Hexadite

The problem: more alerts than analysts

Hexadite was founded in 2014 by Eran Barak (CEO), Idan Levin (CTO) and Barak Klinghofer (CPO), all three veterans of Unit 8200 and former employees of Elbit Systems. They identified a problem that was getting worse in large organizations: antivirus systems, firewalls and other detection tools produce a huge number of alerts, and security teams cannot investigate them all. The idea was to let a machine filter and rank the alerts, so analysts could spend their time on the most serious threats.

The solution: automatic investigation

When the company came out of stealth in 2014, it presented a system called AIRS that automatically carries out the investigation and remediation of cyber incidents. The system connected to existing detection tools, examined every alert they raised and ranked how urgently it needed handling. According to the company, it was designed to imitate the way the best analysts investigate and make decisions, and it handled small threats by itself and passed the complex ones to human experts. The company claimed that the system cut alert handling time by up to 95% and compressed weeks of work into minutes; these figures come from the company.

Funding

In its founding year, Hexadite raised $2.5 million in a seed round led by YL Ventures, with participation from Moshe Lichtman, a former Corporate VP at Microsoft. In 2016 it raised an $8 million Series A from Hewlett Packard Ventures, Ten Eleven Ventures and YL Ventures, and its total funding stood at only $10.5 million. The official headquarters moved to Boston, while research and development stayed in Israel.

The Microsoft acquisition

In May 2017, Globes reported, citing market sources, that Microsoft was buying Hexadite for $100 million, ten times what the company had raised. According to the Israeli Registrar of Companies, each founder held 12.2% of the shares. On 8 June 2017, Microsoft confirmed the acquisition but did not officially publish the terms. The company was absorbed into the Windows and Devices group. The stated goal was to bring artificial intelligence to Windows Defender Advanced Threat Protection, Microsoft's security product for business customers, and to make incident response and remediation faster and more efficient. It was not Microsoft's first Israeli cybersecurity acquisition; it was preceded by Aorato, Adallom and Secure Islands.

What this story teaches

Hexadite was slightly ahead of an idea that has since become central in the cybersecurity industry: not another tool that detects threats, but a system that replaces part of the work of the person who handles them. Today Microsoft offers automated investigation and response in its Defender products, which examines alerts and takes remediation actions without waiting for an analyst. The sources checked here do not say explicitly which part of it relies on Hexadite's technology, but the direction is the same as the one the company presented in 2014. For the Israeli industry, the deal was an example of a quick exit: three years, about $10 million raised and a deal reported at about $100 million.