Full-Time
Posted on 10/3/2025
XDR security platform for threat detection
$160k - $190k/yr
Austin, TX, USA + 1 more
More locations: Chicago, IL, USA
Hybrid
Hybrid work model; on-site days not specified.
| , , |
Trellix provides an extended detection and response (XDR) platform that integrates endpoint, network, and cloud security into a single system. The platform works by using Generative AI and threat intelligence to help security teams detect and respond to cyberattacks across their entire digital infrastructure. Unlike many competitors that offer isolated security tools, Trellix uses an "open" architecture that allows its software to connect with a wide variety of third-party applications and hardware. The company's goal is to provide organizations with a unified, automated defense system that simplifies how they manage and resolve complex security threats.
Company Size
1,001-5,000
Company Stage
Growth Equity (Venture Capital)
Total Funding
$435M
Headquarters
Plano, Texas
Founded
2021
Help us improve and share your feedback! Did you find this helpful?
Health Insurance
Dental Insurance
Vision Insurance
401(k) Retirement Plan
Paid Vacation
Paid Parental Leave
Flexible Work Hours
Analyzing the Trellix breach: mitigating vendor source code breach implications in global supply chains. The Trellix breach is a critical warning for global businesses. Learn about the severe vendor source code breach implications and implement actionable strategies to secure your entire software supply chain against third-party risks. The news of a significant source code repository breach at cybersecurity firm Trellix serves as more than just a headline; it is a profound warning signal to the global business community. For organizations that rely heavily on sophisticated, third-party software,from cloud infrastructure to proprietary AI tools,the potential attack surface has expanded far beyond the company's own perimeter. TL;DR: A source code breach at a major vendor like Trellix underscores that even industry leaders are vulnerable to supply chain attacks. The primary risk is not just data theft, but the potential for malicious backdoors or compromised updates being delivered directly into your operational environment. Immediate action requires rigorous third-party vendor security assessment and implementing zero-trust principles across all connected systems. Understanding vendor source code breach implications. When a company like Trellix reports unauthorized access to its source code repository, the immediate fear is that their intellectual property has been compromised. However, for international businesses, the concern runs deeper than IP theft; it speaks directly to vendor source code breach implications across your entire operational ecosystem. Source code is the blueprint of a product. If an attacker gains access, they can potentially identify logical flaws, backdoors, or even harvest details about how the software integrates with other systems,details that are far more valuable than simple customer data. This elevates the risk from a mere security incident to a critical supply chain cybersecurity risks event. Why does vendor code matter so much? Most modern enterprises do not build every piece of software internally. They consume it. Whether you use SaaS platforms, integrated cloud services, or specialized AI models provided by external vendors, your digital life is built on third-party code. If the foundation (the vendor) is compromised, the entire structure is at risk. The key challenge for IT managers today is moving beyond perimeter defense and addressing systemic trust gaps. This requires a shift in focus from simply auditing compliance reports to actively verifying security posture and validating secure code repositories in enterprise environments. Software supply chain attack mitigation strategies. Mitigating risk when dealing with massive, interconnected software ecosystems demands proactive governance. Here are the critical areas international businesses must address immediately: * Dependency Mapping: Do not assume you know every piece of code running in your environment. Map out all third-party libraries and services to identify single points of failure. * Code Validation Protocols: Implement continuous validation that goes beyond simple patch management. This involves testing updates against known attack vectors and ensuring the integrity of the deployment pipeline itself. * Segmentation and Isolation (Zero Trust): Adopt a zero-trust architecture where no vendor, internal or external, is implicitly trusted simply because they are connected to the network. Access must be granted on a least-privilege basis. The critical role of third-party vendor security assessment. A robust third-party vendor security assessment cannot be completed with a simple annual questionnaire. To properly assess the risk, organizations must perform deep cybersecurity due diligence that includes: * Reviewing the vendor's incident response plan and their history of breaches. * Verifying their controls for secrets management (e.g., API keys, access tokens). * Asking pointed questions about their development lifecycle security (DevSecOps) practices, specifically how they handle code repository access and employee offboarding. Security risk is not limited to the IT department. Understanding operational vulnerabilities helps build resilience across the entire organization. Cybersecurity tips. Implement mandatory Multi-Factor Authentication (MFA) for all vendor portals and critical services. Regularly audit API keys, treating them as highly sensitive credentials that must be rotated frequently. Business technology tips. Establish clear contractual clauses with vendors regarding breach notification timelines and liability in the event of a supply chain attack. This formalizes accountability when disaster strikes. AI tips. When adopting AI solutions, prioritize tools that offer explainability (XAI) and robust data lineage tracking. Never feed proprietary or highly sensitive internal code into an unvetted third-party model without strict contractual controls. Entivel perspective: turning this into safer growth. The Trellix incident illustrates a fundamental truth of modern business: security is no longer a standalone function; it is a core component of business resilience. For international companies looking to accelerate digital transformation through automation and AI, the risk associated with vendor dependencies must be managed proactively. At Entivel, Entivel Pty specialize in bridging this gap by embedding advanced cybersecurity measures directly into your software development life cycle (SDLC). Its approach focuses on: * Secure Code Integration: Ensuring that any new automation or AI module built using third-party components is validated and hardened against supply chain risks. * Automated Risk Monitoring: Using advanced monitoring tools to continuously assess the security posture of your connected cloud services, providing real-time alerts when a vendor's known vulnerability could impact your operations. * Digital Resilience Planning: Moving beyond compliance checklists to build actionable recovery plans that assume failure is inevitable, minimizing downtime and data exposure. By treating every third-party integration as a potential point of failure,and implementing multi-layered controls across your software stack,you can confidently pursue global expansion while drastically lowering your risk profile. Entivel Pty help businesses transition from being reactive to highly resilient.
