Cisco today announced its intent to acquire Israel-based cloud security posture management (CSPM) startup Lightspin, marking its second cloud security deal within two months following the Valtix acquisition.

Founded in 2020, Lightspin has raised $20 million in funding to date, including a $16 million Series A round led by Dell Technologies Capital. Although Cisco didn’t disclose the financial terms of the acquisition, it is reportedly estimated to be worth between $200 and $250 million.

Lightspin was founded by experienced cloud penetration testers and aims to empower organizations to see their cloud environment from an attacker's perspective, according to the startup. Its clients include Inspectiv, Imperva, Panoply, and ZoomInfo.

In the CSPM space, Lightspin competes with companies like Lacework, Orca Security, and Wiz, while many larger security firms like Microsoft, Palo Alto Networks, Trend Micro, and Check Point also offer this service.

“Lightspin takes a unique approach to contextualized cloud-security coverage, using graph-based technology to deliver key context, prioritization, and remediation recommendations,” Cisco SVP ​​Vijoy Pandey wrote in a blog post. “Cisco and Lightspin are aligned with a common goal to help customers modernize their cloud environments with end-to-end security and observability from build to runtime.”

Upon closing the acquisition, the Lightspin team will join Cisco's Emerging Technologies & Incubation (ET&I) business, advancing new and emerging technologies, Pandey noted.

The Lightspin acquisition signals Cisco's continued investment in cloud security.

The announcement follows Cisco's February deal with Valtix, which offers a cloud security platform that delivers capabilities including cloud-based firewall, web application firewall (WAF), intrusion detection systems (IDS) and intrusion prevention systems (IPS), egress filtering, and data loss prevention (DLP) for Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform (GCP), and Oracle Cloud Infrastructure (OCI). Analysts expect Valtix’s unique approach to providing a single policy for multiclouds and protecting each individual workload could potentially give Cisco a competitive advantage over its peers.

Prior to the Valtix acquisition, Cisco bought Kenna Security, Portshift, Sentryo, Duo Security, Observable Networks, and CloudLock over the past few years to enhance its security portfolio.

“Over the past 18 months, Cisco has continuously invested in its cloud-native technologies portfolio across cloud security, connectivity, and observability to meet the growing needs of Cisco customers and their increasingly complex multi-cloud environments,” Pandey wrote. “With the addition of Lightspin, customers will be able to identify, prioritize, and remediate critical cloud security risks without the hassle of extensive configuration requirements.”

He noted organizations need the right expertise with a deep understanding of the evolving critical attack paths, attack surfaces, and vulnerabilities, as Cisco's recent Cybersecurity Readiness Index showed only 15% of global organizations have a “mature” enough cybersecurity posture to defend against hybrid world risks.

The Lightspin team's “experience supporting DevOps and DevSecOps with context and tooling will accelerate our ability to deliver the solutions and support needed to prioritize and remediate vulnerabilities across cloud applications and environments,” Pandey touted.