2020 Tibbetts Award Winner

Red Balloon Security

As our world becomes increasingly connected & automated, each additional embedded device becomes a potential attack surface for threats. Red Balloon Security provides security allowing society to benefit from connected infrastructure - while substantially reducing the risks of doing so.

Impact & Achievements

As our world becomes increasingly connected and automated, each additional embedded device becomes a potential attack surface for threat actors. Red Balloon technology solutions are designed to provide the fundamental layer of security to these devices that allows our society to reap the benefits of “smart” connected infrastructure while substantially reducing the risk of doing so.

While building high-frequency trading networks for financial institutions, Dr. Ang Cui realized the vulnerability of the embedded devices upon which our most critical cyber infrastructure (such as that of our entire financial system) is built. This realization drove Dr. Cui to begin developing a universal embedded security solution as his doctoral thesis at Columbia University. While Columbia’s Intrusion Detection Lab was focused on probabilistic, network-monitoring detection methods, Dr. Cui worked on a unique approach: securing the device from within. Dr. Cui’s work attracted the attention of the U.S. Government, specifically that of the Department of Homeland Security (DHS) – this funding was the catalyst that turned an academic research paper into a tangible reality.

As our world becomes increasingly connected and automated, each additional embedded device becomes a potential attack surface for threat actors. Red Balloon technology solutions are designed to provide the fundamental layer of security to these devices that allows our society to reap the benefits of “smart” connected infrastructure while substantially reducing the risk of doing so. New York City-based Red Balloon Security, founded in 2011, is a leading security provider and research firm for embedded devices. Its pioneering R&D is led by a team of world-class academic researchers and developers.

Developed through Small Business Innovation Research (SBIR) funding provided by the DHS Science and Technology (S&T) Directorate and other government and private-sector funding, Red Balloon Security’s flagship product, Symbiote, is the first universal embedded defense that keeps embedded devices safe against a wide variety of attacks. Symbiote is designed to protect any and all embedded devices, from printers to programmable logic controllers. It can be applied to any device regardless of operating system, central processing unit type, or hardware. It is injected into the firmware in a randomized fashion, and operates alongside the host program during runtime to continuously ensure that the code and data of the host device is untampered and never modified without permission. Symbiote Defense has been a tremendous success and is commercially deployed on more than 4 million endpoints with more than 100 billion hours of runtime without a single failure. Follow-on funding facilitated further integrations on embedded devices spanning commercial verticals including industrial control, building automation, networking equipment, automotive, defense, and aerospace. Symbiote’s success recently culminated in $21.9 million Series A financing and an SBIR Phase III award to integrate Symbiote into building automation controllers at the DHS Plum Island Animal Disease Center.

SBIR funding provided by DHS S&T was instrumental in the development of Symbiote Defense, especially after the R&D project moved from its genesis at Columbia University’s Intrusion Detection Systems Lab – without this essential SBIR funding, Symbiote’s development and transition to the embedded security market either would not have occurred or been seriously hampered. The solution has propelled Red Balloon Security to become a leading security provider and research firm for embedded devices.