Security

Riot prepares your team against highly sophisticated cyberattacks

Comment

Riot's virtual teacher Albert and a message that says "Your account has been suspended"
Image Credits: Riot

French startup Riot has raised a $12 million Series A round to iterate on its all-in-one cybersecurity awareness platform for businesses and their employees. The startup originally focused on fake phishing campaigns. It now also offers customized educational content that can help grow the cybersecurity culture in your team.

While it is still quite difficult to raise a funding round in the current economic environment, Riot managed to put together an interesting list of investors. Base10, a San Francisco-based VC firm that previously invested in flagship startup names like Figma, Notion and CircleCI, led today’s funding round.

Some angels with a technical and operational background also invested in the round, such as Snyk’s founder Guy Podjarny, Duolingo’s co-founder Severin Hacker, Supercell’s co-founder Ilkka Paananen, Deel’s co-founder Alex Bouaziz and Slack’s CPO Tamar Yehoshua. Some of Riot’s existing investors also put more money on the table, such as Y Combinator, Funders Club and Founders Future.

And the reason why these investors lined up to participate in the round is that cybersecurity has never been such a topical issue. At TechCrunch, we cover a fair share of ransomware campaigns, SIM swaps to access user accounts and database leaks with sensitive data like credit card information.

But it feels like things are accelerating. Attacks are becoming more sophisticated and more prevalent. A couple of years ago, CEO fraud was still relatively new. Now, even small companies are targeted with elaborate campaigns.

For instance, I recently heard about a chief accountant who received an email from an important supplier saying that the bank account had changed. The email looked real because it was real — the supplier’s email account had been compromised and there were some outstanding invoices. The bank account didn’t belong to the supplier though.

As I wrote in my first article on Riot, your company’s security is as strong as your least careful employee. A data breach usually starts with a poorly secured internal account with two-factor authentication turned off. Everybody could now potentially receive phony emails, phones calls, text messages and administrative letters that look just like the real thing.

Building a modern educational product

If you work for a big company with important regulatory requirements, chances are you regularly receive mandatory training videos with quick quizzes at the end. Many people play these videos in the background and do something else. They barely pay attention to the content of the videos.

Riot’s main interface is a chatbot called Albert. It is available on Slack, Microsoft Teams or through a web interface. Each course is interactive and the content changes dynamically depending on each employee’s cybersecurity knowledge.

“I read a study from the 1980s and they were looking at the effectiveness of each teaching method,” Riot founder and CEO Benjamin Netter told me. “With one-to-one relationships, when you teach someone individually, the student is better than a student who attends normal classes in 98% of cases. We can’t have a teacher per student at scale, but we try to create these one-to-one relationships.”

For example, instead of giving a general definition of a data breach, Riot starts by telling you that your email address can be found in five different data breaches. When the company then tells you what it means, you are more likely to pay attention and reach the end of the training. Admins can then track the progress of their teams.

This is just one example, but Riot could also encourage employees to activate two-factor authentication on important services. Many hackers also rely on LinkedIn data to find out who you are working with and send a message using some co-worker’s name.

That’s why Riot can encourage your team members to change their privacy settings in order to proactively prevent cybersecurity threats. And many companies have already realized that LinkedIn profiles are used in social engineering attacks. In the company’s handbook for new employees, cryptocurrency exchange Kraken tells their employees that they shouldn’t update their LinkedIn profile to say that they work for Kraken.

Using AI to fight AI

Riot recently passed the $2 million milestone in annual recurring revenue. Overall, Riot reaches 100,000 employees across its clients, like Y Combinator, Deel, Intercom and Le Monde. But the startup thinks cybersecurity is going to change drastically in the coming years and modern attacks are just getting started.

“This year, our big move will be AI. When I say that, I’m a bit annoyed as people think we are following trends. But we’ve been tracking AI for a while,” Netter said.

Large language models like GPT-3 or speech recognition models like Whisper are going to change the nature of cybersecurity threats. “AI is going to have a huge impact on hacking and social engineering. Tone has always been the issue with phishing emails. But AI is going to solve these tone issues,” Netter said.

Even beyond classic phishing emails, it’s going to become easier to conduct sophisticated campaigns at scale. For instance, with speech-to-text, GPT-3 and text-to-speech APIs, hackers could greatly increase the number and quality of phone-based attacks. Or maybe they could use voice messages so that their messages are more credible.

As hackers are upping their game, Riot also wants to improve its product. Dialogue-based language models like ChatGPT unlock new opportunities. That’s why Riot is already testing free-form courses with Albert, its virtual cybersecurity pal. Instead of selecting answers in a drop-down menu or sending simple queries, Riot users will soon write long messages to Albert directly.

Recently, the startup created a fun internal experiment that it doesn’t plan to release publicly. “It’s a training that asks you to put yourself in the shoes of a hacker and you have to get Albert’s credit card information,” Netter said. While that might be a bit too controversial for Riot’s customers, the same technology will make the company’s simulated attacks a lot more sophisticated — and it’s a promising roadmap.

