AQUA SECURITY

Dror Davidoff and Amir Jerbi founded Aqua in Tel Aviv in 2015. Jerbi had spent years at CA Technologies working in enterprise security.

Davidoff had executive and startup experience in enterprise software. They looked at what was happening in large organizations: Docker was being adopted everywhere, Kubernetes was just emerging, and nobody had any idea how to secure any of it.

The traditional security tools were built for a world of static servers. They were useless for containers that spun up and died in seconds.

Davidoff and Jerbi built the Container Security Platform to solve that exact problem. The timing was close to perfect — early enough to shape the category, but not so early that there was no market.

Aqua sells to enterprises running serious production workloads on containers and Kubernetes. They sell software licenses and SaaS subscriptions for their platform, which protects containerized applications across the full lifecycle: from the code being written, to the image being built, to the container running in production.

The platform covers vulnerability scanning, misconfiguration detection, runtime threat protection, and cloud security posture management. The more containers you run, the more valuable Aqua becomes — which ties their growth directly to the growth of cloud-native infrastructure across enterprises.

Aqua Platform — the core CNAPP product covering the full lifecycle of containerized applications from development through runtime. Aqua Trivy — the open-source vulnerability scanner, one of the most downloaded container security tools globally.

Aqua DTA (Dynamic Threat Analysis) — sandboxed analysis of container images to detect zero-day threats before they reach production. These tools integrate with CI/CD pipelines, container registries, and Kubernetes clusters, covering the full security picture from code commit through live production.

Two moves drove Aqua's growth. First, they invested heavily in open source.

Their team built and maintained Trivy — a container vulnerability scanner that became one of the most used security tools in DevOps. Trivy has tens of millions of downloads.

It is not a commercial product. It is a community tool that puts Aqua's name in front of every developer who cares about container security.

From there, selling the enterprise version is a natural next conversation. Second, they expanded from container security to CNAPP — cloud-native application protection — a broader category covering serverless, cloud infrastructure, and code-to-cloud.

That expansion significantly grew their addressable market.

The cloud-native security market got crowded fast. In 2015, the category was essentially Aqua's to define.

By 2020, Palo Alto Networks, CrowdStrike, and a dozen pure-play startups were all competing for the same enterprise security budgets. The trend toward platform consolidation made things harder: enterprises stopped buying 15 separate security tools and started demanding one integrated platform.

Aqua had to evolve from a point product into a platform while simultaneously defending against competitors with much larger sales forces and balance sheets. They have managed it, but the fight is ongoing and the competitive pressure is structural.

Aqua has raised from a strong mix of strategic and financial investors. TLV Partners backed the company from its earliest stage.

Microsoft's venture fund M12 led the Series B alongside Greenspring Associates. Lightspeed Venture Partners came in for Series C.

ION Crossover Partners led the $135 million Series E in 2021 at the $1 billion valuation that made Aqua a unicorn. The breadth of investors — spanning Israeli VC, US corporate venture, and growth equity — reflects how seriously the enterprise security market takes cloud-native protection.