RSAC 2021 Innovation Sandbox

## Overview

Idan Plotnik, CEO of Apiiro, presents the company's approach to reimagining the security development lifecycle for agile and cloud-native environments. The core problem: existing DevSecOps, cloud security, and risk management tools lack visibility and understanding of risk across the complete application lifecycle, from design through code to cloud deployment.

## Key Problems

The talk identifies several critical gaps in current security practices:

- **Multidimensional Risk**: Risk assessment requires understanding developer expertise, code logic changes, pull request discussions, cloud infrastructure modifications, and authorization controls—information typically scattered across disconnected tools. - **Scale Mismatch**: Organizations operate with approximately one security architect per 159 developers, yet each developer generates multiple changes daily. Manual review processes (threat modeling, security reviews, pen-tests, alert triage) are impossible to scale. - **Fragmentation**: No single view exists connecting design decisions to code changes to cloud deployment, resulting in late decision-making and process inefficiency.

## The Apiiro Solution

Apiiro's Code Risk Platform addresses these gaps through:

- **Multi-source Analysis**: Uses NLP and machine learning to analyze application code, open-source components, infrastructure-as-code, user stories, developer knowledge, third-party tool data, and business impact. - **Core Capabilities**: - Real-time application inventory - Remediation work plan generation - Adaptive governance engine - Automated remediation workflows - CACD attack prevention (with anomalous developer behavior detection, similar to detection of Solar Winds-style attacks)

## Market Position

Apiiro targets the intersection of DevSecOps, cloud security, and risk management, addressing a $100 billion market opportunity. The company launched in October and had already acquired over 40 customers at the time of this pitch. The fundamental thesis: DevSecOps and cloud security must evolve from fragmented point solutions into multidimensional risk management platforms that act as business enablers rather than blockers.