Tenable To Acquire Cloud Security Startup Ermetic For $265M

The acquisition will expand Tenable’s vulnerability and risk management platform with capabilities for removing unneeded permissions in the cloud.

Ermetic Co-Founder and CEO Shai Morag

Tenable announced it’s reached an agreement to acquire cloud identity and permissions management startup Ermetic for $265 million in cash and stock, as the company looks to expand the cloud security capabilities of its vulnerability and risk management platform.

In a news release announcing the deal Thursday, the cybersecurity vendor said it plans to integrate Ermetic’s technology into its Tenable One Exposure Management Platform in a move that “increases [its] focus on cloud security.”

[Related: The 10 Hottest Cloud Security Startups In 2023 (So Far)]

The acquisition deal includes $240 million in cash along with $25 million in stock, and Tenable expects it to close in the early fourth quarter.

Shai Morag, co-founder and CEO of Ermetic, said in the release that combining the two companies will provide “unprecedented” visibility to customers and “remove the complexity that makes managing cloud environments so challenging.”

Founded in 2019, Ermetic specializes in automatically removing unneeded permissions in the cloud. The startup is a “leader” in the category, which is known as cloud infrastructure entitlement management (CIEM), Tenable said in its news release.

Ermetic offers CIEM as part of its broader cloud-native application protection platform (CNAPP), which aims to bring an identity-focused approach to a number of capabilities in cloud security. Along with CIEM, the Ermetic platform also offers cloud security posture management (CSPM), cloud workload protection (CWP) and security for infrastructure-as-code (IaC), as well as Kubernetes security posture management.

In March, Ermetic announced the launch of a redesigned channel program, which includes an offering customized for resellers and a separate offering tailored to MSSPs. The startup said at the time that it counted more than 90 channel partners in its program, including Trace3, GuidePoint Security and Optiv.

For Tenable, the expansion of its offering with Ermetic’s identity-driven cloud security capabilities will enable the company to “deliver a holistic view of the modern attack surface and help organizations reduce exposure and risk, using identity as an essential foundation,” Tenable CEO Amit Yoran said in the release.

Ultimately, the integration of Ermetic will provide customers with “market-leading contextual risk visibility, prioritization and remediation across infrastructure and identities,” including in both on-premise and cloud environments, Tenable said in the release.

The acquisition is the sixth for Tenable since it went public in 2018, according to the company.

Ermetic had raised a total of $100 million in funding, most recently landing a $70 million Series B round in December 2021 led by Qumra Capital.