Trellix has announced enhanced data security capabilities and a framework to help organisations adopt generative AI whilst protecting sensitive data. The solution addresses rising risks from shadow AI, which has contributed to data breach costs increasing by an average of $670,000. The platform combines Data Loss Prevention, Data Encryption and Database Security with a three-part framework establishing usage policies, governance and real-time visibility over AI tool interactions with sensitive data. Key features include an AI Data Risk Dashboard monitoring data loss to AI tools, Database Security with Analytics Hub protecting against unauthorised access, and Professional Services supporting policy development and technical implementation. Trellix has raised $295 million to date, helping security-conscious organisations manage AI adoption risks across cloud, on-premises and operational technology environments.
Trellix has launched SecondSight, a threat hunting service designed to identify advanced threats that often evade automated detection systems. The service monitors low-noise signals that traditional defences miss, such as lateral movement indicators. SecondSight combines human expertise with AI-driven analytics across Trellix's endpoint, network and email security products. The service identifies subtle threat indicators that automated systems flag but cannot fully interpret, providing early warnings and actionable notifications to customers. The company released a threat hunting report highlighting five critical campaigns observed last year, including cases of OAuth abuse and spear-phishing operations. Trellix says the service addresses increased alert fatigue caused by threat actors' use of AI, acting as a force multiplier for security analysts monitoring sophisticated attacks.
Trellix NDR strengthens OT-IT security convergence. SAN JOSE, Calif.-(BUSINESS WIRE)- Trellix, the company delivering the future of AI-powered cybersecurity, today announced Trellix NDR innovations, strengthening OT-IT security with integrated visibility across complex environments, enhanced detection capabilities, and automated investigation and response to reduce the threat detection-to-response gap. "We know cybercriminals are increasingly targeting the OT-IT boundary, where threats can hide in the absence of complete visibility," said Rohit Unnikrishnan, SVP Product Management, Trellix. "To keep pace, organizations must prioritize proactive defense with enhanced perimeter visibility and enriched intelligence extending across environments for greater resilience and risk management." Threat actors focus on the IT/OT boundary as an easier, scalable entry point, establishing lateral movement by compromising systems bridging the networks. The need for OT-IT security convergence to strengthen perimeter defense and build resilience is apparent, with 82% of CISOs believing failure to converge OT and IT security will increase organizational risk and compliance exposure. Infused with threat intelligence, Trellix NDR provides deep behavioral detections, threat prioritizations, and visibility across East-West and North-South network traffic. Additionally, Trellix NDR released a certified integration with Nozomi Networks to extend visibility into an OT environment without needing an agent installed. With sensors in place in the OT architecture, Trellix has the ability to detect anomalies within the OT traffic and bridge the IT and OT SOC visibility, supporting threat hunting and forensics within the OT environment. SOC teams are empowered with faster threat detections, OT-IT security convergence, increased visibility, high-fidelity alerts, automated triage and containment, and reduced analyst workload. * Enhanced OT-IT visibility for strengthened defense: Trellix NDR's certified integration with Nozomi Networks correlates Nozomi Networks AI-powered alerts, assets, insights, and network behaviors with enterprise traffic for unified IT/OT visibility and enhanced perimeter defense. * AI-powered detections to disrupt advanced attacks: Trellix NDR's deep behavioral, multi-layered detections across each stage of the MITRE ATT&CK framework and AttackPath Discovery disrupt attackers at every stage for faster remediation. * Hyperautomation for narrowed detection-to-response gap: Trellix Hyperautomation for Trellix NDR offers a no-code, drag-and-drop workflow builder to automate response and security processes, significantly reducing the mean time to detect and respond to threats like encrypted traffic detections, lateral movements, and DNS tunneling. Trellix NDR protects organizations from advanced threats by providing visibility into their extended network infrastructure and enabling security teams to accelerate and automate investigation and response. Greater visibility across environments gives teams the context they need to detect, contain, and resolve issues before they escalate, reinforcing protection for critical infrastructure and supporting compliance. About Trellix Trellix is a global company redefining the future of cybersecurity. The company's comprehensive, open, and native cybersecurity platform helps organizations confronted by today's most advanced threats gain confidence in the protection and resilience of their operations. Trellix, along with an extensive partner ecosystem, accelerates technology innovation through artificial intelligence, automation, and analytics to empower over 50,000 business and government customers with responsibly architected security. More at https://trellix.com.
