AppRiver

AppRiver takes care of email security for companies that want to outsource the task of guarding their email networks from spam, phishing, viruses, and other threats. Though late to the managed security services business, AppRiver has built up an impressive client list of about 4,500 companies. Along the way, the startup has faced two major hurricanes and has managed to avoid any interruption in service. CEO Michael Murdoch has eschewed venture funding to create a startup targeting the small and mid-sized business (SMB) segment. While competitors target the Fortune 1,000 companies, AppRiver wants to reach out to firms that have less than 1,000 users. Attractive as the idea may be, AppRiver will have to watch for larger rivals who could make a play for its SMB customers.

Bharosa

Banks and e-commerce sites use Bharosa’s software to present their online account holders with virtual authentication devices—on-screen equivalents of PIN pads or keyboards—to verify their identities. With an easy-to-deploy infrastructure that eliminates the need for user downloads, Bharosa expects to have as many as 20 million users and revenues of $10 million in the next 12 months. And with federal regulators asking for banks to implement two-factor authentication by the end of 2006, Bharosa could see some big business come its way. But without a clear standard on what kind of authentication services will be preferred by banks, Bharosa will have to compete with not just hardware alternatives like tokens but also other software alternatives like one-time passwords and keystroke biometrics.

CipherTrust

CipherTrust’s all-in-one email security product protects companies from threats coming through emails and instant messaging into the network. Its hardware box combines the five main components of security—spam and fraud prevention, virus and worm protection, policy and content compliance, email privacy, and intrusion prevention—into a single package. The box is used by over a third of Fortune 500 companies and unlike competitors, CipherTrust has chosen to invest in research with over 12 patents issued or pending. The company’s success will depend on its ability to sustain and grow itself in a market that has some tough competitors, including IronPort and Symantec. CipherTrust was also named as one of Red Herring’s 2005 Top 100 Private Companies in North America.

Elemental Security

Regulatory requirements like Sarbanes-Oxley are forcing companies to buy a product that will manage, monitor, and enforce these policies and archive all the data that passes through their system. Elemental Security, a Red Herring 100 company, makes software that does just that. Elemental scores over competitors with the ease and flexibility it offers companies that want to define their own rules. The company’s CTO, Dan Farmer, is known for the free software program he released in the early 1990s called SATAN (System Administrator’s Tool for Analyzing Networks), which lets companies identify weak spots in their networks. With many security startups offering compliance as a feature in their products, Elemental will have to prove that it can cut through the clutter.

Fortify Software

Fortify Software’s code analyzers and testers tackle security issues right at the source-code level. They look for bugs or flaws in the code and help simulate hacker attacks to pinpoint the root cause of the vulnerabilities before the software is shipped or deployed.  Fortify is venture capital firm Kleiner Perkins’ baby, having been created when one of its partners, Ted Schlein, floated the idea. The two-year-old startup recently bagged Oracle as a customer and has combined with all the major software tools vendors, including IBM, Borland, and Microsoft, to bundle its software. Analysts, however, say there is no room for a pure-play security code-testing company and it won’t take much for bigger tools developers to offer a similar product as an add-on.

Imperva

Imperva takes the idea of a firewall from the network level up to the data level. It examines the way data is used and accessed to create a dynamic profile of the web and data security policy. By comparing profiled elements to the actual traffic, Imperva’s firewall software can detect malicious activity coming from both inside and outside the organization. For instance, the software can block a helpdesk employee who only has authorization to access the support tables of a database from looking into the credit card number details in the same database. CEO Shlomo Kramer’s last venture was CheckPoint, which had revenues of $515.4 million in 2004. Can he repeat the magic with Imperva?

IronPort Systems

IronPort Systems’ hardware sits on the network’s perimeter and monitors for threats, blocks spam and viruses, and enforces security policies. It uses a reputation-based filtering method to fight spam; by looking at email or IP addresses, the software can evaluate behavior to create a pattern. In case of spammers, the system blocks the address based on parameters like the volume of messages sent, origin, and ability of the sender to receive return mail. The well-funded startup has inked some clever partnerships and uses anti-spam technology from Brightmail and the antivirus product from Sophos to increase functionality. Gartner estimates that by 2008, sales of hardware boxes such as IronPort’s will dominate the market and edge out alternatives like the use of software from inside the network or outsourcing to a third party.

Nevis Networks

Nevis Networks’ hardware product helps companies to look at every packet on their local area networks (LANs) without slowing down the movement of data inside the network. That means that even applications like VoIP, which are sensitive to any packet delays, can be monitored without any difference in the quality of usage. Combining enterprise networking and LAN security, Nevis uses six or seven techniques including firewalls to analyze behavior and traffic, and intrusion prevention to detect threats before they spread inside the network. Nevis has some powerful backers in Vinod Dham, one of the architects of Intel’s Pentium chip, and Krishna “Kittu” Kolluri, the former CEO of Neoteris, which was eventually integrated into Juniper Networks. With Cisco looming large over the networking space, Nevis may need all the help it can get.

Oakley Networks

After three years of working only with the U.S. government, Oakley Networks decided to open up its product to private enterprises in 2005. Oakley’s software helps companies build and enforce insider threat policies to prevent leakage of intellectual property, private data, and regulated information. Because Oakley deploys a software agent that sits on every desktop in the network, it can even examine encrypted files that are being sent out of the network for confidential data. The company, which has 30 federal customers and about 12 pilot customers from Fortune 500 companies, has been getting some rave reviews in Silicon Valley, though company CEO Derek Smith prefers to maintain operations Utah. In 2004, Oakley booked $30 million in revenue despite being in a market crowded with startups.

Vontu