Sourcefire

Sourcefire, Inc
Company type	Public (until acquisition)
Industry	Network security
Founded	2001; 25 years ago
Founder	Martin Roesch
Defunct	July 23, 2013
Fate	Acquired by Cisco Systems
Headquarters	Columbia, Maryland, United States
Area served	Worldwide
Key people	Martin Roesch (Founder)
Products	Firepower series, Snort IDS/IPS, Immunet antivirus, Advanced Malware Protection (AMP)
Parent	Cisco Systems (since 2013)

Sourcefire, Inc was a company focused on developing hardware and software solutions for network security. Its Firepower series of network security devices were built upon the open-source Snort intrusion detection system. In July 2013, Cisco completed the acquisition of Sourcefire for $2.7 billion.

Background

Established in 2001 by Martin Roesch, the original developer of Snort, Sourcefire transformed Snort into a commercial product through the Sourcefire 3D System, which later evolved into the Firepower suite. The company maintained its headquarters in Columbia, Maryland and operated several international offices.

Financial

Sourcefire's expansion was fueled by $56.5 million obtained through four rounds of venture capital funding from investors such as Sierra Ventures, New Enterprise Associates, and Sequoia Capital. In 2005, Check Point Software made an attempt to purchase Sourcefire for $225 million but retracted the offer due to regulatory issues. The firm went public in March 2007, securing $86.3 million in capital, and acquired Clam AntiVirus later that same year.

In May 2008, Sourcefire rejected a $187 million acquisition proposal from Barracuda Networks. The company broadened its offerings by acquiring the cloud-based antivirus provider Immunet in January 2011.

For Q4 2012, Sourcefire reported revenues of $67.4 million, marking a 27% increase compared to the previous year, with total annual revenue reaching $223.1 million—a 35% rise over 2011 figures. International sales surged by 77%, totaling $74.4 million. By December 2012, cash reserves and investments amounted to $204 million.

The company received notable industry accolades, including SC Magazine’s 2009 "Reader Trust" award recognizing Snort as the best IDS/IPS solution and Network World's "2009 Best of Tests" honor for the Sourcefire 3D System.

On July 23, 2013, Cisco announced its plan to acquire Sourcefire for $2.7 billion, aiming to strengthen its cybersecurity offerings.

Firepower

The Firepower product family from Sourcefire delivers multi-layered security appliances available as:

Next-Generation Intrusion Prevention System (NGIPS), which provides comprehensive network visibility covering hosts, operating systems, applications, protocols, users, content, behaviors, and threats.
Next-Generation Firewall (NGFW) that integrates NGIPS capabilities with access control, application management, threat prevention, and firewall features.
NGIPS devices equipped with built-in application control, Malware defense, and URL filtering functionalities.
Specialized Advanced Malware Protection Appliances designed for inline protection against sophisticated malware threats.

Advanced Malware Protection

Sourcefire Advanced Malware Protection (AMP) utilizes big data analytics to identify and prevent malware across networks and endpoints, effectively countering advanced persistent threats (APTs) and targeted cyberattacks. AMP provides ongoing evaluation and retrospective alerting powered by cloud-based security intelligence.

Deployment options for AMP include inline integration via product keys on NGIPS, dedicated Firepower appliances designed for AMP, or directly on endpoints—including virtual machines and mobile devices—through FireAMP.

Snort

Snort is an open source network intrusion prevention and detection system that uses a rule-based language combining signature, protocol, and anomaly detection techniques. Developed collaboratively with the Snort community, it ranks among the most extensively implemented intrusion detection solutions worldwide.

Immunet

Immunet combines cloud-hosted virus definitions with the open source Clam AntiVirus toolkit to offer antivirus protection primarily targeting e-mail gateways. It features tools such as a multi-threaded daemon and a command-line scanner. Previously available in Free and Plus editions, Immunet Plus was discontinued in June 2014, transitioning support solely to the Immunet Free version under Cisco’s management.

Sourcefire Vulnerability Research Team

The Sourcefire Vulnerability Research Team (VRT) consisted of network security experts focused on detecting and analyzing hacking methodologies, intrusion attempts, and software vulnerabilities. Its membership included contributors from the ClamAV project as well as authors of influential cybersecurity literature. Backed by the open source communities behind Snort and ClamAV, the VRT specialized in crafting vulnerability-based rulesets aimed at protecting both Sourcefire clients and Snort users from new exploit threats.

The team was instrumental in delivering zero-day defenses against malware outbreaks such as Conficker, Netsky, Nachi, Blaster, Sasser, and Zotob. Additionally, it offered same-day mitigation for vulnerabilities disclosed during Microsoft Tuesday updates, maintained the official Snort rules utilized by the Sourcefire 3D System, and managed shared object rules compatible across various platforms.

Following Cisco’s acquisition of Sourcefire in 2013, the VRT merged with Cisco’s TRAC and SecApps teams to establish Cisco Talos. The Talos brand was officially launched in 2014 at Blackhat, marking an expansion of Cisco’s global cybersecurity intelligence capabilities.

External links