Before Fortra was a cybersecurity company, it was a practical answer to a boring night shift. In 1982, three former Arthur Andersen consultants - Richard Jacobson, Tom Mueller and Tom Leahy - started Help/38 in Minnesota. Their first product, Robot/38, scheduled the overnight work that kept IBM System/38 shops moving: run the sales figures, produce the reports, log what happened, tell the operator when something went wrong. It was not glamorous. It was useful.
That origin still explains more about Fortra than the modern language of AI platforms does. The founders brought an auditor's reflex to software. Record the authorized user. Preserve a history. Build for the person operating the system, not merely the programmer admiring it. When IBM replaced the System/38 with the AS/400, Help/38 became HelpSystems. The machine changed; the habit of automating consequential work did not.
The long pivotAn IBM night-shift tool grows teeth
The decisive turn began after the founders retired and sold the company to Summit Partners in 2005. HelpSystems added business intelligence and its first security acquisition. International expansion followed. By 2010, cybersecurity had moved from an adjacent category to a deliberate acquisition program covering data security, information security and identity governance.
Then came the shopping years. Core Security brought penetration testing. Strategic Cyber brought Cobalt Strike, the red-team tool that emulates a sophisticated attacker. Titus and Boldon James added data classification. The 2021 haul included Digital Guardian for data loss prevention, Agari for email defense, PhishLabs for digital risk, Beyond Security for vulnerability management and more. Tripwire, Alert Logic, Terranova Security and Outflank arrived in 2022.
The checks behind most of those deals were not disclosed. Neither were the values of the 2019 investment by TA Associates and Charlesbank, or the 2021 minority investment led by Harvest Partners SCF alongside existing backers. The public record shows the method, not the bill: private capital funded a company that bought specialist depth across the attack chain, then sold that breadth through a global commercial machine.
The product problemThe shelf is not the platform
A broad portfolio is easy to describe and hard to operate. Fortra now covers data discovery and classification, DLP, cloud and email security, brand protection, secure file transfer, vulnerability management, red teaming, managed services and the IBM i work that predates most of the security market. Buyers can choose modules, cloud delivery, on-premises software or a managed service. Security and IT teams in finance, healthcare, energy, government, manufacturing, retail and technology are the natural customers.
The obvious alternatives depend on the job. Proofpoint and Mimecast compete in email. Forcepoint and Broadcom appear in DLP conversations. Progress MOVEit, IBM Sterling and Axway meet Fortra in managed file transfer. Rapid7, Tenable and Qualys cover vulnerability work. Microsoft, Palo Alto Networks, CrowdStrike and Fortinet sell their own versions of the broad-platform argument. Fortra's difference is the combination of offensive tools, defensive controls, file movement and old-school enterprise operations under the same roof.
“Customers are overloaded with a dizzying number of security tools. But they don't talk to each other.”John Grancarich, at the 2024 Fortra platform launch
In May 2024, the company finally named the integration layer simply “Fortra.” The pitch was less console, more connective tissue: a common agent for deployment and patching, normalized telemetry from different products, AI-assisted correlation, and clearer incident activity. Cloud Email Protection, XDR and vulnerability management were in the opening version, with data protection planned next. In 2025, buying Lookout's cloud-security business added CASB, zero-trust network access, secure web gateway and data-security posture management.
Those are company-reported volumes, but they clarify the wager. More products can mean more signals; shared intelligence can make each control less lonely. Fortra says more than 400 threat researchers and data scientists feed that system. Its July 2025 email release used a language model to judge message intent, clustered low-content scams into campaigns, inspected suspicious URL structure and combined model outputs into a risk score. The company said those updates stopped more than 87,000 additional email threats in May.
A peculiar assetThe burglar's tool in the locksmith's bag
Cobalt Strike makes Fortra's position unusually vivid. Authorized red teams use the software to imitate a capable intruder: establish a command channel, move through a network and discover whether defenders can see the behavior before something valuable disappears. That realism made the product useful to customers and irresistible to criminals. Cracked, outdated copies became common infrastructure in malware and ransomware operations. Fortra did not invent that dual-use problem, but buying the product meant owning it.
In 2023, Fortra joined Microsoft's Digital Crimes Unit and the Health Information Sharing and Analysis Center in a court-authorized campaign against malicious infrastructure using those pirated copies. Microsoft and Fortra used copyright claims and technical evidence to seize or disable domains and accounts. The coalition was not trying to erase legitimate Cobalt Strike. It was narrowing the gap between a licensed assessment tool and stolen versions that had become cheap equipment for attackers.
That is also a compact demonstration of what Fortra can offer beyond another alert feed. It owns offensive expertise, sees defensive telemetry and maintains relationships with industry groups and law enforcement. A bank or hospital can use its products to classify sensitive records, prevent them leaving an endpoint, inspect suspicious email, move files with an audit trail, test whether the controls hold and hand parts of the monitoring burden to a managed team. Few buyers need every component on day one. The platform logic works when each additional module contributes context without demanding another parallel workflow.
