automate digital threat detection and takedown processes using artificial intelligence.

See Also: Cloud Security and the Evolving Role of the Firewall

The Silicon Valley-based multi-cloud networking and security firm said its proposed acquisition of Porto Alegre, Brazil-based Axur will help with detecting and removing malicious infrastructure such as phishing sites or impersonating social media accounts before they are weaponized, said President and CEO Scott Harrell. The acquisition means enhanced efficacy and faster response times in combating cyberthreats.

“What really piqued our interest about Axur was that they were using AI in innovative ways to get increasingly preemptive in their ability to be able to take these kind of actions, detect and then respond to these kind of actions before the hacker’s infrastructure could be weaponized against the enterprise or their consumers,” Harrell told Information Security Media Group. “That was really interesting for us.”

Axur, founded in 1999, employs 225 people and hasn’t disclosed how much outside funding it raised. The company has been led since 2012 by Fabio Ramos, who will report to Infoblox Chief Product Officer Mukesh Gupta and be responsible for driving the future of cyberthreat exposure management (see: Why AI-Powered Cyberattacks Demand Preemptive Defense).

How AI Advances Complicate Infrastructure Defense

Security threats driven by AI are evolving so quickly that the human ability to detect impersonation, phishing and rogue infrastructure has become severely limited, Harrell said. This means the burden must shift toward automated detection and takedown systems that can neutralize threats before they’re activated, Harrell said.

“The old adage of security – where the end user is the last line of defense – is just not going to work anymore just because the stuff’s so sophisticated,” Harrell said. “You need tools like Axur to preemptively take that stuff down.”

Threat actors are using AI to create sophisticated phishing sites, impersonations and domain spoofs that are visually and contextually indistinguishable from legitimate ones, Harrell said. The acquisition of Axur enables Infoblox to preemptively strike at such threats not just by blocking access, but by removing the infrastructure itself.

“We strongly believe the world is going to need to move from a reactive to preemptive model from a security posture and construct point of view,” Harrell said. “It’s now stripped the ability of a normal human to judge, ‘Is this authentic or not?'”

Axur has been aggressively using AI for several years, automating processes like the detection of phishing pages, the compilation of evidence for takedowns and the submission of those requests to registries, Harrell said. The company can detect phishing pages in less than four minutes, achieve a 99% success rate in removing malicious content and complete takedowns in around nine hours, he said.

“They’re actually aggressively using AI for years, and what it allows them to do is to automate a lot of what today for other DRPS companies is manual processes,” Harrell said. “Whether its takedown services, the transparency they need to give to enterprises, it allows them to perform what’s largely been a manual process in many cases as an automated process at scale.”

How Infoblox, Axur Will Come Together

With its foundation in DNS security, Infoblox offers the capability to detect and disrupt threats at the point of access within the enterprise network, Harrell said. In contrast, Axur focuses on identifying and taking down malicious infrastructure hosted outside the corporate perimeter such as phishing sites or fraudulent social media accounts impersonating legitimate brands.

“When you combine these, basically what you’re getting is a smarter, faster, more preemptive solution that can more proactively stop attacks at scale,” Harrell said. “The two technologies are complementary, but also the two threat intels are complementary. The net is just that it’s going to create synergies for both solutions and make both better.”

If Infoblox detects traffic to a suspicious domain, Axur can then investigate and determine whether that domain is linked to phishing, impersonation, or data theft and proceed to remove it, Harrell said. This end-to-end process from detection to assessment to takedown is faster and more effective when both technologies work together, he said.

“As we spot these malicious domains, Axur can become part of the reactionary force that can take those down,” Harrell said. “If I detect the potential of a breach and I want to take it down as fast as possible and I want to understand if I’ve actually lost data, Axur helps us complete that workflow. The two companies coming together has a lot of synergy from a solution and use case point of view.”

Latin America is already a material market for Infoblox, and Harrell said Axur’s position offers localized threat intelligence and customer access that would have taken Infoblox significant time and investment to build on its own. Infoblox has ambitions to grow its footprint in the MSSP channel, and Harrell said Axur’s strong foothold gives the company a platform to accelerate this.

“It wasn’t something that we set out and said, ‘Let’s go buy a company focused on Latin America,'” Harrell said. “But we definitely viewed it as a positive. They give us a unique perspective, especially given the size and scope of some of the economies in Latin America.”