Distil Networks

Market position

Distil described itself, and was described by Imperva and press coverage, as a global leader in bot detection and mitigation, and was named a leader in The Forrester New Wave: Bot Management, Q3 2018. Forrester analysts argued bot management tools would become the predominant application defense, supplanting web application firewalls. Distil's own leadership acknowledged growing difficulty competing as a standalone point solution against vendors selling broader application security platforms. Named competitors in market intelligence listings include Nisos Group and Netacea; acquirer Imperva competed with F5, Akamai and Radware.

Distil described its approach as proactive verification that legitimate human users were accessing a property rather than reactive blocking, claiming mitigation of 100 percent of OWASP Automated Threats without friction for legitimate users and blocking of 99.9 percent of bad bots without impacting real users. It offered visibility and control over human, good bot and bad bot traffic, dedicated web and API products, and a managed analyst service. Forrester's New Wave: Bot Management, Q3 2018 cited robust detection, response, user interface and reporting, and Imperva characterized Distil as having pioneered bot management with high detection accuracy and low false positives.

Technology

Distil's platform classified incoming traffic as human, good bot or bad bot and applied mitigation policies for web, mobile and API endpoints. Bot Defense for Web verified human traffic on real browsers, while Bot Defense for API prevented automated access to API servers from web or mobile clients. Detection targeted Advanced Persistent Bots that mimic human behavior, load JavaScript and external resources, support cookies, use browser automation and spoof IP addresses and user agents, including attacks distributed across thousands of IP addresses. Imperva said its own high-capacity global network would add scale to Distil, improve detection accuracy and speed mitigation, with the aim of a single-pane-of-glass view of bots and other attacks.

Go-to-market

Distil sold directly to enterprises through global sales and marketing teams, supported by a managed services and support organization, and used published threat research such as its annual Bad Bot reports for market visibility. Proceeds from the 2016 Series C were earmarked for bolstering global marketing and sales, strengthening core offerings and doubling headcount over 12-18 months. The company was listed as a software/tool vendor offering security reviews in the Drupal partner ecosystem and supported a Distil Registration project.

Enterprises with high-value web properties, APIs and mobile applications, particularly in e-commerce, travel, ticketing, media and information services. Named customers included Thomson Reuters, Yelp, Staples, easyJet, StubHub, B&H Photo, Wayfair and Glassdoor, and Amadeus was a joint customer of Distil and Imperva.

Geography

US-based with a dual presence in Arlington, Virginia (registered address 4501 N Fairfax Drive, Suite 200) and San Francisco, California, where the company was headquartered by 2016. It opened an office in London to expand its international reach and served customers globally.

History

Founded in 2011, Distil went through the Techstars program and raised seed capital in 2012 and 2013, followed by a Series B closed in June 2015 and a $21 million Series C announced in August 2016. In the period after the Series B it launched Distil API Security, acquired ScrapeSentry and its analyst team, opened a London office, grew headcount to 140 and passed 100 enterprise customers. Rami Essaid, co-founder, served as CEO and later as chief product and strategy officer; Tiffany Olson Kleemann was CEO at the time of the exit. On June 4, 2019 Imperva announced a definitive agreement to acquire the company, expected to close within about a month, with Distil becoming a wholly-owned Imperva subsidiary.

Risks & controversies

The company faced rapidly evolving adversaries: Distil and Imperva both noted that bot attacks were growing in scale and sophistication, with Advanced Persistent Bots mimicking human behavior, loading JavaScript, supporting cookies, automating browsers and spoofing IP addresses and user agents to evade IP-centric defenses. Commercially, Distil's co-founder cited increasing difficulty sustaining a standalone point solution in a market favoring single-vendor platforms, which motivated the search for a platform partner. Details on integration and the immediate future of Distil's workforce were not disclosed at announcement.