Wombat Security Technologies

About Wombat Security Technologies

Wombat Security Technologies emerged from pioneering cybersecurity research at Carnegie Mellon University (CMU), establishing itself as a specialized provider of security awareness training. The company was founded in June 2008 by three CMU faculty members: Dr. Norman Sadeh, Dr. Lorrie Faith Cranor, and Dr. Jason Hong. Their collective academic background, rooted in computer science, human-computer interaction, privacy, and security, was foundational to the company's approach, which focuses on the human element of cybersecurity. The founders leveraged research from a significant national project on combating phishing attacks, funded by the National Science Foundation and the Department of Defense, to create their core technologies.

The firm's business centers on a software-as-a-service (SaaS) Security Education Platform designed to mitigate security risks by changing employee behavior. This is achieved through a Continuous Training Methodology that involves four key stages: assessing employee knowledge, educating them with interactive modules, reinforcing best practices, and measuring behavioral change. The platform provides tools for creating simulated phishing, smishing (SMS phishing), and USB-based attacks to diagnose vulnerabilities. Its educational content consists of a library of interactive training modules and reinforcement materials like articles and posters. Wombat's revenue model was based on selling these training and simulation capabilities, often priced per user, to corporate clients. The company served a diverse client base, including Fortune 1000 and Global 2000 companies across sectors like finance, banking, technology, and retail.

A significant milestone in the company's history was its acquisition by Proofpoint, Inc. in March 2018 for approximately $225 million in cash. This event marked the integration of Wombat's training solutions into Proofpoint's broader suite of cybersecurity products, which include advanced threat protection and email security. The acquisition aimed to create a solution that combined threat detection with security awareness education, allowing organizations to use data from real phishing campaigns to inform their employee training simulations. Following the acquisition, the Wombat Security brand was transitioned to Proofpoint Security Awareness Training, continuing its mission under the new parent company.