Following Accenture’s acquisition of Dragos and ServiceNow buying Armis, SJA hears exclusively from Asimily CEO Shankar Somasundarm about what the recent IoT/OT security consolidation means for the industry.
Could you tell us about Asimily and your role?
I’m the CEO and Founder of Asimily. The company launched in 2017. We’re an exposure management platform for IoT, OT and IoMT cyber assets.
Our customer base is broad and spans industries, including manufacturing, healthcare, utilities/energy and life sciences, among others.
Prior to Asimily, I was at Symantec (acquired by Broadcom), where I helped start and grow the company’s embedded/IoT market.
What do you think is driving the recent wave of IoT/OT security consolidation in the market?
It’s nice to see the world catching on to what Asimily believed since its founding – IoT/OT are not like any other internet-connected devices.
Because each is unique and classification is not easy, it is harder to identify and classify them.
They also have potentially unique attack surfaces and responses to unexpected traffic.
So, all the standard cybersecurity techniques don’t apply, at least not safely.
Because IoT/OT devices are growing faster than the rest of the IT market, it’s only natural that companies are going to invest in that growth.
Does consolidation among competitors create an opening for focused independent vendors, or does it make it harder to compete?
We’ve already seen the first wave of “acquisition refugees,” who are seeing the changes that acquisitions inevitably bring: different service, contracts, packaging.
Many of those who don’t like what they see from their new vendor, one they did not choose, come to us for personalized service and predictability.
We think considering the complexity of such devices, best of breed in this market in product and services will continue to win whether it is stand-alone or part of a larger organization.
As the threat environment intensifies, are organizations benefiting from market consolidation?
For some smaller organizations, they might find some benefit from perhaps having fewer vendors to work with, but for larger organizations they prefer best in class.
Plus, organizations have a wide variety of solutions, and they want vendors who can integrate across the ecosystem more than whether they are part of a large ecosystem.
So, it depends, from one organization to the other. That said, buyers should pay attention to what consolidation means for product direction.
When security products get absorbed into much larger software companies, the roadmap usually shifts to whatever the acquirer is building around.
Customers on the other side of those deals can be in for an uncertain future they didn’t sign up for.
What’s the most underappreciated risk in IoT/OT security right now – something the industry isn’t talking about enough?
The biggest risk today is “phantom network segmentation,” where organizations mistakenly believe their IoT/OT are securely segmented.
Many projects fail due to a lack of device context, which traditional vendors often struggle to provide.
Another reason is not knowing how to get segmentation going and how to effectively keep it segmented.
We bridge this gap by offering the context and control needed for effective, reliable segmentation.
There’s also the lifecycle risk. Segmentation cannot, at least not effectively, be a configuration you set and revisit annually.
Your device parameters change all the time, whether you’re aware of it or not, and new assets continue to be added.
Your network topology is also shifting constantly. Policies that are accurate when written tend to go stale within months, if not sooner.
Few security teams have the bandwidth to audit and update them at the pace they need to.
So phantom segmentation persists because policies that exist on paper don’t match network reality.
It’s also why we launched Segmentation Orchestration earlier this year, as a way to make safe segmentation as dynamic as the asset inventory is.
Devices get added, removed and changed all the time, and each one should, but currently usually doesn’t, trigger a re-evaluation of the network policies.
Now it can, because Segmentation Orchestration makes it easy.
What will the IoT/OT security market look like in five years? Will it be a handful of mega-platforms, or will the operational complexity of protecting critical infrastructure keep creating space for specialists? Where does Asimily fit into that picture?
Every part of the software market will always have its large platform players and specialist niche offerings that challenge the paradigm of the prior generation.
At Asimily, we’re simply focused on creating the best software possible that protects our customers and meets their needs, whether it is classification, risk prioritization or mitigation.
We will continue to do this and continue to provide the best service to our customers.
This category will not get decided in a two- or three-year window.
It’ll play out over a longer stretch as IoT/OT security solutions that keep maturing pull ahead of those losing momentum after an acquisition or pivot.
A richer inventory bolted into a bigger suite is not the same as reducing real risk on your network of connected assets, even when the two keep getting sold as if they were.
