Vendor lineage
BrightCloud
The classification layer underneath other people's security products, including its founder's former employer's competitors.
Quinn Curtis founded BrightCloud in San Diego in 2005. He had been director of product management at Websense, and before that spent nearly nine years at Microsoft, on the team that built and shipped the first version of Exchange. The company did one thing: classify the web - reputation and content categories across, by the time Webroot bought it in July 2010, more than 200 million URLs and IP addresses.
**What makes this worth an entry is the business model rather than the product.** BrightCloud did not sell filtering to enterprises. It sold classification to the companies that sell filtering to enterprises. The data was licensed to partners who built it into their own gateways, firewalls and proxies, and the customer never saw the name.
**Which produces a fact most engineers have never considered: two competing security products can be making the same judgement, because they buy it from the same place.** When a firewall from one vendor and a web gateway from another agree that a site is malicious, that agreement may be evidence, or it may be one supplier's opinion arriving twice. The categories elsewhere on this timeline are described as judgements made at scale by people the affected user will never meet - and this entry is where those people actually work.
**The founder loop is the other half.** Curtis had run product management at Websense, whose entire product was acting on classifications. He left to build the classification itself, one layer down, and sell it to everyone - including, necessarily, companies competing with his former employer. **The layer below a market is often a better business than the market**, because it has fewer customers, they are stickier, and they compete with each other rather than with you.
Webroot acquired the company on 7 July 2010, terms undisclosed, and folded the team into its cloud engineering group. Webroot itself had been founded in 1997 in Broomfield, Colorado, and by its 2018 financial year was turning about $215M with more than 14,000 managed-service partners. Carbonite bought Webroot in 2019; OpenText bought Carbonite later the same year. **The classification service is still sold under the BrightCloud name to other security vendors, three owners later** - which tells you something about how durable an infrastructure position is compared with a product one.
**One caution belongs here rather than in a footnote.** A shared classification source means a shared blind spot. If the database miscategorises something, every product consuming it miscategorises the same thing, at the same moment, and the diversity that customers believe they bought by choosing different vendors is not there. That is the same argument this timeline makes about shared platforms and trusted update channels, arriving from a direction most people do not look.
- TechCrunch, 7 July 2010: the acquisition announced, terms undisclosed; BrightCloud founded 2005 in San Diego; founder and chief executive Quinn Curtis previously director of product management at Websense and before that almost nine years at Microsoft on the team that built and launched the first version of Exchange
- Dark Reading: BrightCloud maintaining information on more than 200 million URLs and IP addresses, and the technology being used by partners to add a layer of security and policy management for their own customers
- SecurityWeek: the BrightCloud team joining Webroot's cloud engineering group with an expanded focus on hosted security services
- Carbonite SEC filings (2019): Webroot founded 1997 with executive offices in Broomfield, Colorado; approximately $215M of revenue in the financial year ended June 2018; more than 14,000 managed service provider partners and over 600 employees
- Carbonite SEC filing (2019): the agreement under which OpenText would acquire Carbonite, with the threat intelligence business named among the reasons
- BrightCloud threat intelligence datasheet (OpenText): the service sold to other technology providers, and the 2019 OpenText acquisition
Vendor marketing material. Used for the ownership fact and the fact that the service is licensed to other providers, not for its performance claims.