Sanctum Inc.

Sanctum Inc. was an American information-technology company focused on application-layer security for web environments. Based in Santa Clara, California, the company developed software intended to protect web applications from malicious HTTP traffic and to identify security vulnerabilities before they could be exploited. Its best-known offerings were AppShield, an early web application firewall, and AppScan, a web-application security vulnerability-assessment product. The company originated in 1997 under the name Perfecto Technologies, founded by Eran Reshef and Gili Raanan. Its work grew out of research into application security and the use of formal methods in practical software systems. Sanctum also worked with Turing Award-winning computer scientist Professor Amir Pnueli. Earlier research conducted in 1996 and 1997 contributed to the invention of CAPTCHA technology in parallel with work by other research groups, and the company applied for a United States patent relating to CAPTCHA. The CAPTCHA work was part of Sanctum's broader early interest in securing internet-facing software rather than its principal commercial product line. Sanctum introduced AppShield in the summer of 1999. The product was designed to operate at the application layer, inspecting incoming HTTP requests and blocking attacks according to a dynamic security policy derived from analysis of the application's outgoing HTML pages. This approach sought to reduce the need for administrators to manually encode every application rule and positioned AppShield as an early specialized web application firewall. A 2002 ZDNet report stated that the product had been used by 60 companies in the Fortune 100 during the three years after its launch, although the source does not provide a corresponding revenue figure. In June 2000, the company launched AppScan, described in contemporary reference material as the first web-security vulnerability-assessment solution. AppScan was intended to test web applications for security weaknesses, complementing AppShield's role in blocking hostile traffic. Early AppScan customers reportedly included Yahoo!, Bank of America, and AT&T, indicating that Sanctum targeted large enterprises with substantial public-facing web infrastructure. Also in 2000, Perfecto Technologies adopted the Sanctum name. The renamed company received backing from Sequoia Capital, Intel Capital, Goldman Sachs, Donaldson, Lufkin & Jenrette, Walden, and Mofet. This investment support reflected the growing commercial importance of web and application security as organizations moved business systems onto the internet. Sanctum remained independent until 2004, when Watchfire acquired it for an undisclosed amount. The transaction ended Sanctum as a standalone company and combined its application-security technology with Watchfire's broader security-software portfolio. In 2007, IBM acquired Watchfire. Following the 2004 transaction, Watchfire sold the intellectual property associated with AppShield to F5 Networks. F5 later discontinued AppShield in favor of its competing TrafficShield product. Sanctum therefore survives primarily as an historical application-security brand and as part of the lineage of technologies absorbed into larger enterprise-security companies.

Sanctum Inc. emerged from Perfecto Technologies, a company founded in 1997 by Eran Reshef and Gili Raanan in the United States. Its work addressed the security problems created by the rapid growth of web-based applications. The founders pursued application-security research and explored the use of formal methods in practical software systems, including collaboration with computer scientist Amir Pnueli. Research associated with the company in 1996 and 1997 also contributed to the development of CAPTCHA technology, in parallel with efforts by other groups, and led to a United States patent application. The company's first major commercial product was AppShield, released in the summer of 1999. AppShield was an early web application firewall that examined incoming HTTP requests and attempted to block malicious behavior. Rather than relying solely on manually written rules, its dynamic policy could be constructed by analyzing the HTML pages generated by the protected application. This design reflected Sanctum's emphasis on understanding application behavior at the software layer, rather than treating web traffic only as a network-level problem. In June 2000, the company launched AppScan, a web-application security vulnerability-assessment product. AppScan complemented AppShield by focusing on the discovery of weaknesses in web applications. Reference material identifies Yahoo!, Bank of America, and AT&T among its early customers. A 2002 ZDNet report also stated that AppShield had been used by 60 Fortune 100 companies in the three years following its release, suggesting that Sanctum had gained significant enterprise visibility during the early commercial development of the web-application-security market. Perfecto Technologies changed its name to Sanctum in 2000. The company was backed by Sequoia Capital, Intel Capital, Goldman Sachs, Donaldson, Lufkin & Jenrette, Walden, and Mofet. These investors supported a business operating at the intersection of enterprise software, internet infrastructure, and the emerging cybersecurity market. Sanctum was acquired by Watchfire in 2004 for an undisclosed amount. The merger integrated Sanctum's application-security products and expertise into Watchfire and ended its existence as an independent company. The subsequent ownership history involved the disposition of individual technologies: Watchfire sold AppShield's intellectual property to F5 Networks, which eventually discontinued AppShield in favor of TrafficShield. In 2007, IBM acquired Watchfire, bringing the broader Watchfire business, including technology descended from Sanctum, into IBM. Sanctum is consequently a defunct standalone brand, but its products represent an early stage in the development of commercial web application firewalls and automated application-security assessment.

