17 October, 2024
Citigroup's VC arm invests in API security startup Traceable
In 2019, Jyoti Bansal co-founded San Francisco-based security company Traceable alongside Sanjay Nagaraj. With Traceable, Bansal — who previously co-launched app performance management startup AppDynamics, acquired by Cisco in 2017 — sought to build a platform to protect customers’ APIs from cyberattacks.
Attacks on APIs — the sets of protocols that establish how platforms, apps and services communicate — are on the rise. API attacks affected nearly one-quarter of organizations every week in the first month of 2024, a 20% increase from the same period a year ago, according to cybersecurity firm Check Point.
API attacks take many forms, including attempting to make an API unavailable by overwhelming it with traffic, bypassing authentication methods, and exposing sensitive data transferred via a vendor’s APIs.
“There’s a lack of recognition of the criticality of API security,” Bansal told TechCrunch in an interview, “as well as ignorance of the ever-growing attack surface in APIs and a resistance to embrace API security due to entrenched investments in security solutions that don’t address the API security problem directly.”
To Bansal’s point, more and more businesses are tapping APIs in part thanks to the generative AI boom, but in the process are unwittingly exposing themselves to attacks. Per one recent study, the number of APIs used by companies increased by over 200% between July 2022 and July 2023. Gartner, meanwhile, predicts that more than 80% of enterprises will have used generative AI APIs or deployed generative AI-enabled apps by 2026.
Traceable tries to shield these APIs by applying AI to analyze usage data to learn normal API behavior and spot activity that deviates from the baseline. Traceable’s software, which runs on-premises or in a fully managed cloud, can discover and catalog existing and new APIs, including undocumented and “orphaned” (i.e., deprecated) APIs in real time, according to Bansal.
“In order to detect modern threat scenarios, Traceable trained in-house models by fine-tuning open source large language base models with labeled attack data,” Bansal explained. “Our platform provides tools for API discovery, testing, protection and threat hunting workflows for IT teams.”
The API security solutions market is quickly becoming crowded, with vendors such as Noname Security, 42Crunch, Vorlon, Salt Security, Cequence, Ghost Security, Pynt, Akamai, Escape and F5 all vying for customers. According to Research and Markets, the segment could grow at a compound annual growth rate of 31.5% from 2023 to 2030, buoyed by the increasing threats in cybersecurity and the demand for more secure APIs.
But Bansal claims that Traceable is holding its own, analyzing around 500 billion API calls a month for ~50 customers and projecting revenue to double this year. Most of Traceable’s clients are in the enterprise, but Bansal says the company’s investigating piloting with governments.
“Traceable is building a long-term sustainable company, which from a financial perspective means that we have a very healthy margin profile that continues to improve as our revenue grows,” he said. “We’re not profitable today by choice, as we’re investing into the business responsibly. … Our focus is on strategic investments maximizing return, not simply spending.”
To that end, Traceable today announced that it raised $30 million in a strategic investment from a group of backers that included Citi Ventures (Citigroup’s corporate venture arm), IVP, Geodesic Capital, Sorenson Capital and Unusual Ventures. Valuing Traceable at $500 million post-money and bringing its total raised to $110 million, the new cash will be put toward product development, scaling up Traceable’s platform and customer engineering teams and building out the company’s partnership program, Bansal said.
Traceable currently has ~180 staffers. Bansal expects headcount to reach 230 by year-end 2024, as the bulk of the new investment goes to hiring.
“Traceable wasn’t fundraising, as we still had substantial cash runway prior to this investment,” Bansal said, adding that Traceable secured a “sizable” line of credit in addition to the new funds, “but we received significant inbound demand from investors. With the combination of the strategic alignment with Citi Ventures and the attractive terms of the investment, we decided to take a smaller investment now to accelerate our product and go-to-market initiatives before thinking about a more substantial fundraise.”
Arm's gains are SoftBank's gains
Not so long ago, things were looking bleak for SoftBank, the investment holding company headed by eclectic — and controversial — tech mogul Masayoshi Son. The Vision Fund, SoftBank’s venture arm, posted a $6.2 billion loss in Q2 2023, tied to WeWork and other unfortunate bets.
But — thanks in no small part to chip design house Arm — SoftBank’s fortunes appear to be turning around. While consensus remains mixed on the Vision Fund’s long-term prospects, it’s on the upswing for now — and what an upswing it is.
SoftBank took Arm public in September and still owns about 930 million shares, or 90%, of the chip company’s stock. Arm had a blockbuster quarter, blowing past analysts’ expectations for both revenue and earnings. The company reported adjusted earnings per share of 29 cents, topping the average analyst estimate of 25 cents, according to LSEG (via CNBC), while the company’s revenue rose 14% to $824 million, beating the $761 million average estimate.
Arm projects revenue growth into the next quarter will be even stronger: 38%.
Investors rewarded Arm’s performance, driving the company’s stock price up as high as 57.4% on Wednesday. The chip company added about $38 billion to its market cap, more than $34 billion of which accrued to SoftBank. As CNBC pointed out, SoftBank made more in Arm’s trading than the total amount it lost on now-bankrupt WeWork ($14 billion).
The AI boom drove much of Arm’s recent business.
