Tenable

Ron Gula had worked at the National Security Agency in the 1990s and written the Dragon intrusion detection system, and the company he founded before this one was sold to Enterasys Networks - which appears elsewhere on this timeline as the enterprise remnant of Cabletron. Marcus Ranum, one of the people who built the first commercial firewalls, joined as chief security officer in 2004.

The decision that defines the company came in October 2005. With the release of Nessus 3 the scanner became proprietary, and the stated reasons were both of them honest: to generate income, and to stop giving competitors a free product to resell. The community forked the last open version, and that fork became OpenVAS, which still exists.

That is worth sitting with rather than judging quickly. A free tool written by a teenager became the default vulnerability scanner in the industry, and the only way to fund the engineering it then needed was to stop it being free. Both the closing and the fork were reasonable responses to the same fact.

Tenable was bootstrapped for a decade. Its first institutional money was a $50M Series A from Accel in September 2012 - ten years in, which is not how the funding narrative usually goes. It went public in 2018, and by 2023 was reporting around $799M in revenue and roughly 44,000 customers including a majority of the Fortune 500.

The product argument has since moved from scanning to prioritisation, because the finding that changed the category was that nobody can patch everything. Risk scoring, and CISA's catalogue of vulnerabilities known to be exploited, replaced completeness with triage - and every vendor in this segment made the same move at roughly the same time.