• 2007

  IBM acquires Watchfire

  [1]Sanctum Inc.en.wikipedia.org

  IBM acquired Watchfire, the company that had previously acquired Sanctum.

• 2004

  Watchfire acquires Sanctum

  [1]Sanctum Inc.en.wikipedia.org

  Watchfire acquired Sanctum for an undisclosed amount.

• 2000

  Company renamed Sanctum

  [1]Sanctum Inc.en.wikipedia.org

  Perfecto Technologies adopted the Sanctum name as its application-security business expanded.

• 2000

  AppScan is introduced

  [1]Sanctum Inc.en.wikipedia.org

  Sanctum launched AppScan, a web-security vulnerability-assessment solution.

• 1999

  AppShield reaches the market

  [1]Sanctum Inc.en.wikipedia.org

  Sanctum released AppShield, an early web application firewall for inspecting and filtering malicious HTTP requests.

• 1997

  Perfecto Technologies is founded

  [1]Sanctum Inc.en.wikipedia.org

  Eran Reshef and Gili Raanan founded the company that would later become Sanctum Inc.

An early specialist in application-layer security, positioned around protecting web applications from attacks and identifying vulnerabilities in internet-facing software.

• Web application firewall · 1999

  AppShield

  AppShield was an early web application firewall introduced in 1999. It inspected incoming HTTP requests and blocked suspected attacks using a dynamic policy built through analysis of the application's outgoing HTML pages. The product represented Sanctum's application-layer approach to security and was reported to have been deployed by numerous large enterprises. After Watchfire acquired Sanctum, the AppShield intellectual property was sold to F5 Networks. F5 later discontinued it in favor of TrafficShield.

• Web application vulnerability assessment · 2000

  AppScan

  AppScan was Sanctum's web-security vulnerability-assessment solution, introduced in June 2000. It was designed to test web applications and help organizations identify security weaknesses before attackers could exploit them. The product complemented AppShield's defensive filtering function by addressing assessment and discovery. Early customers cited in reference material included Yahoo!, Bank of America, and AT&T. AppScan's subsequent product lineage was associated with the larger businesses that acquired Sanctum and Watchfire.

• 2007

  Watchfire acquisition by IBMM&A

  Background

  Watchfire had become the owner of the former Sanctum business and its application-security assets.

  Action taken

  IBM acquired Watchfire.

  Aftermath

  Sanctum's technology lineage became part of IBM's enterprise software and security operations.

  Source

• 2004

  Acquisition by WatchfireM&A

  Background

  Sanctum had developed recognized products in web application firewall and vulnerability assessment software.

  Action taken

  Watchfire acquired Sanctum for an undisclosed amount.

  Aftermath

  Sanctum ceased operating as an independent company, and its technology entered Watchfire's portfolio.

  Source

• 2000

  Launch of AppScanProduct launch

  Background

  Organizations needed tools to discover vulnerabilities in web applications in addition to filtering attacks at runtime.

  Action taken

  Sanctum introduced AppScan as a web-application vulnerability-assessment solution.

  Aftermath

  AppScan broadened Sanctum's offering from runtime protection into application-security testing and assessment.

  Source

• 2000

  Rebranding from Perfecto Technologies to SanctumStrategy

  Background

  The company was expanding from research and early product development into a dedicated application-security business.

  Action taken

  Perfecto Technologies changed its corporate name to Sanctum.

  Aftermath

  The Sanctum identity became associated with the company's application-layer security products and research.

  Source

• 1999

  Launch of AppShieldProduct launch

  Background

  Web applications were becoming an increasingly important enterprise interface, creating demand for controls that could understand application-layer traffic.

  Action taken

  Sanctum released AppShield as a web application firewall that inspected HTTP requests and applied dynamically derived security policies.

  Aftermath

  AppShield became Sanctum's flagship product and helped establish the company in the emerging web-application-security market.

  Source

1. 1Sanctum Inc.en.wikipedia.org