Ivanti

Founding stories

The timeline

1. 2017
   Formed

   LANDESK and HEAT combined in January.

2. 2020
   MobileIron and Pulse Secure

   Both completed 1 December, adding mobile device management and the SSL VPN line.

3. 2021
   Cherwell and RiskSense

   Service management and vulnerability prioritisation, bought within months of each other.

4. 2023
   December: the exploitation begins

   An authentication bypass and a command injection in Connect Secure and Policy Secure, chained by an actor later assessed as nation-state, and exploited widely before disclosure.

5. 2024
   The advisory, the letter, and the pledge

   A Five Eyes advisory in late February warned of continued exploitation. In April the chief executive published an open letter promising to rebuild engineering, security and vulnerability management. In May the company was among the first signatories to the United States cyber agency's Secure by Design pledge - the vendor having its worst year signing first, which reads as either cynical or exactly right depending on what follows.

6. 2025
   The architectural answer

   Connect Secure 25.X shipped rebuilt on an enterprise Linux base with mandatory access control enforced and the platform hardened - a replacement of the foundation rather than a patch on top of it. Critical vulnerabilities continued to be disclosed through the same period, including an unauthenticated remote code execution flaw early in the year.

   The continuing disclosures are recorded deliberately: a rebuild of this kind takes years, and reporting the pledge without the subsequent CVEs would misrepresent where the company is.

Flagship products and solutions

• Endpoint ManagerThe LANDESK line: software distribution, patching and inventory for desktops - the oldest code in the company and still among the most widely deployed.
• NeuronsThe platform brand covering patch management, discovery, service management and automation, and the attempt to make one thing out of many acquired ones.
• Connect Secure and Policy SecureThe SSL VPN and network access control appliances, arriving via Pulse Secure from Juniper by way of NetScreen. The products at the centre of the 2024 exploitation.
• Ivanti Neurons for MDMThe MobileIron line, managing mobile fleets - the other half of the December 2020 double acquisition.
• Service Manager and the Cherwell lineIT service management from two separate acquisitions, which is its own consolidation problem.
• Security Controls and Patch SDKPatching components that several other products depend on - which is why a single flaw in the SDK appears in advisories for half the portfolio at once.

Key innovations

• Consolidation as the entire strategyThe proposition is that one vendor covering endpoint, mobile, service desk, patching and access is easier to run than six. That is a real argument for an understaffed IT department, and the company is the clearest test of it in this market.
• The inherited-codebase problem, made visibleBuying eight companies means owning eight codebases, eight sets of assumptions and eight security histories, some written before the threats they now face existed. The 2024 disclosures are what that looks like under sustained attack, and no amount of shared branding changes the code underneath.
• Replacing the foundation rather than patching itRebuilding an appliance on a hardened enterprise operating system with mandatory access control is an expensive, slow answer that addresses the actual class of problem rather than the individual instances. Most vendors under that pressure ship patches faster instead.
• Publishing the commitmentsSigning a public pledge with specific, checkable commitments - multi-factor authentication, no default credentials, expanded disclosure, tracked progress - converts intentions into things a customer can hold you to. It also creates a record against which later failures are measured, which is the point.

Main markets

Analyst standing

• Assessed as a substantial presence in unified endpoint management and IT service management, with breadth as the recognised strength and integration depth across the acquired lines as the recurring criticism.
• The security record is now part of every assessment. The honest position is that the response has been more structural than most - a foundation rebuild and public, checkable commitments - and that the disclosures have continued regardless, which is what remediating a decade of inherited code actually looks like from the outside.