Trellix launches Database Security 10.3. Enhanced insights, expanded network support, and extended database coverage. The volume of databases in hybrid environments and their complexity makes it harder to protect critical data and stop breaches. A key part of this challenge is ensuring that database solutions support modern infrastructure needs, such as IPv6 networks and sensor deployment across both Windows and Linux environments. Organizations also struggle to sift through massive amounts of alert and vulnerability data. This can make effective risk management more difficult. To move beyond simply logging events and toward proactive, decisive security, organizations need a solution that unifies visibility and accelerates action. Trellix is excited to announce the launch of Trellix Database Security 10.3, which enhances its market-leading, comprehensive, and unified database security. This release is packed with key improvements, including its powerful Analytics Hub, extended support for hybrid infrastructures, and expanded database support. What's new in Trellix Database Security 10.3? This latest release includes new features and enhancements designed to provide you with broader coverage, deeper visibility, and a more streamlined security experience. * Analytics Hub: Gain deeper, proactive visibility into database activity and vulnerability findings. * Microsoft Azure IaaS support: Extend your database security to the cloud with support for sensor deployment on Windows and Linux in Azure IaaS hybrid environments. * Extended IPv6 network support: Comply with federal mandates and modernize your network with support for dual-stack, IPv4, and pure IPv6 configurations. * Support for the latest database and operating system versions: Stay current with certified support for the latest versions of leading databases, including Oracle, MS SQL Server, MySQL, MariaDB, MongoDB, and PostgreSQL. Next generation insights with Analytics Hub. In today's complex security landscape, raw data is not enough. Enterprises require actionable intelligence to prioritize threats and manage risk effectively. Trellix is proud to announce the launch of the Analytics Hub, the next generation of its data analytics capabilities. The Analytics Hub delivers a robust insights and visualization engine to provide the speed, scale, and clarity your security teams need. It transforms your database alert and vulnerability data into a centralized, interactive command center for managing data risk and prioritizing your team's most important activities. Here are the key capabilities designed for the modern enterprise: * Automated database risk scoring: Move beyond manual risk assessment. Analytics Hub introduces a sophisticated engine that automatically calculates a holistic risk score (high, medium, or low) for every database. It intelligently weighs active vulnerabilities, privileged user access, and sensitive data activity, providing an immediate, clear benchmark of your security posture. * Intuitive application & access mapping: Improve visibility and reduce blind spots. Analytics Hub's mapping visualizer provides a complete, top-down view of your data flow. Instantly trace and visualize the complex connections between database instances, user IDs, source IPs, and the exact command types being executed. This context is critical for rapid investigation and understanding access patterns. * Centralized, high-speed analytics: Consolidate your security view. Analytics Hub unifies all your alert and vulnerability assessment (VA) findings into dynamic, interactive dashboards. Drill down from a high-level summary to specific findings in seconds and leverage powerful table visualizers to filter and sort massive datasets instantly. * Streamlined audit & compliance reporting: Simplify your audit cycles. Generate customized summaries and detailed reports on both alerts and VA findings directly from the interface. Reports can be exported to XML, PDF, and CSV, providing auditors with the documentation they require, whenever needed. * Granular, role-based access control: Analytics Hub includes a dedicated user management system. This feature allows you to grant specific permissions - such as read-only access for auditors or non-admin accounts for analysts - ensuring your team can access the insights they need without compromising administrative security. The Analytics Hub is an evolution of the former McAfee Database Insights module. Analytics Hub is delivered via a separate installer for flexible deployment. It's included at no extra cost with your database security product license. Hybrid cloud, modern infrastructure, and expanded database support. Trellix understand that your data ecosystem is constantly evolving. This release also includes key enhancements to support your hybrid cloud infrastructure, network modernization efforts, and the latest in database support. * Azure IaaS support: As the next logical step in its commitment to a unified security posture across your on-premises and hybrid cloud infrastructure, Trellix is introducing Azure IaaS support. This allows for sensor deployment on both Windows and Linux environments in Azure, initially with support for Oracle and MySQL databases. * Extended support for IPv6: To address critical network modernization and federal compliance mandates, Trellix is adding extended support for IPv6 networks. This ensures its platform supports dual-stack, IPv4, and pure IPv6 configurations, providing increased protection and ensuring you can meet evolving infrastructure requirements. * Keeping pace with your data ecosystem: Database Security 10.3 will include certification for the latest versions of market-leading databases, including Oracle, MS SQL Server, MySQL, MariaDB, MongoDB, and PostgreSQL. A complete listing will be included in the product documentation. To learn more about how Trellix can help you secure your databases, visit its website or request a demo today.