Aorato

Aorato was an Israeli enterprise cybersecurity company that built a context-aware, behaviour-based Directory Services Application Firewall (DAF) for Microsoft Active Directory environments. The product observed network traffic between Active Directory servers and network entities such as users and devices, profiled and learned the behaviour of those entities, and flagged anomalies that could indicate attacks or security-policy violations, including cleartext or simple passwords, Active Directory protocol violations, and activity from deleted or disabled users and computers. Detected suspicious events were assembled into an Attack Timeline intended to let security teams reconstruct the stages of an attack chain from individually innocuous events.

The company emerged from stealth in January 2014 with a product aimed squarely at Microsoft-centric enterprises, positioning Active Directory — described in coverage as used by roughly 95% of organisations — as a starting point, with the intention of extending coverage to other systems over time. Its stated use cases included detecting misuse of legitimate employee credentials, such as repeated password-guessing attempts and insider access using colleagues' credentials. Aorato researchers also published Active Directory vulnerability findings, including a flaw allowing a targeted user's password to be changed and a finding that disabled accounts could remain valid for up to 10 hours after revocation.

Microsoft announced its acquisition of Aorato on 13 November 2014, citing the Organizational Security Graph and machine-learning-based anomaly detection as complements to its Azure Active Directory identity and access management capabilities. Financial terms were not disclosed by the parties; press reports citing sources close to the deal placed it in the region of $200 million. Following the acquisition Aorato ceased selling the DAF product.

Founding story

The founders came out of the Cyber Security unit of the Israeli Defense Forces and had spent the prior decade in cybersecurity, previously co-founding and running Foreity, a Microsoft security subcontractor acquired by an IT services firm, and holding Microsoft MVP awards for enterprise security. The founding premise was that Active Directory is exposed by default and by design, creating a blind spot the company set out to cover.

Traction

At its January 2014 launch the company stated it had several enterprise customers.

Latest developments

Microsoft acquired Aorato in November 2014 and said the technology would complement capabilities developed for Azure Active Directory; Aorato said it would cease selling the DAF product and would share more on the future direction and packaging of the capabilities later.