Microsoft Buys Privileged Access Startup CloudKnox Security

Purchasing CloudKnox Security will give Microsoft Azure Active Directory customers granular visibility, continuous monitoring and automated remediation for hybrid and multi-cloud permissions.

Microsoft has purchased CloudKnox Security to give organizations visibility into privileged access, right-size permissions and consistently enforce least-privilege principles with the aim of reducing risk.

The Redmond, Wash.-based software giant said its acquisition of Sunnyvale, Calif.-based Cloud Infrastructure Entitlement Management (CIEM) provider CloudKnox Security will give Microsoft Azure Active Directory customers granular visibility, continuous monitoring and automated remediation for hybrid and multi-cloud permissions, said Joy Chik, corporate vice president of Microsoft Identity.

“As the corporate network perimeter disappears, it’s crucial to establish a strong cloud identity foundation, so you can enforce least privileged access to protect business-critical systems while improving business agility,” Chik wrote in a blog post Wednesday. “We’re committed to making it easier to enforce least privileged access for all user and workload identities.”

[Related: Microsoft To Acquire RiskIQ In Zero Trust Security Push]

Microsoft’s stock is up $0.78 (0.28 percent) to $280.10 per share in midday trading. Terms of the deal weren’t disclosed, and Microsoft didn’t immediately respond to a request for additional comment.

CloudKnox was founded in 2016, employs 58 people, and has raised $22.8 million in four rounds of outside funding, according to LinkedIn and Crunchbase. The company most recently closed a $12 million Series A funding round led by Sorsenson Ventures in January 2020.

“We saw opportunities to provide even greater value and seamless experience across hybrid and multi-clouds with deeper integrations within the Microsoft ecosystem,” CloudKnox Founder and CEO Balaji Parimi said. “By joining Microsoft, we can unlock new synergies and make it easier for our mutual customers to protect their multi-cloud and hybrid environments and strengthen their security posture.”

The growth of virtual machines and container accounts that exchange data without human interaction exposes organizations to new attack vectors given the level of permissions, privileges, and entitlements they have access to, Chik said. These permissions leave business critical systems open to infiltration and disruption, with hackers moving laterally by exploiting misappropriated privileged credentials, she said.

While organizations are reaping the benefits of cloud adoption, Chik said they’re still struggling to assess, prevent, enforce, and govern privileged access across hybrid and multi-cloud environments. Traditional privileged access management and identity governance and administration tools are well-suited for on-premises environments but don’t provide the visibility needed for multi-cloud, she said.

Moving forward with CloudKnox, Chik said Microsoft wants to provide customers with automated and simplified access policy enforcement in one integrated multi-cloud platform for all human and workload identities. Microsoft is also looking to deliver the widest breathe of signal-enabling, machine learning-based anomaly detection, as well as seamless integration with other Microsoft cloud security services.

“With the significant acceleration of cloud adoption, CloudKnox has seen a 7x growth of identities accessing cloud services over the past year alone,” said Raman Khanna, managing director of CloudKnox investor Dell Technologies Capital. “Those identities have access to more than 20,000 high-risk permissions, helping crystallize how truly significant this risk vector is for organizations.”

This is the second high-profile acquisition of a CIEM company this year, with Microsoft cloud competitor Zscaler buying Trustdome for $31.1 million in April to help customers control who and what has access to data, applications, and services in public cloud environments. Other cloud security stalwarts like Rapid7 have offered CIEM for several years to help customers better manage risk in cloud environments.

CloudKnox is Microsoft’s third security acquisition since the start of June, with the company scooping up attack surface management firm RiskIQ just last week for a reported $500 million to help customers understand their security posture. And in June, Microsoft bought IoT security firm ReFirm Labs to help device builders and clients discover, protect, and assess device risk at the firmware and network levels.