Cisco Systems Inc. today disclosed that it has acquired Oort Inc., a startup focused on defending enterprises’ identity and access management tools from hacking.

The acquisition’s financial terms were not disclosed. Boston-based Oort previously raised $15 million in funding, a portion of which was provided by Cisco’s venture capital arm last year. Prominent investment firm Bain Capital Ventures is also among the startup’s backers.

Oort sells a software platform that functions as a kind of antivirus for identity and access management, or IAM, systems. Such systems are used by companies to regulate which employee can access what internal application and how. Because of its key role in organizations’ cybersecurity operations, IAM software is a major target for hackers.

Oort’s platform works by collecting telemetry data from a company’s IAM systems and scanning it for signs of malicious activity. According to the company, its platform can detect dozens of common cybersecurity issues. 

Some IAM systems leverage cookies installed on users’ computers to verify login requests. If a machine stores a legitimate cookie, login requests from that machine are approved. In other cases, sign-in attempts are validated using files called access tokens that serve a similar purpose as a password but have different technical characteristics.

If hackers steal a user’s cookie or access token, they can potentially gain access to the application into which the user is currently logged in. Oort says its platform is capable of automatically detecting such breach attempts. The platform can also spot other hacking tactics, including brute-force attacks in which cybercriminals attempt to guess users’ passwords.

“If an attacker stole an employee’s credentials, giving them access to twenty different systems, Oort can identify the four systems that were actually compromised and require further remediation,” Raj Chopra, chief product officer of Cisco’s cybersecurity business, detailed in a blog post. 

After detecting a cybersecurity risk, Oort enables administrators to remediate it with a few clicks. The platform provides a tool that can be used to quickly log out accounts exhibiting signs of malicious activity. Additionally, it provides the ability to temporarily suspend accounts when necessary. 

The platform’s feature covers other aspects of IAM security as well. According to Oort, its platform can not only help companies detect cyberattacks but also prevent them from happening in the first place.

Oort scans an organization’s IAM systems for potential configuration issues that may open the door to hacking. The platform can, for example, find unused accounts with access to sensitive applications. The more users have access to a sensitive system, the more opportunities hackers have to try and compromise it by stealing login credentials. 

It also detects accounts that are used regularly but may be configured incorrectly. According to the company, its platform spots cases where an account may have been given access to more applications than strictly necessary. Such excessive access permissions can potentially increase the scope of data breaches if left unaddressed.

Cisco expects to close the acquisition in its fiscal first quarter, which ends on Oct. 29. Afterwards, the company will fold Oort into its cybersecurity business. Cisco will use the technology to enhance its IAM security and XDR, or extended detection and response, product portfolios.

Image: Oort