To enhance its cloud security portfolio, Tenable today announced its intent to acquire Ermetic, a cloud-native application protection platform (CNAPP) provider, for around $240 million in cash plus an additional $25 million in restricted stock and restricted stock units.

The deal is set to close early in the fourth quarter of 2023. Tenable, an exposure management vendor, reported a 19% year-over-year increase in revenue to $195 million in July during its second fiscal quarter of 2023 earnings call. The vendor claims it added 426 new enterprise platform customers and 63 net-new six-figure customers during the quarter. Tenable expects to fund the cash portion of the Ermetic purchase price with existing cash.

Ermetic, founded in 2019, has raised $97.3 million in funding over three rounds. Its latest Series B funding round was funded by seven investors, including Splunk Ventures, Forgepoint Capital and Target Global.

The startup claims it offers a runtime cloud workload protection platform (CWPP), cloud security posture management (CSPM), cloud infrastructure entitlements management (CIEM), automated Kubernetes security and compliance (KSPM), and infrastructure-as-code (IaC) scanning. It's also putting together all these capabilities as a platform for CNAPP.

Tenable plans to integrate all these cloud-security capabilities into its Tenable One Exposure Management Platform to provide contextual risk visibility, prioritization and remediation across infrastructure and identities for both on-premises and the cloud.

“Our plan is to take the strengths we have — agentless assessment, infrastructure of code scanning, etc. — and integrate that natively into the Ermetic solution for a best-in-class end-to-end CNAPP solution,” Tenable CTO Glen Pendley told SDxCentral in an email. “Together Tenable and Ermetic can dramatically impact our customers’ ability to protect their digital estates and prioritize their teams’ efforts based on real risk to the business.”

In terms of Ermetic’s CIEM capabilities, Pendley added the two companies have a shared view on the importance of identity security in the current threat landscape. “It is necessary to prevent adversaries from elevating entitlements and gaining access to an organization’s most valuable assets. And applying identity context is critical to understanding true risk to the business and prioritizing preventive actions accordingly.”

The Ermetic deal marks Tenable's sixth acquisition since its initial public offering (IPO) in 2018. It bought Indegy for operational technology (OT) security in 2019, Alsid for identity exposure and Accurics for cloud security in 2021, Cymptom for attack path analysis and Bit Discovery for external attack surface management in 2022.

Pendley noted cloud security has been a priority for Tenable for a few years. The vendor acquired cloud-native security startup Accurics for $160 million in cash, aiming to provide customers with a complete lifecycle approach to modern risk management.

“Tenable Cloud Security provides complete visibility into cloud assets and exposure across multicloud environments and the full DevOps lifecycle from cloud to code,” Pendley said. “Tenable Cloud Security is also embedded in the Tenable One Exposure Management Platform.”

“We intend to combine the best technology from Ermetic and our existing Tenable Cloud Security product going forward to maximize value for our customers,” he added.