Sanctum Inc.

Sanctum Inc. was an American information-technology company focused on application-layer security for web environments. Based in Santa Clara, California, the company developed software intended to protect web applications from malicious HTTP traffic and to identify security vulnerabilities before they could be exploited. Its best-known offerings were AppShield, an early web application firewall, and AppScan, a web-application security vulnerability-assessment product. The company originated in 1997 under the name Perfecto Technologies, founded by Eran Reshef and Gili Raanan. Its work grew out of research into application security and the use of formal methods in practical software systems. Sanctum also worked with Turing Award-winning computer scientist Professor Amir Pnueli. Earlier research conducted in 1996 and 1997 contributed to the invention of CAPTCHA technology in parallel with work by other research groups, and the company applied for a United States patent relating to CAPTCHA. The CAPTCHA work was part of Sanctum's broader early interest in securing internet-facing software rather than its principal commercial product line. Sanctum introduced AppShield in the summer of 1999. The product was designed to operate at the application layer, inspecting incoming HTTP requests and blocking attacks according to a dynamic security policy derived from analysis of the application's outgoing HTML pages. This approach sought to reduce the need for administrators to manually encode every application rule and positioned AppShield as an early specialized web application firewall. A 2002 ZDNet report stated that the product had been used by 60 companies in the Fortune 100 during the three years after its launch, although the source does not provide a corresponding revenue figure. In June 2000, the company launched AppScan, described in contemporary reference material as the first web-security vulnerability-assessment solution. AppScan was intended to test web applications for security weaknesses, complementing AppShield's role in blocking hostile traffic. Early AppScan customers reportedly included Yahoo!, Bank of America, and AT&T, indicating that Sanctum targeted large enterprises with substantial public-facing web infrastructure. Also in 2000, Perfecto Technologies adopted the Sanctum name. The renamed company received backing from Sequoia Capital, Intel Capital, Goldman Sachs, Donaldson, Lufkin & Jenrette, Walden, and Mofet. This investment support reflected the growing commercial importance of web and application security as organizations moved business systems onto the internet. Sanctum remained independent until 2004, when Watchfire acquired it for an undisclosed amount. The transaction ended Sanctum as a standalone company and combined its application-security technology with Watchfire's broader security-software portfolio. In 2007, IBM acquired Watchfire. Following the 2004 transaction, Watchfire sold the intellectual property associated with AppShield to F5 Networks. F5 later discontinued AppShield in favor of its competing TrafficShield product. Sanctum therefore survives primarily as an historical application-security brand and as part of the lineage of technologies absorbed into larger enterprise-security companies.

Sanctum Inc. emerged from Perfecto Technologies, a company founded in 1997 by Eran Reshef and Gili Raanan in the United States. Its work addressed the security problems created by the rapid growth of web-based applications. The founders pursued application-security research and explored the use of formal methods in practical software systems, including collaboration with computer scientist Amir Pnueli. Research associated with the company in 1996 and 1997 also contributed to the development of CAPTCHA technology, in parallel with efforts by other groups, and led to a United States patent application. The company's first major commercial product was AppShield, released in the summer of 1999. AppShield was an early web application firewall that examined incoming HTTP requests and attempted to block malicious behavior. Rather than relying solely on manually written rules, its dynamic policy could be constructed by analyzing the HTML pages generated by the protected application. This design reflected Sanctum's emphasis on understanding application behavior at the software layer, rather than treating web traffic only as a network-level problem. In June 2000, the company launched AppScan, a web-application security vulnerability-assessment product. AppScan complemented AppShield by focusing on the discovery of weaknesses in web applications. Reference material identifies Yahoo!, Bank of America, and AT&T among its early customers. A 2002 ZDNet report also stated that AppShield had been used by 60 Fortune 100 companies in the three years following its release, suggesting that Sanctum had gained significant enterprise visibility during the early commercial development of the web-application-security market. Perfecto Technologies changed its name to Sanctum in 2000. The company was backed by Sequoia Capital, Intel Capital, Goldman Sachs, Donaldson, Lufkin & Jenrette, Walden, and Mofet. These investors supported a business operating at the intersection of enterprise software, internet infrastructure, and the emerging cybersecurity market. Sanctum was acquired by Watchfire in 2004 for an undisclosed amount. The merger integrated Sanctum's application-security products and expertise into Watchfire and ended its existence as an independent company. The subsequent ownership history involved the disposition of individual technologies: Watchfire sold AppShield's intellectual property to F5 Networks, which eventually discontinued AppShield in favor of TrafficShield. In 2007, IBM acquired Watchfire, bringing the broader Watchfire business, including technology descended from Sanctum, into IBM. Sanctum is consequently a defunct standalone brand, but its products represent an early stage in the development of commercial web application firewalls and automated application-security assessment.

