Ruvi Kitov and the business of changing the rules

The office came before the idea. Ruvi Kitov and Reuven Harrison rented a small room near Tel Aviv, took on consulting work, and tried to decide what their company ought to make. A startup origin story usually arrives with the insight polished and waiting. This one had rent to pay.

By December 2004, they had sold their first product to three customers. The software helped businesses keep track of changes to their firewalls. It sounds like a modest ambition, particularly beside the grand promises that tend to accompany new technology. But someone inside a large company had to know which rules had changed, who had changed them, and whether the resulting network still made sense.

Kitov would spend most of the next two decades living with that problem. Tufin incorporated in 2005, listed on the New York Stock Exchange in 2019, and was acquired in 2022 in a transaction valued at approximately $570 million. The distance between the rented room and the exchange floor is considerable. The original question remained remarkably useful.

A round trip through Maryland

Kitov's route into computing was less predetermined than a founder biography might suggest. Born in Russia, he moved to Israel as an infant and to Rockville, Maryland, at 13. He liked mathematics and physics. A personal computer was beyond the family budget. His early interests pointed toward engineering, without yet specifying which kind.

After high school, he returned to Israel for military service, then enrolled at the University of Maryland in 1994. He graduated in 1997 with a computer science degree. Networking and security became his particular interests. A student website assignment introduced him to working with the internet; a Microsoft internship gave him another view of the industry.

There was also an imaginative attraction to the subject. Looking back on his introduction to encrypted communications and secure transactions, he connected it to his enthusiasm for spy novels. Here was a field in which keeping a secret had become a technical discipline. The novels supplied the intrigue; the coursework supplied rather more debugging.

In early 1998, Kitov joined Check Point in Israel, working on encryption. The company gave him practical experience of firewalls and of the businesses relying on them. It also put him among people who would eventually start security companies of their own. Harrison was one of them. Their working relationship would last far longer than either man's employment there.

“We prefer doing to talking.”

Ruvi Kitov, 2019

Three customers were enough to begin

The two developers left Check Point and began working together on their own business in 2004. Consulting provided income while they explored possible products. Their experience mattered: they understood the technology, knew people who used it, and could put a proposed solution in front of prospective buyers before committing themselves to a much larger organization.

SecureTrack addressed the management of firewall policies. A firewall can enforce a rule; an organization still needs to understand its collection of rules and what happens when someone edits them. For security teams, a reliable record of those changes has value even when nothing dramatic happens. Especially, perhaps, when nothing dramatic happens.

The initial product was small enough for a small team to build. Early sales supported more hiring and further development. For roughly four years, the founders built without outside investment. The constraints shaped the sequence: consulting, product, customers, expansion. A paying customer was both evidence that the problem existed and a contribution to next month's expenses.

Kitov learned business through the work itself, without an MBA. Spending required care. Growth had to be managed with the money available. It is easy to romanticize this arrangement after an acquisition; living through it means making decisions before the ending is known. A useful product can buy a little more time. It cannot promise the next sale.

The company's first customers were in Israel, followed by Europe. American buyers later arrived through its website. Harrison described that early entry into the United States as something of an accident. The founders had development backgrounds rather than sales careers. Their existing connections helped them begin, and demand traveled farther than their initial plans.

The paperwork inside the machine

By 2014, Tufin's product family included SecureTrack, SecureChange, and SecureApp. The progression extended beyond observing policies to automating changes and connecting application requirements with network security. Kitov's stated vision included testing and deploying policies automatically. The company was pursuing the organizational work surrounding the firewall as well as the rules inside it.

Consider the ordinary request to connect an application to another system. Somebody must establish what access it needs, check the security policy, arrange approvals, implement the change, and verify the result. This is an illustration of the problem, rather than a particular customer's incident. At enterprise scale, the distance between a request and its safe execution becomes a business problem.

Kitov's own writing resisted the notion that enterprise technology would cleanly discard its past. In 2020, he argued that firewalls would persist as businesses combined physical locations, data centers, and cloud services. New infrastructure could add to the management problem. The old equipment did not politely disappear because a new architectural diagram looked tidier.

That argument explains the attraction of the territory Tufin occupied. Complexity could survive a change in fashion. A business with several generations of systems still needed a coherent account of what could communicate with what. Kitov had chosen a problem whose vocabulary could sound dry while its consequences remained immediate to the people responsible for it.

A partnership with different appetites

Kitov described their division of labor plainly: Harrison had the stronger technical inclination; his own interests ran toward business and management. Both began as developers. Their roles developed around different appetites for the work, allowing the partnership to cover more ground than two identical job descriptions would have done.

His ideas about colleagues were similarly practical. In a 2011 interview, he named dedication, flexibility, and openness as qualities he valued. He objected to office politics and gossip, and to the damage self-interested behavior could do to the atmosphere around a team. An organization could have technically capable people and still become an unpleasant place to spend a working day.

There is a pleasing alternative biography tucked into that interview. When younger, Kitov had considered becoming a filmmaker or psychologist. Neither became his profession. Both interests make a recognizable cameo in the questions he kept returning to: how people behave, what they need, and how to make a complicated situation intelligible.

Wall Street enters the room

In April 2019, Tufin began trading on the New York Stock Exchange. For a business started through consulting and product sales, a public listing introduced a different set of obligations and audiences. Customers still needed software. Investors needed an account of the company's results and prospects. The founder had to operate in both conversations.

The story acquired less photogenic chapters. By December 2021, the share price was below its IPO level. Tufin was also moving from perpetual licenses toward subscriptions, a transition that could hurt near-term results while building recurring revenue. Kitov defended keeping cash available for the investment the change required. He was skeptical of the prices being asked for security startups.

That combination is more revealing than the exchange photograph alone. Building a company involves decisions whose costs and benefits arrive on different schedules. A subscription transition asks investors to accept disruption now for a hoped-for improvement later. A founder accustomed to explaining a product must also explain why a business model is changing underneath it.

Turn/River Capital completed its acquisition on August 25, 2022. Shareholders received $13 per share in cash, and Tufin ceased trading on the NYSE. Kitov's announcement emphasized continuing to help large organizations manage security and agility across complex networks. Ownership had changed. The operational problem that had supported the company was still there.

Knowing when to leave the chair

On January 10, 2023, Raymond Brancato succeeded Kitov as CEO. Brancato had already led Tufin's revenue organization for two years. Kitov remained a director and took an advisory role. It was a planned handover involving the new owners, giving the next phase of the company an executive who already knew its customers and commercial operation.

Kitov explained the decision in personal terms. His son Omer had been a baby when the venture began and was 20 by the time he stepped down. He wanted a vacation and more time with family. A company timeline records financings and appointments. His own comparison measured the same period through someone growing up.

He also returned to an agreement with Harrison: they wanted a workplace they would be proud to join as employees. Brancato's own introductory message praised the culture and said he had learned from Kitov about the market, technology, and ecosystem. The handover carried a concern for what would endure once the founder stopped running each day.

Back near the first sale

Kitov remains listed on Tufin's board. His more recent public activity also places him beside younger companies: he has described investing in seed-stage cybersecurity startups and helping them move from beta products toward initial sales. He asked former Tufin salespeople to help introduce those founders to security executives.

There is a familiar bottleneck in that request. A working product needs a buyer willing to give it attention. Someone has to make the introduction, understand the need, and earn enough trust for a first transaction. After a public listing, an acquisition, and a CEO handover, Kitov is again spending time around that early, consequential conversation.

The rented room has long since served its purpose. The work of finding the next customer has kept its place.