Pulse Secure opened the office. Then came the test.

The peculiar thing about an office door is how little you notice it until it stops opening. Pulse Secure built the digital equivalent: the connection between a person somewhere else and the applications waiting inside an organization. For a worker, it could look like a small client and a login. For the employer, it meant deciding which person, on which device, should reach which resource. The simplicity was the product. The machinery behind it was the business.

A company with a past on day one

Pulse Secure arrived in October 2014 carrying somebody else’s history. Siris Capital had bought Juniper Networks’ Junos Pulse business for approximately $250 million. This was a carve-out, complete with products and technical expertise. At launch, Pulse also acquired MobileSpaces, whose mobile workspace technology addressed the awkward overlap between personal phones and company information.

The combination made sense. Employees were bringing their own devices, and applications were spreading beyond the corporate data center. A network boundary could no longer explain where work happened. Pulse’s stated mission was to empower business productivity through secure and seamless mobility. The interesting word was “seamless.” Security was supposed to travel with the employee without becoming the employee’s main occupation.

The password was only half the question

The company’s work fell into two closely related jobs. Pulse Connect Secure supplied remote access to corporate resources through a VPN. Pulse Policy Secure handled network admission: identify the user, examine the endpoint and apply the organization’s rules. A recognized employee using a poorly protected laptop presented a different problem from the same employee using a compliant machine.

Policy could restrict access or direct a device toward remediation. Pulse One, launched in 2015, put central management around the expanding collection. The access client gave employees a common connection tool. These were enterprise products for administrators managing other people’s access, with enterprises and service providers as buyers.

That distinction matters when placing Pulse in the market. A consumer VPN sells an individual a connection service. Pulse sold organizations control over access to their own systems. Its alternatives included enterprise VPN offerings from Cisco and Palo Alto Networks, alongside application-access services such as Zscaler Private Access. A VPN tunnel and application-specific permission solve related problems with different boundaries.

The customers become easier to picture in a university support notice. Lesley University describes moving from Pulse to Ivanti and replacing its older gateway platform. Behind the branding change sat a practical requirement: reach designated campus resources from off campus. Integration mattered, too. Microsoft publishes instructions for connecting Pulse Connect Secure to Entra ID single sign-on. The gateway had to cooperate with the identity system an institution already depended on.

What the connection cost

The economics followed the access model. Omdia’s September 2020 report put the Essentials Plus suite’s starting annual subscription around $80 per concurrent user. Pulse Zero Trust Access started at $15 per named user per month on an annual subscription. Those historical starting prices measured different things: simultaneous connections versus identified subscribers. Neither is a current quote.

For a buyer, the useful calculation goes beyond license arithmetic. Capacity, deployment, support and the staff responsible for updates belong in the budget. A gateway can make remote work feel effortless precisely because somebody else is doing the effort. An organization that cannot maintain that responsibility has a purchasing problem no discount will fix.

Sell the bridge, not the demolition

Pulse’s commercial advantage was partly continuity. By September 2020, Omdia reported more than 24,000 enterprise customers and 21 million users of its technology. The installed base gave the company a reason to introduce new access methods without demanding an immediate replacement of everything customers already used.

A gateway can make remote work feel effortless precisely because somebody else is doing the effort.Operating lesson

Pulse Zero Trust Access used the same client as its VPN and network-access tools. Customers could add finer-grained application access gradually. This is a useful product lesson: make the next step compatible with the last investment. The appeal depends on a real need for coexistence. A company starting with no inherited infrastructure may put less value on that bridge.

The product portfolio also grew sideways. In 2017, Pulse acquired Brocade’s virtual application delivery controller business, adding traffic-management capabilities and a Cambridge research facility. The ambition extended beyond admitting workers to helping deliver the applications they used.

The door needed a lock of its own

The uncomfortable part of the story begins with the gateway itself. CVE-2019-11510 allowed an unauthenticated attacker to read files on affected Pulse Connect Secure versions. In 2020, CISA warned that stolen credentials could still be used after organizations patched the appliance. Closing a vulnerability could not take back a password already copied.

By January 2024, under Ivanti ownership, vulnerabilities in Connect Secure and Policy Secure had prompted emergency action. CISA ordered federal civilian agencies to disconnect the products by February 2. This was a change in the operating assumption: keeping the access service running could itself expose the organization.

The name changed. The responsibility stayed.

Ivanti completed its Pulse Secure acquisition on December 1, 2020. The price was undisclosed; the $872 million in the same announcement belonged to MobileIron. Connect Secure, Policy Secure and the client continued under Ivanti names. Legacy Pulse Connect Secure 9.1x reached end of support on December 31, 2024.

The current chapter remains active. On October 13, 2026, Ivanti disclosed limited exploitation of a vulnerability affecting certain Connect Secure versions and directed customers to remediation. Its current product materials describe an updated platform with Oracle Linux 9 and enforced system controls. Those changes deserve evaluation alongside the security record.

What can another company copy? Make access rules explicit. Check the device as well as the identity. Give customers a migration path. Then assign ownership of the gateway’s entire life, including the day it must be disconnected. The office door is easy to overlook. Its maintenance never is.