Cloud security unicorn Aqua Security acquired software supply chain security provider Argon Security to shift further left and extend Aqua’s vision to secure the full software development lifecycle. 

“It's a very natural extension of what we're doing,” Aqua Security CEO Dror Davidoff said. The acquisition “extends our capabilities further to the left to not only look at the application but also secure the supply chain of the application, the build stage of the application.”

Founded in 2020, Argon is based in Tel-Aviv, Israel. It raised $4 million in the seed funding round in May, according to Crunchbase. Aqua didn’t disclose the financial terms of the acquisition. 

Argon maps and protects the continuous integration/continuous deployment (CI/CD) pipelines while using a zero-trust approach to detect unusual changes in the development environment. Its detection technology checks on every stage of the software delivery process for code-tampering, which prevents supply chain attacks, the vendor claims.

Adding Argon’s technologies will be “a very unique differentiator” for Aqua, Davidoff noted, since “there are maybe two other companies in the world that really address these problems.”

Argon’s technologies complement Aqua’s existing vulnerability management and infrastructure-as-code (IaC) security capabilities.

Aqua’s Dynamic Threat Analysis protects containerized applications from image-based malware by automatically running images in a secure sandboxed environment. This service, combined with Argon’s supply chain security capabilities, can secure the build stage in the application lifecycle, the company claims. 

There are three important components for the application, and “most of the players in this market will only do one of these components — either securing the build or securing the infrastructure or securing the runtime,” Davidoff said. 

Other than Aqua, only Palo Alto Networks can secure all of three, he added. “They did it through a series of nine different acquisitions … so there is a lot of noise coming from different parts,” he added. “But Aqua is practically the only one that has the full coverage of the lifecycle.” 

However, as the demand for a consolidated cloud security strategy increases, Davidoff expects more incumbent security players will also move into this market.

In addition to Argon, Aqua bought cloud security posture management company CloudSploit and open source container image vulnerability scanner Trivy both in 2019. And then the company scored a $135 million Series E funding round that spiked Aqua’s valuation over the billion-dollar mark.

Aqua enjoyed a high double-digit growth rate and doubled its employee and customer base over the last 12 months, including 30 Fortune 100 and 120 Fortune 500 customers, according to Davidoff.

With engineering centers in Israel, India, and Boston, the majority of Aqua’s business remains in North America. However, the company started to expand to the Asia-Pacific market earlier this year and Europe, the Middle East, and Africa market is also its big focus, Davidoff said.

“We're expanding on all fronts,” he added. “Everyone’s moving to the cloud, without exception … so that introduced a phenomenal opportunity for us.”