Tufin’s Bet: The Firewall Is Fine. The Policy Sprawl Is the Problem.

The most dangerous sentence in a large company may be: “It’s only one firewall rule.” The request arrives as a ticket, but the route may cross a data-center firewall, an Azure security group, a Zscaler policy and a device nobody remembers installing. Someone has to find the path, decide whether the access violates policy, ask for approval, configure each control, verify the result and leave enough evidence for an auditor six months later. By then, the “one rule” has acquired a supporting cast.

Tufin sells software for that supporting cast. Founded in 2005 by former Check Point engineers Ruvi Kitov and Reuven Harrison, the company sits above network-security products rather than competing to become the next one. Its Orchestration Suite reads configurations across vendors, builds a map of how traffic can travel, evaluates proposed changes against a common policy and then manages the workflow from request to implementation. The pitch is less “buy a better firewall” than “stop asking every firewall to explain itself in a different language.”

01The product is a translator with veto power

SecureTrack+ is the eyes: centralized policy visibility, topology, rule analysis, compliance checks and change tracking. SecureChange+ is the hands and the paperwork: a configurable process for designing, approving, provisioning and verifying access. SecureApp reorganizes the same problem around business applications, so a payment system’s connectivity is treated as a living dependency rather than a pile of IP addresses. TOS Discovery helps draw the network map. The newer TufinAI features let operators search rules and policy exceptions in natural language or begin an access request without memorizing every field.

The distinction matters. A script can push a rule quickly. Tufin is selling confidence that the rule is necessary, correctly scoped and attached to an accountable process before anyone pushes it. Its unified security policy acts as the house constitution. A proposed change that violates a segmentation standard can be stopped or escalated, whether enforcement happens in Palo Alto, Fortinet, Cisco, Check Point, AWS, Azure, Google Cloud or Zscaler.

02The first failure was the handoff

Tufin’s case studies are most useful when they describe what broke before the software arrived. At RWE Supply & Trading, the early problem was outsourced operations with limited visibility. SecureTrack helped the company see changes, but visibility exposed the next bottleneck: email approvals and a process that was difficult to audit. Then AWS arrived. Cloud resources could appear in minutes, while the number of policy changes needed to connect them to on-premises systems tripled. The cloud was fast; the approval chain was not.

That changed the team’s mind about what to automate. The target was not simply the final device configuration. RWE built an auditable workflow, imported 500 existing requests and used automated risk analysis to reserve human attention for higher-risk changes. It is a subtle but repeatable move: automate the sorting and context first. Otherwise the engineer at the end of the queue still receives a ticket with too little information, only faster.

“They get less complaints that the change process is too slow.”Ralf Buchroth, network operations expert, RWE Supply & Trading

A global professional-services organization supplied the neatest cost ledger. It had 200 corporate firewalls and wanted to absorb 600 more from subsidiary units. The initial estimate for consolidation was nine months. Using SecureTrack and SecureChange, the firm said it finished in 3.7 months, removed thousands of obsolete or redundant rules and saved 1,400 labor hours - about $300,000 against projected cost. It also reported a 10 percent efficiency gain in the regions where the platform had been deployed.

What failed first there was not firewall uptime. It was rework. A redundant request could travel through planning, analysis and approval before an engineer discovered that the access already existed. Detecting redundancy at intake deleted the ticket’s entire future. This is the company’s best economic argument: the valuable action is often not making a change. It is proving that no change is required.

03A business built for heterogeneity

Tufin’s natural customer is a large, regulated organization that has acquired infrastructure the way an old house acquires wiring. Banks, governments, utilities, healthcare providers, retailers and telecom operators show up repeatedly in its public customer list. So do companies with hundreds or thousands of enforcement points, multiple clouds, separate regional teams and auditors who expect the same policy to survive all of them.

The company says it serves more than 2,000 customers. Named references include ABN AMRO, Bloomberg, BMO, BNP Paribas, Deutsche Bank, MassMutual, MetLife, RWE, TransUnion, Fujitsu, AutoNation and the State of Michigan. One recent energy-company case describes five firewall vendors, AWS, Azure and 25,000 Zscaler users under a common governance layer. That is the environment where vendor neutrality stops being a brochure phrase and becomes the job.

