Vendor lineage
TippingPoint - four owners, and the bug bounty that outlived them all
An Austin IPS company that changed hands three times in eleven years. What survived every sale was not the appliance but the research programme attached to it.
TippingPoint is a network intrusion prevention line founded in Austin in 1999 and owned in turn by itself, 3Com, Hewlett-Packard and Trend Micro. It is the company that started the Zero Day Initiative, which is why it still matters long after it stopped being a company.
TippingPoint was founded in Austin, Texas in 1999 and traded on NASDAQ as TPTI before being bought. Its product was an inline intrusion prevention system - a box that sat in the traffic path and dropped attacks rather than reporting them afterwards, which in the early 2000s was the argument the whole category was having.
3Com agreed to buy it in December 2004 and finalised the purchase in 2005, paying around 430 million dollars in stock. THE SOURCES DISAGREE ON BOTH HALVES OF THAT SENTENCE: SecurityWeek and eWeek date the deal to December 2004, other accounts to 2005, and the price is reported as both 430 and 442 million. An agreement announced in one year and closed in the next explains the date; the price difference is not explained, and is left as reported rather than averaged into a number no source states.
Six months into 3Com's ownership, on 25 July 2005, TippingPoint started the Zero Day Initiative: pay independent researchers for vulnerabilities, disclose them to the vendor for patching, and protect the finder from the legal exposure that made reporting risky. It is the programme behind Pwn2Own, and it is still the largest vendor-agnostic bug bounty in the industry.
Hewlett-Packard acquired 3Com in 2010 for 2.7 billion dollars, and TippingPoint came with it. Five years later HP decided to partner in network security rather than own a business in it, and sold the line to Trend Micro - announced October 2015, closed 9 March 2016, 300 million dollars. Trend Micro kept the name, the Digital Vaccine Labs research team and the Zero Day Initiative.
The pattern is worth naming because it is not the usual one. A product line sold three times normally arrives at the third owner hollowed out. What TippingPoint carried through every sale was a research function, and each owner kept it - which suggests the acquisitions were partly ABOUT the research rather than the appliance.
- SecurityWeek: 3Com paid $430 million in stock for TippingPoint Technologies; HP acquired 3Com for $2.7 billion in 2010; Trend Micro completed its $300 million purchase from HPE
- Trend Micro newsroom: close of the TippingPoint agreement, 9 March 2016, including DVLabs and the Zero Day Initiative
- eWeek: 3Com acquired TippingPoint in December 2004; the deal marked the third owner in just over a decade
- Wikipedia: the Zero Day Initiative was started on 25 July 2005 by TippingPoint, then a division of 3Com