Procyon Inc., a provider of secure access management for multi-cloud enterprise infrastructure, said today that it has raised $6.5 million in funding toward launching its privileged access management platform that it says will reinvent how DevOps teams and developers access cloud services.

Lobby Capital led the investment round with participation from GTM Capital and First Rays Venture Partners.

Procyon co-founder and Chief Executive Sukhesh Halemane and Chief Business Officer Akash Agarwal told SiliconANGLE that as multicloud environments become the norm, accessing them securely has become more complex and difficult for developers. At the same time, cybersecurity teams have been tightening their defenses because many users accessing cloud environments have the potential of compromising sensitive information.

“One of the biggest worries is highly privileged users having access to the crown jewels getting compromised, and if you think about it in the cloud every user who has access to the database account is a privileged user,” said Halemane. “A second problem is that either developers are struggling to get access to something, meaning they’re sending email or Slack messages and two days later they finally get access, or they have too much access, such as they have too many privileges assigned.”

The Procyon Multi-Cloud Privilege Access Management platform provides a solution that allows developers quick access to what they need, with enough privileges to do what they need and uses passwordless technology.

On the developer access end, the platform removes passwords by taking advantage of the Trusted Platform Module found in computing environments – such as PCs, laptops and phones — to authenticate devices along with an identity management provider such as Okta Inc.. Using TPM, Procyon cryptographically binds to user identity and maps that to the resources they will access.

The credential itself is secure and eliminates the use of password managers or vaults, thus removing anything that can be easily stolen, the company says. For more sensitive roles, TPM can also be combined with biometrics on laptops and phones such as fingerprint readers and FaceID for even higher security.

Data breaches can be costly, with the average cost reaching $4.35 million according to the 2022 cost of data breach report by IBM Corp. and Ponemon institute. Stolen or compromised credentials were the most common cause of data breaches and took the longest time to identify. Some breaches of big companies in 2022 happened due to stolen credentials, such as the September hack of ride-sharing company Uber Technologies Inc.

In traditional cloud systems, developers can have longstanding access to cloud resources that provide them privileges to sensitive systems, sometimes in perpetuity. That makes them targets for social engineering attacks such as phishing, when a hacker tries to trick a user into giving up their password or other credentials.

To prevent that, Procyon has a self-service portal where developers can request access to the specific resources that they need and the time that they need them for, and they receive access via the passwordless system. Approval policies can be configured by the security team based on any number of factors according to compliance standards, the resource, identity and approver. The access can also be set to expire after a certain amount of time, meaning that the privileges are temporary.

In the industry, this is known as “zero standing privileges” along with “just-in-time access,” which helps eliminate the chances that an attacker can get access to over-privileged resources or user account.

“In olden systems, you’d be given a password and access to these systems that you would retain for some period of time, in many cases forever,” said Agarwal. “And you left the company and your email is being disbanded and maybe your access to corporate, but we’re discovering that other access that you shared over Slack still remains with you. Unless the company has a super-comprehensive system to know who was given access to what, they can’t revoke that. That’s what leads to compromises and the sale of credentials on secondary markets.”

The self-service portal works with all the major cloud services – Google Cloud, Microsoft Azure and Amazon Web Services – and tracks all the permissions and roles for the management. If any of those roles are updated on these services, Procyon also updates them so business workflows don’t break.

If something does go wrong, for example, an account or service is maliciously accessed, Procyon’s platform has a function, dubbed the “kill switch,” that can instantly terminate sessions, devices and accounts from accessing the system. That’s made easy because the platform sits between the developer and every service they interact with and has a perfect view of every authentication transaction and session, according to the company. With the ever-increasing complexity of multicloud environments, the value of Procyon for enterprise businesses is becoming even more obvious, Agarwal explained.

“With businesses with large engineering teams can’t manage this,” said Agarwal. “They have full-time identity management teams where it’s someone’s job to provide you identity and access and that person is just overwhelmed trying to manage it. If you think about it, Procyon’s value proposition becomes compelling because we give that person automation. We give the entire DevOps team automation to manage privileges and eliminate potential compromises with what we do.”

Image: estherpoon/Adobe Stock