How Intel 471’s Buy of Cyborg Is Reshaping Threat Hunting

Intel 471 has purchased a threat hunting startup led by a Raytheon and Swimlane leader to help customers more effectively address complex cyberthreats.

See Also: Hunt Cloud Threats or Be Hunted | CISO Guide to Cloud Compromise Assessments

The Wilmington, Delaware-based threat intelligence vendor said its acquisition of Orlando-based Cyborg Security will bring threat hunting and threat intelligence together to beef up security posture and take proactive measures against adversaries, according to CEO Jason Passwaters. He said threat hunting emerged as a distinct discipline in late 2021, and Intel 471 and Cyborg have been collaborating since early 2022 see: Intel 471 Promotes Jason Passwaters to CEO to Land Prospects).

“The threat hunting use case is pretty universally relevant across the enterprise,” Passwaters said. “What it enables us to do is more easily get deeper into our addressable market. This gives them the ability to basically satisfy a key, if not the most significant, use case: Operationalize intel out of the box through threat hunting.”

A Fruitful Union Between Intelligence and Hunting

Passwaters said Cyborg’s focus on behavior-based threat hunting and tactics, techniques and procedures set the company apart from rivals since such an approach hadn’t been widely adopted by others at the time. Tracking and monitoring adversaries and the particulars of the attacks they carry out was unique at that juncture, he said.

Bringing threat intelligence and threat hunting together will allow the combined company to enhance its service offering and address a broader spectrum of the market, according to Passwaters. Specifically, he said, combining the two will allow organizations to adapt to evolving threats and integrate intelligence directly into their security practices.

Buying Cyborg will enhance Intel 471’s reach across different maturity levels in the threat intelligence market and address significant use cases right out of the box given Cyborg’s ability to address less mature markets with turnkey solutions. In the months ahead, Passwaters plans to align Cyborg’s team with Intel 471’s existing business processes and merge teams and systems between the two companies.

“Organizations and CISOs are seeking security leadership that sees the natural kind of synergies that exist between the two disciplines,” Passwaters said. “You have to track the threat as it evolves, and then your hunt has also evolved with that as well.”

How Intel 471 and Cyborg Will Become One

The acquisition of Cyborg will make the application of threat intelligence more efficient and dynamic for customers, with ongoing updates and maintenance of threat hunting packages, according to Passwaters. Intel 471 plans to leverage its existing sales and marketing capabilities to enhance Cyborg’s market position, and go-to-market plans are already in motion, Passwaters said.

Over the course of 2024, Passwaters wants to enhance threat intelligence sharing across both customer bases by integrating Cyborg’s team and threat hunting tools into the existing Intel 471 platform. Then in 2025, Intel 471 and Cyborg will consolidation their operations into a single platform, streamlining the investigation process and improving the efficiency of threat hunting practices for their clients, he said.

“What’s on the horizon for more mature teams is the ability to use our intelligence and then maintain and create their own threat hunt packs,” he said. “Instead of just relying on what we’re creating, they can create their own since their organization may have access to other streams of intelligence as well as internal data.”

Cyborg founder and CEO David Amsler will remain with Intel 471 as an adviser focused on integrating threat hunting into the broader threat intelligence platform. Amsler established Cyborg in August 2019, and was previously an original investor and board member at Swimlane and president of virtual security operations center provider Foreground Security, which was acquired by Raytheon in October 2015.

Passwaters said the company will closely monitor revenue growth following the Cyborg acquisition as well as the adoption rate of Cyborg’s technology among existing Intel 471 customers. The deal will fuel the evolution of threat hunting into a core business function that seamlessly integrates with broader threat intelligence activities, which he said are increasingly supported by internal threat intel teams.