AlgoSec makes
the rules make sense

At T-Mobile, getting a grip on firewall rules took a six-month project. In an AlgoSec customer interview, security executive Peter Erceg described the work: understand the rules, analyze them, document them, and bring them into the required state. Buying firewalls had not made that knowledge arrive automatically. Someone still had to establish what all those permissions meant.

That is the wonderfully unglamorous territory AlgoSec occupies. A firewall decides which traffic can pass. AlgoSec helps people understand and manage the policies behind those decisions, across equipment from different vendors and across cloud environments. The everyday questions are surprisingly human. Who requested this access? Does anybody still need it? What happens if we remove it?

Six months to understand the rules

Erceg’s account gives the category a useful starting point. The initial cleanup was followed by maintenance, using AlgoSec’s change-management software to check that approved changes were actually implemented. Without that discipline, he explained, the organization risked needing another analysis exercise within six to twelve months. A clean rulebook has a short shelf life if people keep editing it elsewhere.

The company now reports more than 2,300 enterprise customers in 80 countries, including 20 of the Fortune 50. Its natural audience includes banks, insurers, telecommunications providers, and managed service providers. These buyers inherit networks with long memories: old applications, overlapping controls, acquisitions, migrations, and access granted for projects nobody has discussed in years.

Give the rule a business reason

AlgoSec’s organizing idea is to begin with the application. A collection of permitted addresses becomes more useful when someone can connect it to the service earning money or processing claims. Horizon, the platform released in 2025, brings that application context into policy management. It gives application owners and security engineers a common object to discuss, even when their everyday vocabularies differ.

The modules divide the work. Horizon Security Analyzer maps network topology, examines traffic paths, and flags risky or redundant policies. AppViz discovers application dependencies, using AI to suggest application candidates from network and change data. FireFlow handles the change sequence, from planning and risk analysis through implementation and validation. Its last step matters: closing a ticket should mean the intended access actually exists.

Horizon ACE extends policy visibility and management into multi-cloud environments. ObjectFlow tackles network objects, including duplicate or misaligned definitions. There is a pleasing specificity to that product: sometimes the obstacle to sophisticated security is simply that two places disagree about what a name means.

AlgoSec competes with Tufin and FireMon, which also sell visibility, policy management, and automation across mixed environments. Application context is AlgoSec’s central pitch, but the overlap is substantial. A sensible comparison uses the buyer’s actual devices, traffic paths, and approval requirements. A feature name cannot tell you how well a tool will model your particular network.

The upgrade that could wait

Natilik’s account of deploying AlgoSec at Rothschild supplies a more revealing test. Rule optimization reportedly removed the need for a planned firewall infrastructure purchase. Early difficulties involved approvals, change management, and integrating workflows. The technology arrived before the organization had finished agreeing how to use it.

“The money saved on after-hours work alone justified the tool within the first year.”

Robert Elgidge, Natilik
AlgoSec-published customer account

No contract amount accompanies that result. Elgidge describes standard licensing fees and additional personnel for internal change management. The economics therefore include both software and organizational work. His experience also suggests a boundary: small, simple environments may have too little complexity to justify a dedicated platform. The avoided purchase and labor savings belong to this deployment, not every prospective customer.

Patient money, expanding perimeter

Co-founders Yuval Baron and Avishai Wool established AlgoSec in 2004. Baron remains CEO; Wool remains CTO. Their business secured its first external investment in January 2018, when Claridge IL invested $36 million. The announcement described an already profitable company with more than 1,500 enterprise customers. Outside capital followed an established business.

The company’s overview still describes founder control and a customer-focused culture, including a money-back guarantee introduced in 2005. Its careers material lists accountability, teamwork, and thorough decision-making. Those are stated commitments. The guarantee is the more concrete detail: customer satisfaction enters the sales proposition as a financial promise.

Cloud adoption expanded the territory. AlgoSec acquired Prevasio in December 2022, adding agentless cloud posture and container-security capabilities. By July 2026, its Horizon A33.30 announcement emphasized broader cloud-managed firewall support, Azure Firewall automation, natural-language queries, and updated compliance reporting. The policy problem had followed applications beyond the data center.

Copy the sequence, keep the judgment

AlgoSec sells enterprise licenses and SaaS, alongside services, support, and training. Its ecosystem includes Cisco, AWS, ServiceNow, and automation tools such as Ansible and Terraform. These connections help place policy changes within existing work, where requests and approvals already happen. Integration is part of the buying decision, not a detail to postpone until after it.

Consider a proposed connection between an application server and a database. The useful output is more than a new rule: it is a record of the required path, the controls that block it, the risk assessment, and the resulting configuration. That is an illustrative request, but it explains why application knowledge belongs beside firewall knowledge. Either picture alone leaves questions unanswered.

There is also a practical way to test the sales pitch. Bring a recently completed change into an evaluation. Ask the vendor to reproduce its path analysis and explain the exceptions your engineers handled. Then examine the resulting evidence. The most persuasive demonstration is one your own team can challenge.

The transferable lesson is procedural. Map the application’s dependencies. Identify the relevant controls. Test the proposed access against policy. Decide who owns exceptions. Verify the result. Then keep the map current. Automation becomes useful when that sequence reflects reality; missing dependencies, unsupported devices, or unresolved approval roles leave gaps it cannot wish away.

T-Mobile’s six months of groundwork make more sense in that light. Understanding the rules was a project. Preserving that understanding was a continuing job. AlgoSec’s business lives in the distance between the two.