Identity protection provider Aura raises $200M at a $2.5B valuation

Burlington, Massachusetts-based identity protection company Aura today announced it raised $200 million at a $2.5 billion post-money valuation, bringing its total sum raised to $650 million. CEO Hari Ravichandran said that the funds will be put toward expanding the company’s workforce and investing in product R&D as Aura grows its sales team.

In 2019, 14.4 million consumers — about 1 in 15 people — were victims of identity fraud. And as the world became increasingly digital during the pandemic, fraud accelerated. According to Javelin Strategy & Research, the total loss caused by identity scams and frauds reached $56 billion in 2020. That’s led to a growth of $3.2 billion for the identity theft protection services industry in 2021 alone.

Aura was founded in 2019 by Ravichandran, who previously started cloud service provider Endurance and venture investment firm Jump Ventures. Ravichandran himself was the victim of credit theft in 2014, which sowed the seeds of Aura’s identity theft protection and monitoring services.

“I was inspired to start Aura to create a simple, all-in-one digital security solution that protects individuals from cybercrime. As a result, we’ve built a tool that is gaining interest from chief information officers and chief information security officers, as it provides a solution for employers to provide access to a tool that protects employees’ personal information, without stretching the domain of corporate enterprise security into our private lives,” Ravichandran told VentureBeat via email. “The pandemic pushed thousands of employees to remote work and fundamentally changed the enterprise security landscape. [The new threats] will not go away as workers return to the office. We’ve seen expanded interest in conversations around the role of cross-device and network security in our daily lives.”

Monitoring  and recovery services

Some security experts aren’t bullish on identity protection services, calling them unnecessary. In a comprehensive report, The Wirecutter concluded that these services are more about monitoring or addressing identity theft as opposed to preventing it and that most of the features they offer are tasks people can do themselves for free — as long as they’re willing to put in the time.

“Identity theft isn’t something you can always protect against, at least not with a paid service package. In fact, in 2015, LifeLock settled a lawsuit with the FTC about misleading customers in this way,” The Wirecutter wrote. “When you dig through the fine print for these services, you’ll often find statements like ‘No one can prevent all identity theft.’ It’s best to think of them as monitoring and recovery services.”

Against this tempering backdrop, Aura, which claims to have resolved more than 150,000 fraud alerts for upwards of two million customers, scans for and stores personal info, accounts, IDs, and more. It lets users know if their online accounts, passwords, or personal information are compromised, alerting them to new inquiries on their credit files, credit cards, loans, wire transfers, and bank account openings.

“Aura is innovating in the consumer cybersecurity landscape that hasn’t seen innovation in more than a decade. These legacy players — like Norton and McAfee — have products that are built upon point solutions that have been bolted together into products. Their apps are difficult to navigate and tend to be very expensive and incomplete,” Ravichandran said. “Prior to Aura, a user would need to subscribe to six different services, totaling around $80 a month in subscription fees, to achieve complete protection across devices.”

Once customers link their bank accounts to Aura, the platform looks over their finances for suspicious activity. It also provides a monthly and annual credit score report from major credit bureaus, as well as an easy way to lock and unlock Experian credit files.

Aura alerts users if it finds their information in criminal or court records. Beyond this, it offers antivirus software that protects against malware, viruses, ransomware, and Trojans and also secures internet connections with a virtual private network (VPN) that blocks scam and phishing sites.

“The technologies that we integrated to build Aura have been in the market for many years. Through these products, we have a very large pool of behavioral data that informs our knowledge of how consumers operate online,” Ravichandran said. “We’ve pulled that data into models that are powered by AI and machine learning, which enable us to analyze user traffic in near real time and determine whether the activity is safe or at risk.”

Last year, Aura acquired Pango, which offered a digital privacy and security subscription service that was generating over $200 million in revenue. That came after Aura’s purchases of FigLeaf and PrivacyMate. FigLeaf enabled users to anonymize their data, while PrivacyMate monitored for and aimed to prevent the collection and sale of private personal information.

Aura’s workforce currently stands at 200 employees. It expects to have more than 1,000 by the end of the year, with plans for further growth in 2022.

“A little over a decade ago, the focus of enterprise security was on securing the perimeter … [N]ow, the individual employee is the last endpoint left unsecured,” Ravichandran said. “To date, enterprises have put an overwhelming amount of responsibility in their employees’ hands. And the truth is that the threat landscape evolves so quickly that we’re unlikely to ever reach a point where every employee is educated enough about security risks that they can efficiently protect themselves — and their employers — online. From our view, the only realistic way to solve this problem is to protect users from themselves, and we’re seeing a lot of interest in exploring this solution.”

Madrone Capital Partners led the series F round with participation from TenEleven Ventures, General Catalyst, WndrCo, Warburg Pincus, and Accel.