IMPI: Is this SA startup going to become the Symantec of the mobile age?

With its growing popularity, the Android mobile platform, much like Windows, is rising to number one on the cybercriminal hit list.

At the end of 2012, Trend Micro reported 350 000 “malicious” and “high-risk” Android apps — up from a mere 1 000 in 2011. The security firm notes that it took Windows 14 years to reach this threat level, while Android managed it in three.

What types of carnage did mobile malware cause? While 605 new malicious families were detected in 2012, the most common type was the “premium service” abuser. This type of malware sends text messages to a premium rate number without the user’s consent, subsequently racking up unsolicited phone bills.

Aggressive adware — apps that displays advertising through system popups, notifications or browser bookmarks — also continued to grow. Rogue ad networks target personal information such as location data and contact lists to spread.

We’ve touched on only two of the top 5 Android malware threats, but if you love your Nexus 4, we probably have your attention.

South African startup, IMPI (International Mobile Protection Initiative), provides anti-malware protection for Android devices along with an integrated data management suite that simplifies the secure backup and storage of device data.

If you were wondering, yes, IMPI protects Android devices against the top threats including premium service abusers, aggressive adware and malware that gives attackers remote access to your device. In fact, IMPI claims to have one of the most complete and comprehensive databases of mobile malware in the world. IMPI also checks removable media for threats, and like a typical PC virus scanner, automatically scans and updates to protect against new malware.

Through a chance meeting with a cyber security specialist in early 2006, serial entrepreneur Mauritz Robertson came to learn of viruses and malware that specifically target mobile phones. At the time there were few companies focusing on this emerging threat. Given the rapid adoption of mobile technology, they believed that there was a gap in the market for specialised mobile security applications and subsequently committed resources to fund two years of research. Aided by co-founder Johann Rousseau who is based in Sao Paolo and oversees the startup’s database administration and web development, IMPI launched in 2008

Robertson notes that although IMPI’s malware protection is exclusive to Android, the solution’s data management and storage aspects do extend to BlackBerry and Symbian — a nice touch as it takes the pain out of jumping to a new platform. IMPI does not have an iOS or Windows Phone flavour, but Robertson says that there will be support for the platforms in 2013.

With the open nature of the Android eco-system, malware protection for the platform is a priority. Even with the addition of Bouncer — Google’s automated malware scanner for app submissions — Android still remains vulnerable.

For more tightly regulated platforms such as iOS, Windows Phone and more recently, BlackBerry 10, apps submitted to the respective platform app stores undergo a more rigorous testing process. Recently, BlackBerry announced that it will utilise Trend Micro’s mobile app reputation service in addition to its own proprietary processes, to analyse BlackBerry 10 apps submitted to BlackBerry World.

With Symbian being declared officially dead and sales beginning to plunge, IMPI’s support for the troubled mobile OS might be a blessing to those that haven’t made the leap to another platform. Each flavour of IMPI has some additional extras. The Symbian version for example includes a call recorder and dictaphone.

IMPI’s business model is subscription based. Users pay an annual fee that is based on the size of the data vault they require. This unique pricing model means that users have the freedom to use IMPI and its additional bundled applications on multiple devices at no additional cost — there’s no per device license requirement. Pricing starts at US$16 for 100 megabytes and goes all the way up to US$130 for 20 gigabytes. There’s also a 60 day free trial available for those that would like to dip their toes into the water.

Initially self-funded, IMPI later secured investment from two private investors in exchange for a 20% minority stake in the company. According to Robertson, to date, the startup has invested more than R5 million into the research and development of their solutions. IMPI is expected to be profitable by the end of 2013.

IMPI will find favour with consumers, but with the rising interest in enterprise startups, Robertson also makes a compelling enterprise play. The startup offers risk management and consultation services that help enterprise clients securely deploy mobile tech inside their companies.

IMPI also has its sights set on being relevant to the South African government. The country’s cabinet approved the Draft National Cybersecurity Policy in March 2012. As it prescribes locally developed security solutions as a way to ensure enhanced software integrity, Robertson is very bullish about IMPI’s prospects to service both government departments and parastatals.

Future features on the IMPI roadmap include browser protection and panic button as well as anti-spam and anti-phishing features. Robertson says that a Remote Control feature is also in the works, which is an antitheft application with remote lock, wipe and stealth functionality — similar to what is built into iOS, BlackBerry and Windows Phone.

Touching on similarities between IMPI’s offering and that of OEMs, Robertson points out that features such as cloud storage and remote control functionality are often proprietary per platform, while IMPI remains agnostic. “OEMs regularly offer data storage solutions to their users. In some instances the motive is to leverage a captive client base to increase revenues, but more often it is purely an attempt to lock users into using a specific device or operating system. These include iCloud, BlackBerry Protect and Samsung Kies,” says Robertson. The services are also sporadic, for example, BlackBerry offers remote wipe functionality, but doesn’t have a cloud storage solution for media.

IMPI will compete with cloud storage solutions such as those offered by Dropbox, Google Drive and Microsoft’s SkyDrive, but Robertson believes that there are unresolved issues related to security and data ownership that makes cloud storage slightly less attractive and significantly more insecure.

Additionally, IMPI competes in the on-device security industry with the likes of Lookout and Netqin and as traditional anti-virus companies are also starting to make inroads into the mobile market, competitors include Kaspersky, F-Secure, ESET and Bullguard.

In terms of mobile device management, IMPI stands to compete with BlackBerry, Good Technologies, Mobile Iron and Maas360.

To start with IMPI is targeting markets in South Africa, Australia, USA and UK. Robertson says that once traction is reached in English-speaking markets, IMPI will be translated with the intention of reaching emerging markets in Brazil, China, Indonesia and India, as well as alternative European markets such as Germany, Italy, France and Portugal.