Vendor lineage
IronPort Systems
Worked out that the useful question about an email was not what it contained but who sent it.
IronPort was founded in 2000 by Scott Weiss and Scott Banister to build email security appliances at a moment when spam was moving from an annoyance to an operational cost. Its answer was not a better content filter but a different question entirely.
Content filtering asks whether a message looks like spam. That is an arms race, because the sender can rewrite the message. IronPort's SenderBase asked instead who was sending it, and how that sender had behaved everywhere else - volume, complaint rates, how long the address had been sending mail at all. A sender with no history and sudden volume is suspicious regardless of what the message says.
That reputation data was aggregated across every customer, which made the network itself the product: the more organisations used it, the better the signal. It is the same structural argument that cloud-delivered security has made ever since, and IronPort was making it about email in 2002.
The appliances ran a purpose-built mail transfer agent designed to hold enormous numbers of simultaneous connections, because a mail gateway under a spam flood fails on connection handling long before it fails on filtering.
Cisco announced the acquisition in January 2007 for around $830M. The technology became Cisco's Email Security Appliance line, and the reputation approach outlived the brand by decades.
Founding stories
IronPort Systems
Founded in December 2000 by two of Internet messaging's original insiders: Banister, the Idealab 'VP of Ideas' who invented the bid-for-placement keyword auction behind Overture and sat on PayPal's founding board; and Weiss, an early Hotmail team member, as CEO. They staffed the company from Hotmail, eGroups, ListBot, and Yahoo, and bet on a then-contrarian idea - that spam would be beaten not by inspecting message content but by scoring the behavior and reputation of the machines sending it, delivered on purpose-built appliances. Roughly $90 million in venture funding had backed the thesis by 2004.
The timeline
- Founded in San Bruno
December 2000: Banister and Weiss start IronPort around sender reputation and the appliance model - white boxes for the email edge, at the moment spam is becoming an economic problem.
- SenderBase scales; SpamCop joins
SenderBase grows into the world's first and largest email traffic monitoring network: data from more than 100,000 ISPs, universities, and corporations, over 110 measured parameters per mail server, more than 5 billion queries a day. On November 24, 2003, IronPort acquires the SpamCop filtering and reporting service and runs it as a stand-alone entity.
- My chapterMy chapter
Late 2004 into 2005: the brief, independent engagement recorded in the narrative above - while IronPort's C-Series gateways are spreading through the mail edges of large enterprises and the biggest ISPs.
- The numbers before the deal
By August 2006: $25 million in quarterly sales, some 3,000 customers including eight of the ten largest ISPs, 408 employees, and marquee names like CNN, Microsoft, Nasdaq, and PayPal on the customer list. By the mid-2000s the platform is processing over 10 billion emails a day.
- Cisco pays $830 million
Announced January 4, 2007 and completed June 25, 2007: Cisco - itself a longtime IronPort customer - acquires the company for $830 million and folds it into the Security Technology Group. SenderBase is renamed SensorBase as other Cisco devices begin feeding the database.
Deal dates per the IronPort corporate record; $830M per Cisco's announcement.
- The brand retires; the name survives in DNS
November 26, 2012: IronPort formally moves onto the Cisco price list and the brand is retired. The tell survives to this day - Cisco's cloud email service still answers at iphmx.com: IronPort Hosted MX.
- The lineage today
The appliances became Cisco Secure Email Gateway and the cloud service Cisco Secure Email Cloud Gateway, both still running AsyncOS - and the SenderBase telemetry idea matured into Talos, Cisco's threat-intelligence group, which analyzes some 600 billion emails a day.
Flagship products and solutions
- C-Series email security gatewaysThe flagship appliances: multi-layered anti-spam, antivirus, and policy enforcement at the SMTP edge, built to sit in front of the world's largest mail systems.
- AsyncOSThe proprietary operating system - a modified FreeBSD kernel with a stack-less threading model that let a single appliance hold more than 10,000 simultaneous connections, built for the asymmetric bursts of SMTP traffic.
- SenderBase / SensorBaseThe reputation network that made the products work: global email telemetry scoring every sending server on the Internet, licensed even to the open-source community - and the ancestor of Cisco's Talos intelligence.
- SpamCopThe community spam-reporting and blocklist service, acquired in 2003 and deliberately kept independent - grassroots signal feeding an enterprise engine.
- Web security appliancesThe S-Series extension of the model to web traffic - the same reputation-first philosophy applied to HTTP, rounding out the gateway portfolio Cisco bought.
Key innovations
- Reputation before contentIronPort's core insight: who is sending predicts spam better than what is said. Sender reputation scoring became the industry's first line of email defense and remains so today.
- Telemetry as the productSenderBase turned the customer base into a sensor network - every appliance made every other appliance smarter, a network-effect model that Talos still runs at Cisco scale.
- The email appliance categoryPurpose-built boxes with a purpose-built OS for one protocol's pathologies - AsyncOS's stack-less design handled connection volumes general-purpose mail servers could not.
Main markets
IronPort defined the enterprise email security appliance market of the 2000s, guarding the mail edges of the biggest ISPs and a fifth of the world's largest enterprises before Cisco absorbed it. The category it created later moved to the cloud - where Cisco's successor service still carries IronPort's initials in its DNS.
My engagement, in late 2004 and 2005, belongs to the independent era - recorded here as its own chapter precisely because the acquisition came two years later.
Analyst standing
- SenderBase at the time of the acquisition: telemetry from more than 100,000 organizations, 110+ parameters per mail server, over 5 billion queries a day - the largest email monitoring network in the world, per contemporary coverage.
- The $830 million Cisco paid in 2007 bought a company running $25 million quarters with 408 employees - and a reputation network whose descendant, Talos, now analyzes roughly 600 billion emails a day.