A hospital can buy a risk assessment and still be left with a difficult question: who is going to do the work? The findings need decisions, budgets and people who can turn them into a security program. Delphiis built its business around that awkward interval between identifying a problem and getting an organization to address it.
- Software organized risk assessments; consultants helped build the program.
- Hospitals and health systems were the central market.
- Auxilio bought Delphiis in 2014; its technology later supported RiskSonar.
The company sold a combination: professional advice, recurring managed services and software delivered over the internet. That mix matters. A customer could buy a tool for assessing risk, then buy help with the continuing responsibilities the assessment exposed. Delphiis occupied the space where a software subscription meets an understaffed security department.
The soft skills inside the software
Mike Gentile, Delphiis’s co-founder and chief technology officer, had spent years developing enterprise security programs through Coastline Consulting. He also co-authored The CISO Handbook and a second book with a wonderfully unglamorous subject: CISO Soft Skills: Securing Organizations Impaired by Employee Politics, Apathy, and Intolerant Perspectives.
The title is a useful clue. It places office politics and human cooperation inside the security problem. Gentile’s publisher biography described his ambition as making security more collaborative and repeatable. Read alongside Delphiis’s service offering, that suggests a practical premise: better information has limited value when an organization cannot organize itself around the response.
In December 2012, Delphiis announced Chris Rogers as president and CEO, succeeding Gentile, who continued as CTO. Rogers arrived with experience running technology services businesses, most recently as general manager of FusionStorm Managed Services. The appointment gave the growth plan a dedicated operator while Gentile remained attached to the technology.
The report was only the start
Delphiis’s customers included university hospitals and major health systems. Its software helped organize security risk assessments; its services covered program development, remediation planning and continuing security work. For a healthcare buyer, the appeal was a connected process spanning the assessment and what followed.
The application was called Delphiis IT Risk Manager in Auxilio’s filings. It supported assessments involving hospitals, clinics, projects and business associates. Those are different units of responsibility inside a complicated organization. Giving them a repeatable assessment process could make findings easier to compare and communicate. That is the product logic, rather than a claim that every customer achieved the same result.
- 01AssessCollect and organize risk findings
- 02PlanDevelop the program and remediation work
- 03ContinueSupport ongoing security responsibilities
The money came from three streams: professional-services work, recurring managed services and SaaS license fees. Software supplied repeatability; people supplied expertise and capacity. The distinction is useful when comparing Delphiis with a standalone assessment application. A hospital buying this combination was also buying access to people who could help carry the resulting workload.
Auxilio’s later filings described assigning an expert to a defined security role, on-site or virtually, for a specified period. They also named Accenture, KPMG, Dell SecureWorks and Coalfire among the competing security service providers. Delphiis’s market position rested on its healthcare focus and its combination of assessment technology with services.
Consider a hypothetical hospital reviewing a supplier. Collecting answers is one job. Deciding whether the answers are adequate is another. Agreeing on corrective work introduces a third set of conversations. A tool can keep the information together, but someone still has to make judgments and pursue the response. That is an organizational task with a technical subject.
The buyer already had a way in
The surprising buyer was a company familiar with hospital printers. In July 2014, Auxilio announced its acquisition of Delphiis at approximately $2.7 million. Auxilio already served more than 100 hospital campuses through managed print services. That was the buyer’s existing reach, a potential route to customers for the acquired security business.
The pairing had an operational logic. Hospitals handle information on paper as well as in systems, and Auxilio already had relationships and field staff in that environment. Gentile pointed to overlapping decision makers and customers. The acquisition offered Delphiis a distribution opportunity; Auxilio expected another service to sell through relationships it had already built.
“simple, fast and collaborative solutions”Mike Gentile, describing the mission in the 2014 acquisition announcement
The announced consideration combined $1 million in cash, stock contractually valued at $1.25 million and about $464,000 in assumed debt. Management retention arrangements were additional. These figures describe the acquisition’s economics. They are not a venture funding round or a price a hospital paid for the software.
Early reporting sounded encouraging. Auxilio attributed roughly $400,000 of third-quarter 2014 revenue to Delphiis consulting and software subscriptions. Management also reported renewals and expanded customer contracts. The initial case for bringing the businesses together appeared to have something behind it.
Then the numbers changed
At the end of 2016, Auxilio recorded impairments against Delphiis: $667,050 in intangible assets and $837,126 in goodwill. The filing tied its review to business-unit performance and changes in strategy and outlook. The financial expectations had weakened. Those accounting charges establish a disappointment; they do not, by themselves, diagnose a software defect.
The technology nevertheless continued to have a role. In 2017, CynergisTek described integrating RiskSonar, a tool from the Delphiis acquisition, into vendor security management. Auxilio adopted the CynergisTek name that year. Clearwater acquired CynergisTek in September 2022 and announced a common Clearwater brand in May 2023.
There are two different stories here, and keeping them separate makes the history more useful. One concerns whether an acquisition produced the financial value its buyer expected. The other concerns whether acquired technology could serve a later product. The impairment and the RiskSonar integration answer different questions. Neither makes the other disappear.
Give the findings somewhere to go
The useful lesson is operational: plan the response while buying the assessment. Decide who will interpret findings, choose priorities and keep work moving. Delphiis’s combination of software and services was an attempt to make those responsibilities easier to connect.
For a team studying the model, the handoff deserves attention: what happens when an assessment is finished, and which responsibilities continue? Those questions connect the product to the service. They also explain why a repeatable process and recurring expert support could belong in the same purchase.
That approach depends on participation. Outside experts need access, internal decision makers and the authority to move agreed work forward. A hospital that only needs a narrow assessment may not need continuing services. An organization unwilling to act on findings will get limited benefit from better reporting. Delphiis’s history makes the distinction concrete: organizing the work can be valuable, while the business built around it still has to earn its purchase price.