Headquartered in Virginia, Phishme is a provider of security solutions through training and awareness against malware and drive by attacks. The company has received a total funding of $2.5 million from Paladin Capital Group.

One of the more remarkable recent developments in the technology industry has been the evolution of the cyber security field. Twelve years ago, cybersecurity was a new phenomenon confined to the realm of computer geeks, and most threats originated from amateur hackers and script kiddies looking for thrills and bragging rights. Fast forward to the present day, cyber security has become a board level issue in the corporate world over attacks being carried out by nation-states and sophisticated cyber criminals that have profound ramifications for businesses. This increased relevance has also spurred a growing industry of cyber security firms that have captured the attention of the venture capitalist community.

Origins of Cyber Threats
In the early days of the Internet, cyber threats were generally perpetrated by geeks and pranksters who were more interested in the thrill of the hack than in gaining economic benefit (think of the characters from the ‘90s movie Hackers). Without significant resources, organization, or clear goals, these early hackers did not pose a systemic threat to private industry, and so cyber threats and security remained low on the corporate priority list. Any cyber security responsibilities were likely added to the CIO's list of duties, and any budget earmarked for cybersecurity was minimal. Venture capital investment in security firms was accordingly sparse, as well.

Today, most organizations recognize that cyber threats present a great risk to their business. No longer are adversaries disorganized amateurs. Threat actors are often backed by nation-states or sophisticated criminal organizations that compromise enterprise networks with economic motives. These attackers will exfiltrate intellectual property and other sensitive economic information, the loss of which can have a negative impact on an organization’s reputation and bottom line, as well as incur fines for regulatory violations. The power shift is striking. Whereas before, organizations possessed far greater resources than their attackers; however in the present day, attackers are backed by organizations (such as nation-states) that have far greater financial wherewithal than even Fortune 500 corporations. Enterprises have necessarily begun placing higher priority on cyber security, with many making the chief information security officer an important member of executive leadership.

The reason for this transformation is simple: adversaries are following the easiest path to the information. As the Internet has grown to contain more and more sensitive information, adversaries have realized how much there is to be gained by relentlessly—and often successfully—targeting enterprise networks. For these adversaries, carrying out a cyber-attack offers access to large amounts of money or information with relatively low risk of retribution or attribution. This has meant that any organization dependent on conducting business over the Internet is a potential target. As a result, the list of large corporations and government agencies that have been breached is as long as it is prestigious. In 2013, prominent organizations including Apple, Facebook, The New York Times, and The Wall Street Journal are just a few of the organizations that suffered data breaches.

As cyber threats have grown in importance, security solutions have evolved too. Technologies such as anti-virus software and firewalls have grown in sophistication and proven to be effective at stopping the threats they are designed to protect against. The success of these solutions transformed cyber security into a prosperous industry, as implementing technical defenses has become a standard best practice at every enterprise.

However, as with any protective measure, attackers have merely evolved their tactics to evade these traditional defenses. Consequently, attackers have begun targeting employees as their preferred point of entry into enterprise networks. The exploitation of humans has led to email-based social engineering, known as spear phishing, which has been cited in prominent security research reports as the preferred attack method used by advanced threat actors to carry out targeted attacks. Spear phishing emails, sent to employees appearing to be genuine, attempt to entice the recipient into clicking on a malicious link, opening a malware-laden attachment, or surrendering login credentials. This approach offers the attacker a path of least resistance onto the network. Enterprises have struggled to find ways to effectively train their employees to recognize spear phishing emails and avoid falling for them.

Aligning Cyber Security Efforts with Changing Business Objectives
The cat-and-mouse dynamic that has come to define the cyber security industry has seen explosive growth, as firms continue to roll out solutions intended to defend against the latest threats. The dynamic nature of the threat landscape means that there will always be a new threat to defend against, continually offering savvy companies with opportunities to develop new solutions. Venture capitalists have taken notice as well by continually investing in new ideas and the vision of entrepreneurs to solve hard security problems. Many have been rewarded for their investments with a number of security firms, notably Palo Alto Networks and FireEye, recently enjoying successful IPOs.

With technology continuously growing in importance as a business enabler, the attack surface will only expand and offer new opportunities for compromise using well known tactics. Organizations must bolster their defensive posture, evaluate proactive threat mitigation strategies, and align their cyber security efforts with changing business objectives and workforce to ensure appropriate risk levels are achieved.