More TechCrunch

Meta is updating its Ray-Ban smart glasses with new hands-free functionality, the company announced on Wednesday. Most notably, users can now share an image from their smart glasses directly to…

Meta’s Ray-Ban smart glasses now let you share images directly to your Instagram Story

Spotify launched its own font, the company announced on Wednesday. The music streaming service hopes that its new typeface, “Spotify Mix,” will help Spotify distinguish its own unique visual identity. …

Why Spotify is launching its own font, Spotify Mix

In 2008, Marty Kagan, who’d previously worked at Cisco and Akamai, co-founded Cedexis, a (now-Cisco-owned) firm developing observability tech for content delivery networks. Fellow Cisco veteran Hasan Alayli joined Kagan…

Hydrolix seeks to make storing log data faster and cheaper

A dodgy email containing a link that looks “legit” but is actually malicious remains one of the most dangerous, yet successful, tricks in a cyber criminal’s handbook. Now, an AI…

Bolster, creator of the CheckPhish phishing tracker, raises $14M led by Microsoft’s M12

If you’ve been looking forward to seeing Boeing’s Starliner capsule carry two astronauts to the International Space Station for the first time, you’ll have to wait a bit longer. The…

Boeing, NASA indefinitely delay crewed Starliner launch

TikTok is the latest tech company to incorporate generative AI into its ads business, as the company announced on Tuesday that it’s launching a new “TikTok Symphony” AI suite for…

TikTok turns to generative AI to boost its ads business

Gone are the days when space and defense were considered fundamentally antithetical to venture investment. Now, the country’s largest venture capital firms are throwing larger portions of their money behind…

Space VC closes $20M Fund II to back frontier tech founders from day zero

These days every company is trying to figure out if their large language models are compliant with whatever rules they deem important, and with legal or regulatory requirements. If you’re…

Patronus AI is off to a magical start as LLM governance tool gains traction

Link-in-bio startup Linktree has crossed 50 million users and is rolling out the beta of its social commerce program.

Linktree surpasses 50M users, rolls out its social commerce program to more creators

For a $5.99 per month, immigrants have a bank account and debit card with fee-free international money transfers and discounted international calling.

Immigrant banking platform Majority secures $20M following 3x revenue growth

When developers have a particular job that AI can solve, it’s not typically as simple as just pointing an LLM at the data. There are other considerations such as cost,…

Unify helps developers find the best LLM for the job

Response time is Aerodome’s immediate value prop for potential clients.

Aerodome is sending drones to the scene of the crime

Granola takes a more collaborative approach to working with AI.

Granola debuts an AI notepad for meetings

DeepL, which builds automated text translation and writing tools, has raised a $300 million round led by Index Ventures.

AI language translation startup DeepL nabs $300M on a $2B valuation to focus on B2B growth

Praktika has secured a $35.5M Series A round to apply AI-powered avatars to language-learning apps.

Praktika raises $35.5M to use AI avatars to make learning languages feel more natural

Humane, the company behind the hyped Ai Pin that launched to less-than-glowing reviews last month, is reportedly on the hunt for a buyer.

Humane, the creator of the $700 Ai Pin, is reportedly seeking a buyer

India’s Oyo, once valued at $10 billion, has withdrawn its IPO application from the market regulator for the second time.

Oyo, once valued at $10 billion, shelves IPO plans for second time

Where Aytac Yilmaz lives in the Netherlands, the sun might not appear for days on end, which can really crimp the output of the country’s solar panels. Wind turbines might…

Ore Energy emerges from stealth to build utility-scale batteries that last days, not hours

Paytm, a leading financial services firm in India, said its net loss widened in the fourth quarter as it grappled with a regulatory clampdown.

Paytm warns of job cuts as losses swell after RBI clampdown

Government officials and AI industry executives agreed on Tuesday to apply elementary safety measures in the fast-moving field and establish an international safety research network. Nearly six months after the…

In Seoul summit, heads of states and companies commit to AI safety

Copilot, Microsoft’s brand of generative AI, will soon be far more deeply integrated into the Windows 11 experience.

Microsoft wants to make Windows an AI operating system, launches Copilot+ PCs

Some startups choose to bootstrap from the beginning while others find themselves forced into self funding by a lack of investor interest or a business model that doesn’t fit traditional…

VCs wanted FarmboxRx to become a meal kit, the company bootstrapped instead

Uber and Lyft drivers in Minnesota will see higher pay thanks to a deal between the state and the country’s two largest ride-hailing companies. The upshot: a new law that…

Uber’s and Lyft’s ride-hailing deal with Minnesota comes at a cost

Andreessen Horowitz’s American Dynamism fund has established a new fellowship program aimed at introducing top engineers and technologists to venture investing, a move that could help the firm identify less…

a16z’s American Dynamism team launches program to introduce technical minds to VC

Another fintech startup, and its customers, has been gravely impacted by the implosion of banking-as-a-service startup Synapse. Copper Banking, a digital banking service aimed at teens, notified its customers on…

Teen fintech Copper had to abruptly discontinue its banking, debit products

Autodesk — the 3D tools behemoth — has acquired Wonder Dynamics, a startup that lets creators quickly and easily make complex characters and visual effects using AI-powered image analysis. The…

Autodesk acquires AI-powered VFX startup Wonder Dynamics

Farcaster, a blockchain-based social protocol founded by two Coinbase alumni, announced on Tuesday that it closed a $150 million fundraise. Led by Paradigm, the platform also raised money from a16z…

Farcaster, a crypto-based social network, raised $150M with just 80K daily users

Microsoft announced on Tuesday during its annual Build conference that it’s bringing “Windows Volumetric Apps” to Meta Quest headsets. The partnership will allow Microsoft to bring Windows 365 and local…

Microsoft’s new ‘Volumetric Apps’ for Quest headsets extend Windows apps into the 3D space

The spam reached Bluesky by first crossing over two other decentralized networks: Mastodon and Nostr.

The ‘vote Trump’ spam that hit Bluesky in May came from decentralized rival Nostr

Welcome to TechCrunch Fintech! This week, we’re looking at the continued fallout from Synapse’s bankruptcy, how Layer wants to disrupt SMB accounting, and much more! To get a roundup of…

There’s a real appetite for a fintech alternative to QuickBooks