What the integrated pitch is supposed to do
The trust testThe file-transfer door swung open
Platform companies inherit every product's upside and every product's scar tissue. On January 30, 2023, Fortra detected suspicious activity in some hosted GoAnywhere MFT environments. Attackers had exploited a previously unknown remote-code-execution flaw, later labeled CVE-2023-0669. The first technical failure was a vulnerable administrative surface; exposed on-premises admin portals represented the higher-risk configuration. The operational reality was worse: unauthorized accounts appeared, and files were downloaded from a subset of hosted customer environments. The Clop group claimed roughly 130 victims.
Fortra temporarily took the hosted service offline, investigated with Palo Alto Networks' Unit 42, patched the product, rebuilt clean hosted environments and gave customers indicators and mitigation guidance. Its April summary said the incident was isolated to GoAnywhere, but outside reporting found that some breached customers initially received assurances their data was safe. Communication became part of the failure story, not merely the response.
GoAnywhere faced another maximum-severity deserialization flaw in 2025. Researchers reported evidence of exploitation before the public advisory. The practical lesson is uncomfortable and portable: consolidation does not remove security work. It concentrates the trust. A unified platform helps only when internet-facing consoles are restricted, supported versions are inventoried, patches move quickly and incident messages change as the evidence changes. Without that operating discipline, integration can give a weak component a larger blast radius.
The copyable moveThe $4 million policy map
Do not start with the block button.
A large North American natural-gas producer needed contractors to use sensitive seismic, engineering and investment data through Citrix. Its first approach required laboriously customizing every published application. A separate Citrix farm looked cleaner but cost too much.
Digital Guardian first documented legitimate data flows, then classified content and enforced context-aware policy at 14,000 workstations and 400 Citrix servers. Approved moves continued; unapproved drives and applications were blocked. The customer reported more than $4 million in avoided hardware, software and physical-security expense.
That case contains the most reusable part of Fortra's playbook. Map how work should happen before enforcing how it must not happen. Put controls inside the existing workflow. Preserve useful access for employees, contractors and privileged administrators. Measure avoided complexity, not merely alerts. The approach becomes a poor fit when the organization cannot define authorized flows, lacks reliable classification, cannot deploy endpoint enforcement, or treats policy as a substitute for identity, segmentation and patching.
A narrower companyBuying cloud security, selling automation
Fortra's recent portfolio moves suggest the company has become more willing to choose. In 2025 it agreed to sell JAMS and Skybot, workload-automation businesses close to its historical roots, while acquiring Lookout's cloud-security operation. In 2026 it formed a Defense and Intelligence Unit and, on September 1, announced an advisory board of former military and government leaders. The target is secure classification, governance and sharing for U.S., Five Eyes, NATO and allied missions.
The go-to-market model is similarly layered. Large organizations can buy software and run it themselves, subscribe to cloud-delivered controls, or pay Fortra specialists to operate pieces of the defense. Distributors and resellers carry the products into regions and regulated markets; Carahsoft has served as a U.S. government aggregator since 2019. That flexibility matters to a hospital with a thin security staff or a defense customer that cannot put every workload in a public cloud. It also makes integration harder: one platform must respect different update windows, data rules and procurement paths.
Inside the company, the old HelpSystems language of “Minnesota nice” has been stretched across offices in more than 15 countries. Fortra formed a diversity, equity and inclusion council in 2020 and built employee resource groups as it absorbed new teams. U.S. News placed the company on its 2026 workplace list in four categories, reporting top marks for flexibility, work-life balance and physical and psychological safety. Those ratings are not a product metric, but acquisition strategies depend on whether specialist teams stay long enough to integrate what they built.
Where it wins
Large organizations that want fewer vendors, shared threat intelligence, flexible deployment and coverage spanning data, email, files and offensive testing.
Where specialists win
Teams that need the deepest standalone tool, have already standardized elsewhere, or cannot absorb the integration and migration work behind consolidation.
How it gets paid
Enterprise software subscriptions and licenses, maintenance, cloud delivery, managed security and professional services, often sold through channel partners.
What remains private
Current revenue, profitability, valuation, deal prices and product-level economics are not publicly reported.
Today, Fortra says it serves more than 7,200 organizations with more than 2,000 security professionals across over 15 countries. It displays names such as American Express, Coca-Cola, FedEx, Mastercard, Nike and Salesforce. LinkedIn places the total company between 1,001 and 5,000 employees. Matt Reck, previously president and chief financial officer, now leads it as chief executive.
The business has traveled a long way from Robot/38, yet the sharpest version of its argument is almost identical to the one from 1982: complicated systems should do more of the routine work, tell operators what matters and leave an audit trail. Fortra has already proved it can assemble the parts. The next proof is whether customers experience a coherent machine rather than a well-stocked cabinet - and whether the company can keep every door in that cabinet worthy of trust.