Subscriptions come in SecureTrack+, SecureChange+ and Enterprise tiers, with add-ons for application-centric management, topology, provisioning, discovery and self-service. Support, training and professional services add another revenue stream. Tufin publishes the menu but not the check; prospective customers must request a quote. The known price attached to the company itself is more dramatic. It raised about $28 million privately before its 2019 IPO, sold shares at $14 and raised roughly $124 million gross after the underwriters exercised their option. Turn/River Capital then bought the company in 2022 for about $570 million in cash, or $13 a share, taking it private.

04Why not use the firewall vendor’s console?

For a tidy Palo Alto-only network, the answer may be: use Palo Alto’s tools. Native consoles understand their own products deeply, and a small team may prefer fewer layers. Tufin earns its place when no single vendor owns the whole route. Its direct competitors - AlgoSec and FireMon, historically joined by Skybox - make a similar cross-vendor argument. Home-grown alternatives combine ServiceNow tickets, scripts, infrastructure-as-code and patient engineers.

Tufin’s differentiation is the combination of topology, policy reasoning and change orchestration. It tries to answer three questions in one system: Can this traffic flow now? Should it be allowed? Which controls must change to make the approved intent real? The integrations are part of the product, not decoration. ServiceNow can remain the familiar front door while Tufin supplies design and risk analysis behind it. Microsoft integration reaches Azure Firewall and network security groups. Zscaler support extends the same logic toward SASE. An Open Policy Model gives partners and customers a route to onboard controls outside the standard list.

The 2025 and 2026 releases show where the market is pulling the platform. R25-2 added Azure NSG provisioning, proactive violation detection for AWS and Google Cloud, broader Zscaler design and optimization, and AI-assisted rule search. A later feature release added natural-language search for policy exceptions, expanded Fortinet policy-block support and widened Aruba EdgeConnect and VMware NSX coverage. Tufin is moving from “firewall management” toward a unified control plane for cloud, edge and SASE - a larger promise and a much larger integration burden.

05The part you can copy before buying anything

The best ideas in Tufin’s operating model do not require a purchase order. Start by defining connectivity in the language of applications and approved services, not raw ports passed between teams. Build a canonical policy that says which zones and systems may communicate. Reject duplicate access before it enters an approval queue. Require every exception to have an owner and expiration logic. Keep the request, decision, implementation and verification in one audit trail. Measure elapsed time and rework, not merely the number of changes closed.

Then run a production pilot. The energy company with five firewall vendors did not bet the estate on a slideshow; it tested the governance layer against real infrastructure and expanded over 18 months. A proof of concept should include an awkward path across vendors, an existing redundant rule, a policy violation, a rollback and an auditor asking why the access exists. A clean demo network proves very little.

There are conditions under which it will not work well. Incomplete topology produces confident answers about the wrong network. Unsupported devices create blind spots. A company that cannot agree on policy will merely encode its disagreement. Teams may resist a workflow that makes informal exceptions visible. And automation can multiply a bad decision as efficiently as a good one. Tufin reduces the cost of governed change; it cannot manufacture governance from missing ownership.

06Twenty years later, the mess got bigger

Kitov and Harrison started with a problem they had watched closely as Check Point engineers: firewall estates were becoming too complicated to reason about device by device. The bet survived because the industry kept adding dialects. Virtual networks arrived, then public clouds, Kubernetes, SD-WAN, SASE and zero-trust segmentation. Each promised cleaner architecture. Together they produced another generation of policy sprawl.

Tufin today is private, led by CEO Raymond Brancato, and describes a workforce of more than 500 across five sites and 14-plus countries. Its stated values - collaboration, customer success, resiliency, respect and operational excellence - sound conventional. The more revealing cultural fact is the product itself: this is a company that has spent two decades caring about the change ticket everyone else wants to close.

That is also the sober way to understand the AI chapter. Natural-language search can make a vast rule base easier to interrogate, but the durable asset is the model beneath the prompt: devices, routes, applications, policies, exceptions and history. The chatbot is the new door. The old work is making sure the room behind it is organized.

Tufin’s wager is not that enterprise networks will become simple. It is that they will remain complicated enough to need a constitutional layer above the equipment. For the right customer, the payoff is wonderfully mundane: fewer tickets that should never have existed, fewer rules nobody owns, faster changes that can survive an audit, and an engineer who gets an afternoon back.