Lastwall raises $16 million to defend critical infrastructure in cyberspace

In the digital age, communications, weaponry, and critical infrastructure all exist on networks operated by trusted personnel. But what happens when the enemy steals the keys? 

Karl Holmqvist is the founder and CEO of Fredericton-based identity verification software Lastwall, the digital key keeper for the United States and Canada’s agencies and critical infrastructure. It may not be guns in the trenches, but in this era of warfare, he says nothing is off-limits. 

“We’re seeing foreign nation-state[s] hacking our critical infrastructure, our water, our power, the food supply chains; all those things need to be defended.”

Karl Holmqvist, Lastwall

“We’re seeing the legitimization of attacking commercial targets that would not, in an earlier era, have been considered necessarily fair game,” Holmqvist told BetaKit in an interview on Friday. “We’re seeing foreign nation-state[s] hacking our critical infrastructure, our water, our power, the food supply chains; all those things need to be defended.” 

According to the US Cybersecurity and Infrastructure Security Agency, 90 percent of cyberattacks begin with a phishing email, where a bad actor hijacks a victim’s sign-on credentials through a malicious link. If a government or power station employee gets phished, adversaries can impersonate them in critical systems, gathering intelligence or conducting sabotage. The impact, Holmqvist says, can only get worse in the AI era. 

“Right now, if I steal your identity … that’s bad, and I can cause damage,” Holmqvist said. “If you’ve got 40 agents that you have delegated authority to do things to, and I managed to steal your identity, the blast radius of that attack is so dramatically magnified.”

Lastwall’s IDCommand software is meant to mitigate those attacks by assessing over 200 characteristics of each login attempt, like keystroke cadence, mouse movement, and hardware configurations. If something seems off about that power station employee’s login attempt, IDCommand prompts for additional authentication and alerts security teams. Its work landed Lastwall in this year’s issue of BetaKit Most Ambitious. 

Holmqvist, who’s based in Vancouver, said his startup went “hard mode.” Instead of building out a minimum viable product and working their way up, they built Lastwall for the big fish customer first and foremost: the US Department of Defense. After many years of working with the agency, the gambit has paid off; Lastwall now has FedRAMP Moderate Authorization, clearing it for use in the entire US federal ecosystem. Holmqvist said this also sends a signal to private sector institutions that care about strongly regulated tech, like banks or other defence contractors. 

“When they see an organization has hit FedRAMP standards, they know that the company is passing a 400-plus control audit every year,” Holmqvist said. “It’s a big gold standard trust mark to have FedRAMP certification for your tech, and that plays through to Canada.” 

The certification, alongside a fresh $16 million Series A extension round, will aid in Lastwall’s mission to scale up and protect more government agencies and critical infrastructure providers across North America. The round was led by BDC Capital’s StrongNorth Fund, with participation from the New Brunswick Innovation Foundation, Frostbite Capital, and its existing investor base, including Blue Bear Capital, 18West, and Blue Wing Ventures.

RELATED: BDC expands Defence Platform to $6 billion and names a StrongNorth Fund leader 

As part of the round, BDC’s vice-president of defence strategy, Peter Dawe, is joining Lastwall’s board of directors. Holmqvist said Dawe, who is a recently retired Major General with 35 years of experience in the Canadian Armed Forces, understands the strategic value of Lastwall’s technology. 

Dawe has “operated at an international level and has … seen the scenarios where you need an identity platform that can serve groups from multiple nations,” Holmqvist said. “He also is very well respected and maintains connectivity with a lot of the right places, so he’s definitely somebody who can help us have some of these discussions.” 

Holmqvist hinted that his company’s fundraising efforts may not be over, as “there’s a larger appetite than anticipated for Canadian defence tech,” including from banking partners that might supply Lastwall with venture debt. Lastwall will take every dollar it can get as it strives to digitally protect more of Canada and the US, two countries that are, for better or worse, linked as one. 

Canada and the US are “all part of the same power grid, so an attack on the Canadian side is an attack on the American side, and an attack on the American side is an attack on the Canadian side, so there is more blurring of lines,” Holmqvist said. “You can’t defend one without defending both.”

Feature image courtesy Lastwall on LinkedIn.