Menlo Buys CDR Vendor Votiro to Protect Collaboration Tools

Menlo Security purchased a data and file security vendor led by a longtime IBM executive to more effectively secure cloud-based applications and collaboration tools.

See Also: 2024 CISO Insights: Navigating the Cybersecurity Maelstrom

The Silicon Valley-based enterprise browser company said Austin, Texas-based Votiro’s content disarm and reconstruction and data loss prevention capabilities will complement Menlo’s existing security tools by neutralizing threats in real time and facilitating AI-driven data protection without disrupting user workflows, according to President Bill Robbins.

“As we look at the Menlo vision, it started with web isolation and the secure enterprise browser,” Robbins told Information Security Media Group. “But we’ve been evolving to really think about workplace security. In the modern workspace, whether it’s Google Docs, whether it’s Microsoft 365, people are in the browser all the time. They’re using collaboration tools like Slack and Teams.”

Votiro, founded in 2010, employs 50 people and has raised $25.5 million of outside funding, having most recently closed an $11.5 million Series A funding round led by Harvest Lane Asset Management. The company has been led since August 2021 by Ravi Srinivasan, who previously spent more than 13 years at IBM, culminating in a stint overseeing information security strategy and product management (see: Securing the Enterprise Browser).

What Sets Votiro’s Approach to CDR, DLP Apart

Menlo aims to secure modern work environments by protecting user activity within browsers, across SaaS applications, and through cloud collaboration tools. Buying Votiro aligns with this strategy by enhancing data security and protecting against threats embedded in files and documents, Robbins said. He said traditional endpoint and network security solutions are insufficient to protect modern workflows (see: Menlo CEO Amir Ben-Efraim on Beating Highly Evasive Threats)

“Looking at how we could continue to extend our protection as we migrate more to workspace security has been something we’ve been on that journey for,” Robbins said.

Robbins said Menlo chose to acquire Votiro instead of continuing a partnership to gain full control over the technology, avoid dependency on an external company, and prevent a competitor from acquiring the firm. Developing a proprietary solution from scratch would have taken significant time and resources, and technical due diligence showed Votiro’s technology was well-constructed, making M&A appealing.

“We could have just continued to partner, but then you never know what’s going to happen,” he said. “You never know if they’re going to be acquired by somebody else. You don’t know if their roadmap’s going to align perfectly with yours. We could have built our own, but that certainly takes time. As we did our technical due diligence, we really liked the way the Votiro solution was constructed.”

Unlike traditional data loss prevention solutions that rely on cumbersome rules and policies, Robbins said Votiro’s approach to CDR and DLP enhances security without disrupting user workflows. Votiro’s CDR reduces threats in real time by dismantling and reconstructing files to remove malicious elements, while its DLP solution uses AI to automate and modernize data protection, eschewing rule-based measures.

“It really fits the whole concept of being able to provide security while not impacting a user’s workflow,” Robbins said. “Not just blocking files, but rather, if there’s malware in it, we’re able to basically split that file apart with Votiro, neutralize the threat, reconstruct the file and get it back to the user basically in real-time so that they’re not just going, ‘Hey, why was this file blocked and I have no access to it?'”

How Votiro’s Technology Will Address the Gen AI Gold Rush

The rise of AI tools has increased the risk of sensitive corporate data being unknowingly uploaded to public AI models, making data security and policy enforcement more critical than ever, Robbins said. Companies must monitor and regulate AI usage to prevent data leaks and compliance risks, and Robbins said Votiro’s AI-driven approach to DLP can help prevent sensitive PII and PHI from being misused.

“People are going out and using AI tools,” Robbins said. “They’re thinking, ‘Well, I can just upload this information and then I’ll pull it back.’ We know that’s not the case, right? Once it’s uploaded into a public AI tool, that information is gone forever. So, being able to actually block and monitor that in real time to protect PII and PHI is a very important use case for the DLP part of this acquisition.”

Modern work environments are cloud-first, Robbins said, meaning data is stored and accessed via SaaS applications rather than local devices. With employees using multiple platforms and moving data across them daily, Robbins said ensuring secure data flow across applications and preventing unauthorized access or exfiltration is the next frontier in enterprise security.

“The real threat is becoming much more around how the CISOs colleagues, the employees of their organization, are using the browser, how they’re using SaaS-based applications, how they’re accessing and moving data amongst those applications and application and collaboration tools,” Robbins said. “So, thinking about that is where we think most CISOs are going to go.”

Menlo will track customer satisfaction, revenue retention, cross-sell opportunities, and the impact on strategic partnerships with Google and Cisco to evaluate the success of the Votiro acquisition, Robbins said. Votiro is the first acquisition in Menlo’s 14-year history, and while the company’s primary focus is organic growth, Menlo remains open to additional deals that fits its workspace security vision, he said.

“As we digest this, we will always look for potential tuck-in technologies as long as they really support and differentiate our ability to secure the next-gen workspace,” Robbins said.