Tenable Bolsters AI Controls With Apex Security Acquisition

Tenable plans to purchase an AI security startup led by an Israeli Military Intelligence veteran to help monitor and control AI usage within enterprises.

See Also: Boost your cybersecurity team capabilities with GenAI

The Baltimore-area exposure management vendor said its proposed acquisition of Tel Aviv, Israel-based Apex Security will bring deep visibility into user behavior and help address accidental and malicious misuse of AI. Chief Product Officer Eric Doerr said clients demand tools that detect AI usage and also implement enforceable guardrails and help mitigate risk.

“We started looking seriously at a number of different companies in the space,” Doerr told Information Security Media Group. “We got connected with a bunch of different companies, and talked to a number of them, got connected with Apex and thought that what they had was the magic combination of really deep insight into what people are doing with AI.”

Apex Security’s start dates back to March 2023, emerging from stealth in May 2024 with $7 million in seed funding from Sequoia Capital and Index Ventures. Apex currently employs 47 people. The company has been led since inception by Matan Derman, who previously spent nearly 15 years in Unit 8200 of the Israeli Military Intelligence, where he rose to be a Lieutenant Colonel and was head of the cyber division (see: Tenable’s $150M Vulcan Cyber Buy Boosts Exposure Management).

What’s Different About Apex’s Approach to AI Security

Doerr said Apex was one of several companies Tenable considered, but its granular understanding of AI usage patterns and its ability to detect nuanced behavior made the company stand out. Apex can detect a range of misuse scenarios and will advance in preventative controls like policy enforcement whether the misuse was accidental errors by employees or intentional exploitation by adversaries.

“The product that Apex has built, the tech that they’ve been innovating on is going super, super deep in those use cases around accidental misuse as well as deliberate attacks,” Doerr said. “Meeting both sides of that attack surface is absolutely essential. And then, on top of that, starting to build some preventative controls.”

Competitors like Protect AI – which Palo Alto Networks agreed to buy for $700 million – often focus on securing AI models or infrastructure, but Apex zeroes in on the user behavior layer, which Doerr said is a critical and often neglected dimension of risk. Apex can interpret whether actions carry accidental or malicious intent.

“Most of the CISOs we talked to say, ‘Look, you got to give me the tools to enforce policy and add guardrails,'” Doerr said. “‘It’s fine to detect if something bad is happening, but that can’t be 100 times a day.’ And so Apex has done a lot of that in a really good package.”

Accidental misuse typically stems from employees using AI tools like ChatGPT and inadvertently sharing sensitive or regulated data, Doerr said, while malicious actions might include prompt injection attacks, attempts to exfiltrate sensitive model data, or using AI systems to carry out intentional breaches. Having detection plus control is key in taking on both the human and technological elements of AI-related risks.

“Think of this as the classic IT user problem,” Doerr said. “ChatGPT gets turned on, great. What are they doing? Where are employees? Are they putting confidential data in there or not? And there’s some controls that get built in by the chat providers. But it’s not enough. It’s not what people need. So that’s what led us to it. And we thought that the Apex team was a terrific team they put together.”

How Tenable, Apex Will Come Together

Apex’s capabilities will be embedded into Tenable’s exposure management platform. “This will become a part of Tenable One,” Doerr said. “We will work to have the new integrated version of this available in the back half of the year. We’ll have more details on specific dates later. But this is something we’ll move pretty quickly on.”

Tenable launched a product in August to help organizations discover where and how AI is being used within their environments, but Doerr said AI Aware couldn’t enforce policies or apply controls. By combining AI Aware’s discovery capabilities with Apex’s enforcement features, Doerr said customers can now find shadow AI, assess its risk and take immediate action within a single platform.

“There’s a logical connection to say, ‘Now that you’ve discovered stuff, what controls do you want to put in place? How do you monitor what employees are actually doing there?'” Doerr said. “That’s a very natural kind of one plus one equals three that you can imagine.”

Doerr said Tenable will judge its progress with the Apex Security deal based on how effectively clients use the tool to manage and reduce AI-related risk within their environments. While AI is a critical new frontier, Doerr said it must be integrated into a broader risk posture that covers the entire enterprise. Therefore, he said success is about contributing to Tenable’s mission of end-to-end exposure reduction.

“As excited as I am about AI and what we can do to help customers there, at the end of the day, it’s about the whole risk and all the exposure mapped across your whole enterprise,” Doerr said. “That’s really the problem we’re solving toward.”