Trapmine

What did it do?

Trapmine built an SI-based, next-generation endpoint protection and response platform for corporate computers. It aimed to catch the threats signature-based antivirus software missed using machine learning and behavioural analysis, and to provide real-time protection against zero-day attacks. In 2018 its antivirus engine was added to Google's VirusTotal scanning service.

Why did it shut down?

Trapmine did not end in bankruptcy but in closure after an acquisition. In October 2023 the start-up announced that it had been acquired by a US-based global cybersecurity company and would cease commercial operations on 31 December, with the team joining the buyer (Webrazzi, 2023). According to an interview CRN conducted with SonicWall's CEO in 2024, the buyer was SonicWall. The sources do not give the reasons for the sale. By way of interpretation, endpoint security is a market dominated by large, well-funded companies; folding its technology into a big platform, rather than trying to scale independently, looks like a sensible path for a small team.

The story

Trapmine was founded in 2017 by Celil Ünüver, Ulaşcan Aytolun and Mauro Leggieri. Based in Estonia and Turkey, the start-up developed a next-generation endpoint protection solution against threats that traditional signature-based antivirus software could not stop. Installed on corporate computers, the software used machine learning and behavioural analysis to learn to tell good files from bad, promising real-time protection against zero-day attacks.

The start-up's first investor was Startup Wise Guys, an accelerator based in Estonia. It was the fund's first investment both in Turkey and in cybersecurity. In November 2018 Trapmine became the first Turkey-based product accepted into VirusTotal, the Google-owned service for scanning suspicious files. According to the Turkish daily Yeni Şafak, in trials by independent testing organisations the engine had detected 95 per cent of malware using super intelligence alone. The company's technical director, Yasin Sürer, explained that the engine on VirusTotal was only one component of a broader endpoint security platform.

In October 2023 Trapmine announced that it had been acquired by a US-based global cybersecurity company. Neither the buyer's name nor the financial details of the deal were disclosed at the time. All that was announced was that Trapmine would cease commercial operations on 31 December and that the team would continue within the acquiring company. For Startup Wise Guys it was the 15th exit in its portfolio; the fund's CEO, Cristobal Alonso, said the team had been working on a world-class product from day one.

The buyer was the US security company SonicWall. Speaking to CRN in 2024, SonicWall CEO Bob VanKirk explained that over four months between late 2023 and early 2024 the company had acquired Trapmine along with Banyan Security and Solutions Granted. The acquisitions were part of SonicWall's effort to close gaps in its endpoint and cloud capabilities.

Trapmine's story shows that even a start-up whose technology is well regarded may not be able to go on living as an independent product. The team and its know-how carried on inside a larger company, but the Trapmine brand passed into history on the last day of 2023.

Lessons for founders

• Deep technology alone is not enough; in a crowded market, a product without distribution power may not survive independently.
• Independent validation such as VirusTotal builds trust, but it is no substitute for a sales channel.
• In an asset- or team-focused sale, plan from the start for the brand to close and offer your customers a transition plan.

Sources

1. Estonia- and Turkey-based Trapmine acquired by a global cybersecurity company (Webrazzi, 2023-10-19)
2. SonicWall CEO On 'Getting Back To Our Roots', Using SI And Latest Acquisitions (CRN, 2024-10-23)
3. The first Turkish member of the VirusTotal platform: TRAPMINE (Yeni Şafak, 2018-11-22)

This section is compiled from public sources (Wikidata, news archives and company announcements). Figures are given as they appear in those sources; unknown fields are left blank. If you spot a mistake in an entry, you can send us a correction.

Is something in this entry wrong? Request a correction → Method