SentinelOne today announced its plan to acquire PingSafe, a cloud-native application protection platform (CNAPP) startup founded by one of the world’s top five white hackers. The integration is aligned with SentinelOne’s current effort to extend its cloud security capabilities beyond cloud workload security to agent and agentless combined CNAPP.

SentinelOne's acquisition of PingSafe involves a combination of cash and stock, with the financial terms remaining undisclosed. So far, PingSafe has raised $3.3 million in a seed round on July 18, 2023. The deal is expected to close in SentinelOne’s first fiscal quarter of 2025, pending regulatory approvals and customary closing conditions.

The security vendor plans to integrate PingSafe’s CNAPP into SentinelOne's Singularity platform, which unifies the vendor’s extended detection and response (XDR), cloud and identity security, incident response, and managed detection and response (MDR) solutions.

PingSafe offers cloud security posture management (CSPM), secrets scanning and log analytics, while bringing offensive security testing to cloud security.

“The market for CSPM is competitive and characterized by low initial costs and minimal costs for customers to switch between providers. Therefore, solutions need to offer more than just CSPM to attract and retain customers,” SentinelOne Chief Product and Technology Officer Ric Smith told SDxCentral in an email.

“With the acquisition of PingSafe, we are forging a new approach to cloud security that blends cloud workload protection, AI [artificial intelligence] and analytics capabilities, and intelligent automation with CNAPP in a single, unified platform that will simplify work for security teams and enhance their productivity by reducing the time to detect, respond to and remediate threats,” he said.

PingSafe's founder and CEO Anand Prakash added, “an attacker’s mindset is needed to drive prioritization in cloud security.”

“For example, instead of assessing a never-ending set of theoretical attack paths, I think defenders need to know where their cloud is offering immediately exploitable activity for threat actors. Show me the evidence-based reporting that there is an exploit path,” the renowned white-hat hacker said in an earlier conversation with Smith about the acquisition.

CNAPP, coined by Gartner, consolidates a large number of previously siloed capabilities including CSPM, runtime cloud workload protection platform (CWPP), cloud infrastructure entitlements management (CIEM), development artifact scanning and infrastructure-as-code (IaC) scanning.

The acquisition enables SentinelOne to combine its strengths in agent-based cloud workload security and cloud data security with PingSafe's CSPM and container image vulnerability management, Kubernetes security posture management (KSPM) and IaC security, which allows the vendor to combine agent and agentless-based CNAPP capabilities.

“SentinelOne has always known that agent-based security allows superior stopping power for attacks as they happen, and increases remediation opportunities. It also allows access to more detailed forensics, so it's crucial to analysts,“ Smith said.

“And agentless controls allow security to extend beyond compute and containers to cloud services like cloud identity, cloud database and cloud firewall. It also allows for security and visibility free of deployment dependencies,” Prakash added.

“Clearly, the answer is that combination of the two makes magic happen,” Smith concluded. “We are confident our ability to integrate with PingSafe’s innovative features outpaces agentless vendors who lack the engineering background necessary to create competitive sensors/agents.”