Cybersecurity startup ConductorOne grows series A funding to $27M to boost least privilege access

ConductorOne has expanded its series A funding by $12 million, bringing the total to $27 million, on the strength of customer growth and product momentum. The company will use the funding to fuel product development and build out its go-to-market teams.

Felicis led the expanded series A. ConductorOne CEO Alex Bovee told VentureBeat, “It was an opportunity to partner with a great firm, so we’re pretty excited about it.” He explained that after meeting with Felicis, “We just immediately clicked. We really loved the team.”

With Felicis’ security ecosystem expertise and connections, ConductorOne is well positioned to reinvent identity and access management. Strong early traction validates the company’s differentiated integration and developer-centric approach. By balancing the need to shift security left in the CI/CD process with the need to improve user productivity beyond what traditional solutions can do, ConductorOne’s dev-first model with extensive integrations is proving effective across its customer base. 

ConductorOne: An integration powerhouse

Integrations are key to managing access and enforcing least privilege in cloud, hybrid and on-premises environments. 

ConductorOne recognized this challenge early on. With over 75 integrations and an open-source integration protocol it invented called Baton, the startup is quickly covering the most important SaaS and infrastructure apps to help companies manage permissions across their entire environments. 

“One of our greatest technical achievements is our ability to produce integrations. We believe, first and foremost, that securing identity and access requires the need to integrate with any technology,” Bovee told VentureBeat during a recent interview. 

One of ConductorOne’s core strengths is that its architecture is designed to deliver integration at scale. Bovee told VentureBeat that it could produce several new integrations monthly using its Baton SDK. 
“Our Baton SDK is designed to quickly build new connectors to any app based on customer needs,” he told VentureBeat. Further strengthening its integration strategy, ConductorOne has open-sourced its Baton integrations, “because we believe that, at the end of the day, this is a protocol. Baton is the connective fabric and protocol that powers identity security posture management.”

VentureBeat believes open source is the future of integration at scale. ConductorOne’s decision to make Baton an open-source platform allows CIOs, CISOs and the enterprises they serve to audit behaviors and data access. An open-source identity security protocol enables greater extensibility for every connector in a network, enabling more effective customized sync, discovery and provisioning logic workflows that are unique to every business’s approach to managing its tech stacks.

Automating cloud PAM for developer workflows

Capitalizing on its successful track record and expertise in integration, ConductorOne recently launched a new cloud privileged access management (CPAM) solution tailored for modern teams with a developer-first focus. Bovee told VentureBeat the new platform automates permissions and enforces least privilege access policies across cloud infrastructure, including AWS, Google Cloud Platform and Snowflake as well as existing hybrid cloud, on-premises and legacy systems.

One of ConductorOne’s core goals for the release was to provide developers a platform that would allow them to secure cloud access without friction or standing privileges that increase risk. 

By designing its cloud-based PAM platform specifically for developers, ConductorOne enables its customers to take a dev-centric approach to cloud access security. This is key to giving development teams an adaptive, flexible approach to just-in-time access that matches their needs and work cadence while staying within security guidelines. Bovee says permissions are granted on demand, and revoked once the task is complete, to minimize standing access, further strengthening the platform’s ability to deliver least privilege access at scale.

The new capabilities live within ConductorOne’s unified identity security posture management (ISPM) platform, making it possible to govern sensitive access to all cloud infrastructure without impeding developer productivity.

Enabling zero trust for dev teams

By automating least privilege controls in infrastructure environments, the platform supports the core zero-trust principles defined in the NIST 800–207 standard. Just-in-time privileged access and automated de-provisioning minimize standing privileges that could be misused, further strengthening his company’s platforms’ contributions to customers’ zero-trust frameworks. 

Granular policies that are designed in and core to ConductorOne’s platform enforce access only to specific resources needed for a task at a specific time. Members of developer teams are granted temporary credentials to deploy code to production servers and are not provided standing access afterward. Bovee noted that this strengthens customers’ zero-trust frameworks by verifying explicit authorization for access.

VentureBeat has seen how important it is to get integrations right across a wide spectrum of tech stacks across multiple industries. The reason is that they provide continuous visibility of permissions across cloud infrastructure, SaaS apps and on-premises systems, which is essential to ensuring zero trust. The greater the integration, the greater an organization’s ability to monitor identities and configure least privilege access policies.

The bottom line is that these capabilities taken together are table stakes for getting least privilege access right amid rapid changes to resources and workflows. ConductorOne’s platform aims to embed zero trust into modern CI/CD pipelines and cloud-native infrastructure, enabling stronger security postures in the process. “We have this concept we call ‘shift left identity,’ and the idea is that the best way to prevent an identity breach in the first place is not to detect and remediate it, but to prevent it from happening in the first place. That’s the idea of shifting left,” Bovee told VentureBeat. 

Investor confidence

ConductorOne’s $27 million series A funding round confirms investor confidence in the company’s vision to reinvent legacy IAM, IGA and PAM solutions. The latest funding will be used to accelerate the development of the company’s cloud-native identity security platform. By reinventing IGA and PAM for the cloud, ConductorOne aims to secure workforce access across all applications an enterprise uses.  

The shift from perimeter security to identity-centric zero-trust models mirrors the company’s trajectory. ConductorOne is expected to be a leading vendor in transforming how integration is done at scale and securely across enterprises while ensuring developer teams achieve least privilege access at scale — a core element of a strong cybersecurity posture and a hardened zero-trust security framework.

Originally appeared on: TheSpuzz