Websense and Forcepoint - A reseller that became a filter, then a bubble IPO, then a defence contractor's cyber arm, then private equity again.

Phil Trubey founded NetPartners in Sorrento Valley, San Diego in 1994, reselling other people's network security products. What made the company was the thing it built rather than resold: software for controlling what employees could reach on the internet. It was renamed Websense in June 1999, and in March 2000 - the actual peak of the dot-com bubble - it raised $72M in an IPO whose share price doubled on the first day.

The founder was not there for it. In 1998, with $6M of venture funding raised and $6M of annual revenue, the investors removed Trubey from the chief executive's job and appointed John Carrington. The renaming, the IPO and everything after happened without the person who started it - which is common enough to be unremarkable in aggregate and worth naming in the particular.

What the product actually did is worth stating precisely, because the mechanism explains the criticism. A category database classifies sites; a policy decides which categories a given user may reach; the enforcement point sits between the user and the web. That is the same architecture as the proxies elsewhere on this timeline, and it has the same unavoidable weakness: a classification is a judgement, made at scale, by people the affected user will never meet.

So the product was called censorware, and the complaint was not baseless. Over-blocking caught sexual health information, political material and plenty of ordinary sites that fell on the wrong side of a category boundary. That is not a bug that gets fixed; it is the failure mode of the entire approach, and any honest account of web filtering has to say so. The defence is that an employer restricting its own network is a different question from a state restricting a population - but the same product served both, and it usually does.

The company grew by buying capability: PortAuthority in 2006 for data fingerprinting, SurfControl in 2007 for email security, Defensio in 2009 for social spam. By 2011 Facebook was using it to scan every link posted on the platform, which is a striking measure of how far a corporate filtering product had travelled from the corporate network.

Then the ownership carousel, which is the other half of the story. Vista Equity Partners took it private in 2013 for $906M at $24.75 a share, and moved it from San Diego to Austin. In April 2015 Raytheon - a defence contractor - bought 80% for $1.9B net of cash, contributing its own Raytheon Cyber Products valued around $400M and creating a joint venture worth roughly $2.3B, with Vista keeping the rest. That October it bought Stonesoft and Sidewinder from Intel for $389M, Stonesoft having been McAfee's next-generation firewall. On 14 January 2016 the whole thing was renamed Forcepoint. Raytheon took the remaining 20% in 2019, and in January 2021 sold the company to Francisco Partners.

Four names, five owners, thirty years. NetPartners, Websense, Raytheon|Websense, Forcepoint. What the defence-contractor period bought was not technology so much as clearance: government work needs a supplier who can hold it, and a commercial filtering company could not. The product went where the ownership could take it, which is a more honest description of most security-industry consolidation than the strategy language used at the time.

The timeline

Yemen
The Yemeni government was found to be using the company's products to monitor public internet use and block applications. The company states a policy against selling to governments and providers that restrict the internet, which makes the case sharper rather than softer: a stated position did not prevent the deployment, because filtering technology reaches its end user through distributors, resellers and integrators, and a policy at the top of that chain is a document rather than a control.
Reported in secondary sources rather than in company filings or regulatory findings.
A 29% premium to go private
Vista paid well above the recent trading price - which is what a private equity buyer offers when it thinks a public company is being valued on the wrong metric.
Six hundred million of it was a loan
Part of Raytheon's $1.9B took the form of an intercompany loan into the joint venture rather than a purchase of equity. That structure matters: it is a defence contractor keeping optionality about how deeply it wanted to own a commercial software business, and six years later it exercised that option by selling.

Flagship products and solutions

Web securityThe original filter, still the recognisable product: classify the destination, apply the policy, enforce in the path.
Data loss preventionInspecting what leaves rather than what is reached, which arrived by acquisition and became the more defensible business as web filtering commoditised.
SureView and insider riskThe Raytheon contribution: watching what authorised users do, on the reasoning that the person with legitimate access is the harder problem. It is also the capability closest to surveillance, and the company's own positioning as human-centric security is a way of describing it.
Next-generation firewallThe Stonesoft line, bought from Intel, having previously been McAfee's - a product that has now belonged to four companies without changing much.
Cross-domain and government solutionsGuarded transfer between classified networks of different levels, sold to defence and intelligence customers. This is the part that required the ownership the entry above describes.

Key innovations

A policy is not a controlThe company's stated refusal to sell to censoring governments is genuine and did not stop its products being used that way. Software of this kind reaches its operator through channels, and an intention held at the manufacturer does not travel down them. Any vendor whose product can restrict what people read has this problem, and stating a policy is the least effective of the available responses - though it is also the only one that costs nothing.
Moving from what you reach to what you sendWeb filtering asks where a user is going. Data loss prevention asks what is leaving. The second question survived the commoditisation of the first, because a classification of destinations can be bought from anybody while an understanding of a specific organisation's data cannot.
Buying clearanceThe observation the entry above makes is worth restating in product terms: cross-domain solutions and classified deployments are not sold by companies without cleared personnel and facilities. The defence contractor did not add much technology, and it added the only thing that opens that market.

Main markets

Enterprises in regulated industries, financial services and government - reported at over twelve thousand customers across more than twenty sectors, with revenue around $658M in 2019 and roughly 1,800 staff by 2025. The installed base is concentrated where data protection is a compliance requirement rather than a discretionary purchase, which is the most durable kind of security demand.

It competes with the secure web gateway vendors, the data protection specialists, and the platform suites that now bundle both - a market where the original product is a feature of somebody else's platform, which is why the company's centre of gravity moved.

Analyst standing

Assessments place it among the established vendors in data protection and secure web gateway rather than at the front, and the coverage reflects a company whose product line has been assembled from four decades of purchases.
The durable point is the one the entry above ends on. A commercial filtering product acquired federal clearance by acquisition, sold cross-domain solutions on the strength of it, and was then sold on to a financial owner with no such standing. The capability stayed; what moved was who was permitted to sell it, which is a reminder that in parts of this industry the licence is the asset.

Acquisitions

2006 PortAuthority Technologies
Data fingerprinting - identifying sensitive content by its shape rather than by rule.
The beginning of the data-loss prevention line that eventually mattered more than the filtering.
2007 SurfControl
A web and email filtering competitor.
Consolidation of the filtering market into fewer hands.
2015 Stonesoft and Sidewinder $389M
Bought from Intel. Stonesoft had been sold as McAfee Next-Generation Firewall.
Forcepoint's firewall line - and another piece of McAfee's estate changing hands, which this timeline records repeatedly.
2015 Foreground Security $62M
Security operations and managed detection.
Services capability alongside the products.

Forcepoint ↗

Sources