Arm, based in Cambridge, makes most of its money licensing the chips it designs to customers and charging royalties for each chip sold that uses its technologies. Arm’s bread-and-butter work remains mobile chips for devices like smartphones, tablets and smartwatches; 35% of overall units shipped this quarter were smartphone-bound, according to Arm finance chief Jason Child. But an increasing share of the billions of chips Arm’s customers produce each quarter is hardware designed to accelerate AI workloads.
Both Microsoft and Amazon, among others, are deploying custom-designed Arm chips to run AI models. So are countless startups in the expanding market for tailored AI chips.
While the bulk of Arm’s AI chip sales are indirect at present, often paired with GPUs in data centers, the company expects direct sales to increase as consumers buy new laptops and other devices with chip-accelerated AI features. In another boon for Arm, AI-supporting chips will command higher royalty revenues. Arm charges roughly double the royalty rate for its latest processor architecture (v9) versus the previous generation.
All this is music to SoftBank’s ears, I’d guess — particularly at a time when tempestuous U.S.-China relations have put a damper on the holding company’s investments in key Asian economies.
Buoyed by Arm, SoftBank’s Vision Fund this afternoon posted its first quarterly profit after four straight losses and its biggest gain in nearly three years: $4 billion. U.S. shares in SoftBank were up 17% following the company’s earnings report, largely on news of Arm’s cheery quarter.
The question now is what SoftBank, which is currently restricted from selling Arm shares as part of its agreement to take the company public, does in March, when it’s permitted to begin selling Arm shares again. SoftBank could fuel a buyback of its own shares by selling Arm stock — or decide to sit on that stock instead.
It’ll depend, one imagines, on whether the current enthusiasm for AI maintains.
Arm after the IPO
SoftBank expects $24 billion in losses from Vision Fund, WeWork and OneWeb investments
Citigroup's VC arm invests in API security startup Traceable
In 2019, Jyoti Bansal co-founded San Francisco-based security company Traceable alongside Sanjay Nagaraj. With Traceable, Bansal — who previously co-launched app performance management startup AppDynamics, acquired by Cisco in 2017 — sought to build a platform to protect customers’ APIs from cyberattacks.
Attacks on APIs — the sets of protocols that establish how platforms, apps and services communicate — are on the rise. API attacks affected nearly one-quarter of organizations every week in the first month of 2024, a 20% increase from the same period a year ago, according to cybersecurity firm Check Point.
API attacks take many forms, including attempting to make an API unavailable by overwhelming it with traffic, bypassing authentication methods, and exposing sensitive data transferred via a vendor’s APIs.
“There’s a lack of recognition of the criticality of API security,” Bansal told TechCrunch in an interview, “as well as ignorance of the ever-growing attack surface in APIs and a resistance to embrace API security due to entrenched investments in security solutions that don’t address the API security problem directly.”
To Bansal’s point, more and more businesses are tapping APIs in part thanks to the generative AI boom, but in the process are unwittingly exposing themselves to attacks. Per one recent study, the number of APIs used by companies increased by over 200% between July 2022 and July 2023. Gartner, meanwhile, predicts that more than 80% of enterprises will have used generative AI APIs or deployed generative AI-enabled apps by 2026.
Traceable tries to shield these APIs by applying AI to analyze usage data to learn normal API behavior and spot activity that deviates from the baseline. Traceable’s software, which runs on-premises or in a fully managed cloud, can discover and catalog existing and new APIs, including undocumented and “orphaned” (i.e., deprecated) APIs in real time, according to Bansal.
“In order to detect modern threat scenarios, Traceable trained in-house models by fine-tuning open source large language base models with labeled attack data,” Bansal explained. “Our platform provides tools for API discovery, testing, protection and threat hunting workflows for IT teams.”
The API security solutions market is quickly becoming crowded, with vendors such as Noname Security, 42Crunch, Vorlon, Salt Security, Cequence, Ghost Security, Pynt, Akamai, Escape and F5 all vying for customers. According to Research and Markets, the segment could grow at a compound annual growth rate of 31.5% from 2023 to 2030, buoyed by the increasing threats in cybersecurity and the demand for more secure APIs.
But Bansal claims that Traceable is holding its own, analyzing around 500 billion API calls a month for ~50 customers and projecting revenue to double this year. Most of Traceable’s clients are in the enterprise, but Bansal says the company’s investigating piloting with governments.
“Traceable is building a long-term sustainable company, which from a financial perspective means that we have a very healthy margin profile that continues to improve as our revenue grows,” he said. “We’re not profitable today by choice, as we’re investing into the business responsibly. … Our focus is on strategic investments maximizing return, not simply spending.”
To that end, Traceable today announced that it raised $30 million in a strategic investment from a group of backers that included Citi Ventures (Citigroup’s corporate venture arm), IVP, Geodesic Capital, Sorenson Capital and Unusual Ventures. Valuing Traceable at $500 million post-money and bringing its total raised to $110 million, the new cash will be put toward product development, scaling up Traceable’s platform and customer engineering teams and building out the company’s partnership program, Bansal said.
Traceable currently has ~180 staffers. Bansal expects headcount to reach 230 by year-end 2024, as the bulk of the new investment goes to hiring.
“Traceable wasn’t fundraising, as we still had substantial cash runway prior to this investment,” Bansal said, adding that Traceable secured a “sizable” line of credit in addition to the new funds, “but we received significant inbound demand from investors. With the combination of the strategic alignment with Citi Ventures and the attractive terms of the investment, we decided to take a smaller investment now to accelerate our product and go-to-market initiatives before thinking about a more substantial fundraise.”