Zest Security emerged from stealth with $5 million funding from Hanaco and Silvertech Ventures, and an AI-powered platform that resolves the root source of risk, rather than simply mitigating the visible symptoms, within complex cloud environments.
According to Snir Ben Shimol, co-founder and CEO at Zest Security, the problem is no longer one of visibility into the cloud. Visibility now exists, and we can find the vulnerabilities and risks (which are usually related to some form of misconfiguration). The problem is the length of time it takes to fix the risks.
Remediating these risks is a lengthy manual process of back and forth between DevOps and security teams. On average, says Zest, it takes 30-60 days to remediate a single cloud security risk, and 80% of resolved risks only resurface shortly after remediation.
Zest’s AI-powered platform is designed to simplify and automate risk resolution at speed and scale. The first requirement is to rapidly mitigate the risk. “The cloud environment is rich with ready-made security services and controls,” said Ben Shimol. “When we see a risk, we use those services and put them layer over layer over layer around that specific risk.”
This is rapid mitigation rather than full remediation. “Using the existing cloud controls, we mask and reduce the risk, so that a critical risk that would normally take a long time to remediate immediately becomes very difficult for a threat actor to exploit,” he continued. This has no effect on the legitimate operation of the protected area.
Full remediation is still often necessary for many if not all such mitigated risks. Here Zest helps by providing the triaging – locating the root cause of the risk. It may be this root cause triggers multiple other different risks that may not obviously be related. “Pinpoint the origin of the problem all the way left to the associated asset and originating lines of code to enable security and DevOps to take down more issues with minimal changes,” says Zest.
Full remediation, now that the risk has been mitigated, is tackled differently. The most pressing risks, that is, the most impactful, are now known and mitigated, but the remediation process is still mostly manual and time-consuming. The Zest platform uses AI to build a resolution path for the pre-triaged individual risks.
“This is how you remediate and completely resolve the problem,” explained Ben Shimol. “This is the place in that DevOps system that needs to be changed. Oh, and this is the code that you should use, that we recommend you should use, and you can just apply it in one click. If DevOps or the engineers want to modify it, they can, but we’ve already done the necessary work. So, we provide a complete resolution path, from rapid mitigation to full remediation, for the security team, DevOps, the platform teams and the engineering teams. We call this whole process ‘risk resolution’.”
Zest was founded in November 2023 by Snir Ben Shimol, CEO, and Uri Aronovici, CTO. Ben Shimol was formerly an R&D team leader with the Israel Defense Forces (IDF); while Aronovici was lead security architect at Akamai, and previously in the development and implementation team with the IDF. The company has offices in Tel Aviv and New York.
Related: Dazz Scores $50M Investment for Risk Remediation Technology
Related: Veracode Buys Longbow for Automated Root Cause Analysis Tech
Related: Investors Bet Big on Cloud Security Startups Ermetic, Dazz
Related: These Are the Top Five Cloud Security Risks, Qualys Says
