Infrawatch Ltd., a cybersecurity company providing intelligence about the infrastructure used by malicious actors to help organizations stop attacks, fraud and online abuse, announced Wednesday it has raised $3 million in pre-seed funding. 

Outward VC and TriplePoint Ventures co-led the round, with participation from Portfolio Ventures and leading fintech and cyber angel investors. 

The traditional method for handling cybersecurity surrounds malicious tactics and the perimeter. What’s happening to the network at the machine level becomes the hottest flashpoint and the most important problem to handle because that’s what’s about to cost any given corporation a lot of money in the short run. This is the nature of rules, policies, firewalls and reactive architecture. 

However, Infrawatch founder and Chief Executive Lloyd Davies argues that although tactics change daily to avoid and evolve around defenses, hostile infrastructure is necessarily far more static and leaves a persistent trail. That infrastructure can be identified, blocked and mitigated before it’s used at scale, providing another layer of proactive defense that is underutilized. 

Infrawatch was built to gather intelligence, providing a massive collection of real-time classification data to help organizations move from reactive monitoring to pre-emptive defense. 

“I know from first-hand experience how broken infrastructure intelligence is today: fragmented data, noisy feeds and taped-together workflows, where ‘real-time’ detection often means static daily updates in practice,” Davies said. “Enterprises cannot keep up by patching together narrow intelligence feeds while the internet changes beneath them.” 

Davies built Infrawatch with a team of alumni from CrowdStrike Holdings Inc., Recorded Future and Intel 471. He added that many have first-hand knowledge of how adversaries use internet infrastructure to operate and how poorly existing tools help defenders understand modern-day threat vectors. 

The premise behind the company, he explained, is to provide a critical layer to empower defenders to act earlier by having knowledge of threats before they reach customers, users or systems. 

Today, the company processes tens of billions of events per day, turning what looks like noise into actionable intelligence. Additionally, the platform provides more than 1,000 out-of-the-box detection rules and allows organizations to build their own custom detection mechanisms. 

Infrawatch leans heavily on research into hostile infrastructure, and it will continue to publish security intelligence. The company recently exposed a Belarus-based “SIM-Farm-as-a-service” provider linked to operators across 17 different countries. 

 Image: SiliconANGLE/Ideogram