Artificial intelligence is emerging on the development roadmaps of more and more security vendors. Among them is endpoint protection powerhouse Webroot Inc., which today acquired a low-key firm called CyberFlow Analytics Inc. that employs machine learning to monitor network activity.

The firm’s flagship FlowScape platform scan the massive amounts of traffic that flow through an organization’s internal infrastructure to identify unauthorized user behavior, suspicious files and other potential threats. Its machine learning algorithms then filter out false positives using a patent-pending method CyberFlow refers to as “Binocular Analytics” until they isolate the problems that truly warrant the IT department’s attention. Administrators have a choice between displaying the results directly in the software’s built-in monitoring console, or sending them to a third party security tool like ArchSight for further processing.

The latter feature enables organizations to plug FlowScope into their existing security infrastructure instead of having to use its capabilities in isolation, which can simplify adoption a great deal. And to make even the software even more accessible, CyberFlow sells two separate editions for large enterprises and small to medium organizations with fewer than 10,000 IP addresses in their networks. Though it’s not mentioned explicitly, the platform’s broad appeal is likely one of the main reasons why Webroot decided to swoop in and buy the frim today.

The company’s business security division has so far focused mainly on SMBs with limited IT resources and even tighter security budgets. The acquisition of CyberFlow gives Webroot an opening into the more lucrative enterprise segment while augmenting its modest network protection portfolio, which until now consisted solely of a web gateway designed to block online threats from entering companies’ backend infrastructure.

Webroot didn’t say how much it paid for CyberFlow, but it did drops some hints about the changes that will occur in the wake of the deal. The acquisition announcement states that “FlowScape is available for custom integration and evaluation as part of an initial pilot program, with full availability and further product integrations expected in 2017.” This presumably means that the company plans on integrating the platform with its web gateway, flagship endpoint protection solutions or perhaps even both to put forth a more cohesive value proposition for customers.

Image via blickpixel