\nGoogle\u2019s Gradient backs YC alum Infisical to solve secret sprawl<\/br>
\n2023-07-03 21:41:10<\/br><\/p>\n
Secret sprawl, where companies store authentication credentials and similar sensitive data across multiple locations, is a real<\/a> and growing problem<\/a> for any company wanting to avert a security breach.<\/p>\n Companies might have hundreds of secrets \u2014 such as API keys, passwords or database access tokens \u2014 spread across their infrastructure, making it difficult to keep tabs on what is stored where, who has access to it, and whether any of this data has inadvertently found its way into the public realm. By way of example, back in 2017, Uber revealed a major breach<\/a> that exposed the personal data of some 57 million customers, and while there were many security failures at play, the root cause<\/a> stemmed from hackers that found an AWS access key in a GitHub repository of an Uber developer.<\/p>\n And it\u2019s against that backdrop that we\u2019ve seen a slew of startups and Big Tech tools<\/a> go to market designed to help companies manage their secret sprawl. The latest is a San Francisco-based company called Infisical<\/a>, which today announced it has raised $2.8 million in a seed round of funding led by Google\u2019s Gradient Ventures to help companies of all sizes centralize their secret management.<\/p>\n Infisical is pitching itself as a holistic secret-management platform combining all the components a company needs \u2014 a bit like what Rippling has been doing in the workforce management space<\/a>, except for secrets, according to Infisical\u00a0co-founder Vlad Matsiiako<\/a>.<\/p>\n \u201cAs companies are becoming more digital and integrated with other software, it\u2019s harder to manage all of their application and developer secrets \u2014 they have to buy multiple tools and give all of them access to their secrets, which is a security concern on its own,\u201d Matsiiako explained to TechCrunch. \u201cYou can think of Infisical as an all-in-one secret management stack that combines all related product verticals for a company.\u201d<\/p>\n This includes a dashboard<\/a> for managing secrets across different projects and environments; client SDKs<\/a>; a command line interface (CLI<\/a>); native integrations<\/a> with the likes of GitHub, Netlify and Vercel; secret versioning<\/a> and \u201cpoint-in-time recovery\u201d; audit logs<\/a>; and secret scanning<\/a>.<\/p>\n Infisical dashboard. Image Credits:<\/strong> Infisical<\/p>\n<\/div>\n As for a business model, Infisical attracts revenue through its hosted cloud incarnation, which it sells as a SaaS, and through its self-hosted counterpart by selling enterprise-grade features.<\/p>\n While Infisical is pushing itself as an \u201copen source\u201d SecretOps platform, a quick peek at its licensing on GitHub<\/a> reveals that it\u2019s perhaps more aligned with the open-core or source available realm, than it is the pure open source sphere. That is to say, while much of the platform\u2019s core functionality is apparently available to use under the permissive MIT license<\/a>, including secret-scanning and infrastructure integrations, it has retained a lot of the features \u2014 such as audit logs, single-sign on, recovery and access controls \u2014 under a proprietary license under a separate enterprise edition (EE).<\/p>\n \u201cOur entire codebase is available for everyone to view on GitHub, and we keep all core secret management functionalities available under the MIT license,\u201d Matsiiako said. \u201cWe strongly believe that solo developers and hobbyists should be able to experiment with most features for free using either Infisical Cloud or Infisical self-hosted.\u201d<\/p>\n The thinking here is that when users start considering Infisical in terms of deploying for critical commercial use cases, they need more features such as advanced security and compliance. So even if a company has chosen to self-host Infisical, they still have to purchase an enterprise license to leverage core proprietary features.<\/p>\n \u201cThe goal is really to charge only larger enterprises,\u201d Matsiiako added.<\/p>\n There are a bunch of similar tools on the market already, including the open source Vault<\/a> project from billion-dollar cloud infrastructure giant HashiCorp<\/a>, which has pretty much set the standard for the secret-management sector. However, Matsiiako argues that Infisical is aimed more at general developers rather than platform-engineering teams, making it easier to deploy with a flatter learning curve.<\/p>\n \u201cVault is difficult to adopt for developers without a background in security or infrastructure, and we find it to be more popular amongst security and platform-engineering teams,\u201d he said. \u201cBecause of that, companies experience slower development cycles and some even resort to developing fully custom developer-facing solutions on top of \u2014 or instead of \u2014 Vault.<\/p>\n Other notable alternatives include\u00a0Doppler<\/a> and\u00a0Akeyless<\/a>, which are substantively proprietary SaaS products, and even tangential products such as secret-scanning tools from the likes of GitGuardian<\/a>, a feature that Infisical is already supporting as part of its platform.<\/p>\n \u201cBy integrating secret scanning inside of Infisical\u2019s bundle offering, we extract synergies between secret management and secret scanning, and a company looking for related secret management solutions now only needs to go through one vendor instead of multiple,\u201d Matsiiako said.<\/p>\n The company\u2019s trio of founders \u2014 Matsiiako, Maidul Islam<\/a> and Tony Dang<\/a> \u2014 met at Cornell University, where they studied a mix of computer and data science subjects, going on to work at various companies such as AWS, Figma and Bung. They then met up to kickstart their new venture together out of San Francisco last August.<\/p>\n \u201cThroughout our past collective experiences and talking to industry peers, we recognized that managing application secrets was cumbersome and that problems in the secret management industry were far from being solved,\u201d Matsiiako said. \u201cIt became clear to us that we needed to build an open source solution that\u2019s simple to use for secret management; being open source gives developers the flexibility of using Infisical Cloud or self-hosting it on their own infrastructure which is what larger companies frequently do.\u201d<\/p>\n Infisical went on to raise $500,000 from its participation in Y Combinator\u2019s (YC) winter \u201923 program<\/a>, and it recently made its first engineering hire, who joined them from enterprise software giant Red hat.<\/p>\n Aside from lead backer Gradient Ventures, the company\u2019s seed round included investments from YC, 22 Ventures and angel backers such as Elad Gil<\/a> and YC\u2019s Diana Hu<\/a>.<\/p>\n<\/p><\/div>\n <\/br><\/br><\/br><\/p>\nTop secret<\/h2>\n
![\"Infisical](\"https:\/\/i0.wp.com\/techcrunch.com\/wp-content\/uploads\/2023\/06\/Infisical-Dashboard.png?resize=1024%2C570&ssl=1\")
<\/p>\nThe (sort of) open source factor<\/h2>\n
The story so far<\/h2>\n