Core Security's Testing Tango

Venture capital is still flowing into security startups, with Core Security Technologies the latest to feel the benefit of a buoyant market.

The firm, started in Argentina but with an office in Boston, has clinched a $4.5 million Series B round from Morgan Stanley Venture Partners. At a time when businesses are coming under a bewildering array of electronic attacks, Core Security joins a long list of startups with bulging wallets (see Security Startups Flood the Market).

The funding brings Core Securitys total financing to $10 million. A previous round, which took place in 2000 and 2001, involved Pegasus Capital and an unnamed angel investor.

So, what’s the Core Security story? The company was founded in Buenos Aires back in 1996 as an information security consultancy. Then, in 2000, Core Security branched out into the software business, and a U.S. operation was set up a year later. The firm’s flagship Core Impact product was launched in 2002.

The software works by planting agents on servers, which act as proxies for simulated attacks, in an approach often referred to as "penetration testing." Users can then trace the attack’s path, find out which machines have been compromised, and work out which patches are out of date, according to Paul Paget, the firm’s CEO.Paget tells NDCF that the software effectively clears up after itself. The agents "are not persistent," he says. "Once you have finished the test, they are extricated from the system automatically.”

The exec says that most of Core Security’s staff are in Argentina, with 50 currently based in Buenos Aires, compared to 10 in Beantown. Whereas engineering, research, IT operations and consultancy are handled in the Argentine capital, Boston is responsible for sales, marketing, and business development, he says.

The company’s founders include Core Security’s CTO, Ivan Arce, and the firm’s R&D director, Ariel Futoransky. Prior to founding Core, Arce was vice president of research and development at VirtualFon, a computer telephony integration company. Futoransky is a former member of the Special Projects Group at the Argentine Tax Agency.

With the money burning a hole in his pocket, Paget is now planning to boost Core Security's presence in both its locations: “Boston will go to about 25 [staff] over the next year, and Buenos Aires will go from 50 to 75."

Core Security is not the only company playing in this space. Internet Security Systems Inc. (Nasdaq: ISSX) offers penetration testing as part of its professional services portfolio, and startup eEye Digital Security uses its Retina network security scanner to check for vulnerabilities.Paget says Core Security compliments eEye’s offering -- so much so that the two firms recently entered into an agreement to integrate their products (see Core Security, eEye Team Up).

Core Security’s message appears to be getting through. To date, Paget says, the company has amassed 150 customers, which include such big names as the US Marines, Northrop Grumman, and Continental Airlines.

Nonetheless, Core Security does face the challenge of working across two different continents. “The servers for our Website are in Boston, but the guys that manage that are in Buenos Aires,” explains Paget, although he says the firm has figured out how to work collaboratively. Certainly, it could be worse. Unlike the 10-and-a-half-hour time difference between the U.S. and India, Argentina and Boston are only an hour apart, he notes.

The firm also runs Spanish classes for its Boston staff and English classes in Buenos Aires, although Red Sox fan Paget has so far been unsuccessful in introducing baseball to his Argentine staff. However, the exec says that ice hockey has attracted much more interest. The staff, he says, "are fascinated by the intensity and speed of the game. That’s one sport that they want to see.”

The diverse nature of Core Security’s operation could be an asset. With managed security services now big business, security startups with a consultancy portfolio are seen as having an additional string to their bow. Last year, for example, McAfee Inc. acquired Foundstone Inc. for $86 million, and Symantec Corp. (Nasdaq: SYMC) bought @stake Inc. (see Symantec Gets @stake).Paget promises a new version of Core Impact for the middle of this year.

— James Rogers, Site Editor, Next-Gen Data Center Forum