Illusive

Illusive, based in New York City, New York, develops identity threat detection and response (ITDR) technology, evolving from its initial focus on deception-based cybersecurity. Its platform is designed to discover exploitable credentials, block lateral movement, and provide forensic intelligence for remediation, helping global enterprises detect and disrupt advanced persistent threats. Serving over 120 industry-leading companies, Illusive raised over $30 million in funding from prominent investors including Team8, NEA, Bessemer Venture Partners, and Microsoft Ventures. The company, which employed approximately 100 individuals, also had Nadav Zafrir as Chairman. Illusive was later acquired by Proofpoint, a Thoma Bravo portfolio company. It was founded in 2014 by Ofer Israeli. Its business model centers on venture-backed private company that sold to Proofpoint, previously generated revenue through sales of its ITDR platform to enterprises.

Illusive (now operating as Proofpoint Identity Threat Defense) is a cybersecurity company that built an *agentless identity threat detection and deception platform* which discovers and eliminates exploitable credentials and lateral‑movement pathways, then deploys high‑fidelity deceptions to detect and gather forensics on attackers[5][1]. Illusive’s technology targets privileged‑identity and post‑breach lateral movement risk for large enterprises across finance, retail, healthcare and other regulated sectors, and the product has been positioned as an identity‑focused complement to PAM and MFA controls[2][4][5].

High‑Level Overview

• Mission: Illusive’s mission was to eliminate exploitable identities and stop attacker lateral movement by continuously discovering identity risk, automatically mitigating vulnerable credentials/connections, and deploying deception as compensating controls[2][1].
  - Investment philosophy / Key sectors / Impact on the startup ecosystem (not applicable): Illusive is a portfolio company/startup rather than an investment firm; it focused on cybersecurity for large enterprises—financial services, retail, pharmaceuticals, healthcare, energy and law firms—and influenced the deception and identity‑threat sectors rather than acting as an investor[2][3][4].
  - Product, customers, problem solved, growth momentum (portfolio company view): Illusive built an *Active Defense Suite* composed of an Attack Surface Manager (automated hygiene to remove risky credentials and connections), an Attack Detection System (agentless deception to produce high‑fidelity alerts), and an Attack Intelligence System (rich forensics from high‑interaction decoys)[4][2]. It served Fortune 100 and other large enterprises that needed to detect and stop post‑breach lateral movement and identity exploitation[3][1]. The company reported broad enterprise deployments, participation in many red‑team exercises (reporting never losing in >130 exercises), and was acquired/integrated into Proofpoint to become Proofpoint Identity Threat Defense, indicating meaningful commercial traction and strategic exit momentum[3][2][5].

Origin Story

• Founding year and founders: Illusive was founded around 2014–2015 out of the Team8 cybersecurity foundry and was led by Israeli cybersecurity veterans including founder Ofer Israeli and a research/R&D team with backgrounds in Unit 8200 and nation‑state level operations[2][3].
  - How the idea emerged: Founders who had worked on offensive nation‑state techniques translated attacker tradecraft into defensive technology—mapping how attackers view networks (Attacker View™) and then removing or replacing the exploitable artifacts attackers rely on, plus embedding deceptions to catch them in‑flight[3][2].
  - Early traction / pivotal moments: Early recognition included Gartner Cool Vendor (2015) and RSA Innovation Sandbox finalist placements, rapid adoption by large financial and enterprise customers, more than 130 red‑team engagements with claimed undefeated results, and eventual acquisition/integration by Proofpoint, which rebranded Illusive as Proofpoint Identity Threat Defense[6][3][2][5].

Core Differentiators

• Agentless discovery and remediation: Scans Active Directory, PAM configurations, endpoints and servers without needing agents to find unmanaged or exposed identities and connections, then provides prioritized remediation[2][4].
  - Identity‑first, deception‑driven approach: Focuses on eliminating the *identity* attack surface and uses realistic credential/data deceptions as compensating controls to produce high‑fidelity alerts when adversaries engage[2][4].
  - Attacker View™ and attack‑path mapping: Visualizes the network from an attacker’s perspective to reveal attack paths that conventional tooling misses[4][6].
  - High‑fidelity forensics and automated mitigation: When deceptions are tripped, the platform collects deterministic evidence of attacker behavior and enables faster incident response[2][4].
  - Team and provenance: R&D and leadership from Israeli cyber talent including former IDF Unit 8200 members and founders with offensive expertise—positioning the product as built by people who “think like attackers”[2][3].

Role in the Broader Tech Landscape

• Trend leveraged: Illusive rode two converging trends—the shift of sophisticated adversaries to post‑breach lateral movement and identity‑centric attack chains, and growing interest in deception technologies as a detection strategy for in‑flight intrusions[1][4].
  - Why timing mattered: As enterprises deployed PAM and MFA, attackers increasingly exploited misconfigured or unmanaged credentials and living‑off‑the‑land techniques, creating demand for tools that discover identity exposures and detect lateral movement without adding heavy endpoint agents[2][5].
  - Market forces in its favor: Rising ransomware, supply‑chain and nation‑state threats increased enterprise security spend on detection and incident response; regulators and boards prioritized identity risk, benefitting vendors that offered demonstrable forensic evidence and reduced dwell time[1][5].
  - Influence: Illusive helped mainstream identity threat detection and elevated deception as an operational control, influencing both product roadmaps at larger security vendors and buying criteria at enterprise CISOs[3][6].

Quick Take & Future Outlook

• Near term for the product/brand: Illusive’s integration into Proofpoint as Proofpoint Identity Threat Defense positions its identity and deception capabilities to be bundled with broader email, cloud and threat protection suites, which should accelerate enterprise reach and cross‑sell into Proofpoint’s customer base[5].
  - Trends that will shape the journey: Continued prioritization of identity security, integration between threat detection and identity governance/PAM, and the need for deterministic forensics will keep demand for identity‑focused deception tools strong[2][5].
  - How influence may evolve: If tightly integrated with a large security portfolio, Illusive’s techniques could become a standard compensating control for identity risk—shifting deception from niche to mainstream and prompting more automated, cross‑layer deception and remediation workflows across cloud, endpoint and directory services[5][4].

Quick take: Illusive carved a distinct niche by combining identity discovery, remediation and deception‑based detection into an agentless platform; its acquisition by Proofpoint signals its approach will scale within larger security suites and further normalize identity‑centered active defense for enterprises[2][5].