1. 2007IBM acquires Watchfire

   IBM acquired Watchfire, the company that had previously acquired Sanctum.

   Source
2. 2004Watchfire acquires Sanctum

   Watchfire acquired Sanctum for an undisclosed amount.

   Source
3. 2000Company renamed Sanctum

   Perfecto Technologies adopted the Sanctum name as its application-security business expanded.

   Source
4. 2000AppScan is introduced

   Sanctum launched AppScan, a web-security vulnerability-assessment solution.

   Source
5. 1999AppShield reaches the market

   Sanctum released AppShield, an early web application firewall for inspecting and filtering malicious HTTP requests.

   Source
6. 1997Perfecto Technologies is founded

   Eran Reshef and Gili Raanan founded the company that would later become Sanctum Inc.

   Source

An early specialist in application-layer security, positioned around protecting web applications from attacks and identifying vulnerabilities in internet-facing software.

• AppShieldWeb application firewall1999

  AppShield was an early web application firewall introduced in 1999. It inspected incoming HTTP requests and blocked suspected attacks using a dynamic policy built through analysis of the application's outgoing HTML pages. The product represented Sanctum's application-layer approach to security and was reported to have been deployed by numerous large enterprises. After Watchfire acquired Sanctum, the AppShield intellectual property was sold to F5 Networks. F5 later discontinued it in favor of TrafficShield.

• AppScanWeb application vulnerability assessment2000

  AppScan was Sanctum's web-security vulnerability-assessment solution, introduced in June 2000. It was designed to test web applications and help organizations identify security weaknesses before attackers could exploit them. The product complemented AppShield's defensive filtering function by addressing assessment and discovery. Early customers cited in reference material included Yahoo!, Bank of America, and AT&T. AppScan's subsequent product lineage was associated with the larger businesses that acquired Sanctum and Watchfire.

• 2007Watchfire acquisition by IBMM&A

  Watchfire had become the owner of the former Sanctum business and its application-security assets.

  What changed. IBM acquired Watchfire.

  Aftermath. Sanctum's technology lineage became part of IBM's enterprise software and security operations.

  Source
• 2004Acquisition by WatchfireM&A

  Sanctum had developed recognized products in web application firewall and vulnerability assessment software.

  What changed. Watchfire acquired Sanctum for an undisclosed amount.

  Aftermath. Sanctum ceased operating as an independent company, and its technology entered Watchfire's portfolio.

  Source
• 2000Launch of AppScanProduct launch

  Organizations needed tools to discover vulnerabilities in web applications in addition to filtering attacks at runtime.

  What changed. Sanctum introduced AppScan as a web-application vulnerability-assessment solution.

  Aftermath. AppScan broadened Sanctum's offering from runtime protection into application-security testing and assessment.

  Source
• 2000Rebranding from Perfecto Technologies to SanctumStrategy

  The company was expanding from research and early product development into a dedicated application-security business.

  What changed. Perfecto Technologies changed its corporate name to Sanctum.

  Aftermath. The Sanctum identity became associated with the company's application-layer security products and research.

  Source
• 1999Launch of AppShieldProduct launch

  Web applications were becoming an increasingly important enterprise interface, creating demand for controls that could understand application-layer traffic.

  What changed. Sanctum released AppShield as a web application firewall that inspected HTTP requests and applied dynamically derived security policies.

  Aftermath. AppShield became Sanctum's flagship product and helped establish the company in the emerging web-application-security market.

  Source

• 2007IBM acquires Watchfire

  IBM acquired Watchfire, bringing the former Sanctum business and related technology into IBM's enterprise software portfolio.

  M&A
  Source
• 2004Watchfire acquires Sanctum

  Watchfire acquired Sanctum for an undisclosed amount, ending Sanctum's independent operation and incorporating its application-security technology into Watchfire.

  M&A
  Source
• 2000Perfecto Technologies adopts the Sanctum name

  The company founded as Perfecto Technologies renamed itself Sanctum as it developed its application-security business.

  Other
  Source
• 2000Sanctum introduces AppScan

  Sanctum launched AppScan, a web-application vulnerability-assessment product intended to identify weaknesses in internet-facing software.

  Product launch
  Source
• 1999Sanctum launches AppShield web application firewall

  Sanctum introduced AppShield, an application-layer firewall designed to inspect HTTP requests and block malicious activity using policies derived from the application's output.

  Product launch
  Source
• F5 Networks discontinues AppShield after acquiring its intellectual property

  After Watchfire sold AppShield's intellectual property to F5 Networks, F5 discontinued the product and favored its competing TrafficShield offering.

  Product generationOther
  Source

1. Sanctum Inc.