IBM Buys Polar Security to Find and Protect Cloud, SaaS Data

IBM has purchased a startup founded by a longtime security leader in the Israeli Prime Minister’s Office to ensure personal identifiable information isn’t left unprotected.

See Also: Live Webinar | Education Cybersecurity Best Practices: Devices, Ransomware, Budgets and Resources

The Armonk, New York-based technology giant said its acquisition of Tel Aviv, Israel-based Polar Security will help organizations avoid exposing sensitive data in public cloud data stores or popular SaaS apps such as Slack, SharePoint and Office 365, said IBM Security Director of Product Management Eric Maass. He said Polar excels at visualizing vulnerabilities to customers in a way that’s synergistic with IBM’s portfolio.

“We knew that we had to make a move in this space,” Maass told Information Security Media Group. “Doing something inorganically just made sense in terms of time to market.”

From the Prime Minister’s Office to Big Blue

Polar Security emerged from stealth in January 2022, raised $8.5 million in seed funding and employs 30 people, 24 of whom are based in Israel, according to IT-Harvest. Terms of the deal weren’t disclosed, but TechCrunch reported that IBM paid $60 million for Polar. IT-Harvest estimates that Polar has yearly sales of $6.4 million – or $210,000 per employee – and a valuation between $9 million and $13 million (see: Why Datadog and Rubrik Are in Talks to Buy Laminar for $200M).

The company was founded by Guy Shanny – who spent more than a decade as a security researcher at the Israeli Prime Minister’s Office – and Roey Yaacovi, who served as a software engineer at both Check Point and the Israeli Prime Minister’s Office. Maass said the acquisition closed late last week, and all of Polar’s employees joined IBM.

“DSPM, while very hot in its current form, will need to fold into bigger data security platforms.”


– Eric Maass, director of product management, IBM Security

Maass praised Polar for its ability to discover and pull back sensitive data that a user or department put into a cloud data store or SaaS application without notifying anyone. The technology can contrast actual ways an organization’s data has been accessed in a data store or SaaS app with potential paths a hacker could take to reach that same data and provide a side-by-side visualization for customers, Maass said.

IBM plans to incorporate Polar’s technology alongside its Guardium Insights product, which focuses on data auditing and compliance in the hybrid cloud landscape, such as what SQL commands can be found in data stores, Maass said. Polar’s expertise around data security posture management will complement investments IBM has already made around analytics and data monitoring as part of a broader platform.

“DSPM, while very hot in its current form, will need to fold into bigger data security platforms to be digestible to customers,” Maass said.

Expanding Data Protection Outside the Large Enterprise

Guardium currently audits and inspects activity taking place in a data store and bubbles up risk scores and telemetry into the security operations center so that SOC analysts can take action, Maass said. But in order to address data lineage, find over-entitled Amazon S3 buckets and discover which departments have been pushing sensitive data into Office 365 or Slack, Maass said Polar’s technology is needed.

Guardium up until now has focused on larger enterprises in verticals such as healthcare, retail, financial services and banking, but Maass said Polar’s technology will appeal to more industries as well as smaller companies that are cloud-native or cloud-first since they’re still on the hook for guarding corporate data. Polar will be offered as a chargeable feature within Guardium as well as on a stand-alone basis, he said.

From a metrics perspective, Maass said, IBM plans to track customer adoption of Polar and ensure the value proposition of the data security posture management technology is resonating with customers. IBM wants to help consolidate data activity monitoring, data leakage prevention and encryption management into a unified data security platform to reduce the management burden for customers (see: IBM Buys Startup Databand.ai to Address Data Quality Issues).

“It’s a really interesting space, and a space where CISOs are going to find immediate value,” Maass said.