Virsec Systems gives software a smaller room to misbehave

Broadcom had a customer portal to protect. The stack included Java, Node.js and Nginx, the ordinary ingredients of an enterprise application. Its security problem was less ordinary: attacks could get past the controls already standing guard. In Virsec’s account of the evaluation, the question became whether a tool inside the running application could stop what the tools around it had missed.

That last detail gives the story its weight. A security demonstration can be theatrical. A production deployment has to survive Tuesday. According to the vendor-published case study, Broadcom tested efficacy, performance and usability before expanding. The interesting question was whether protection could become part of ordinary operations.

The permission slip inside the machine

Virsec Systems builds the Virsec Security Platform, or VSP. Its proposition begins with a boundary: identify trusted software and permitted execution, then block departures while the workload runs. The company calls this a positive security model. The phrase sounds bloodless until you consider the alternative: letting unfamiliar activity proceed while deciding how suspicious it looks.

VSP combines several controls. Host protection checks executables, libraries and scripts. Application policies constrain parent-child processes and command lines. Memory protection is designed to stop code injection and deviations in execution flow. These distinctions matter because an attacker can misuse a legitimate program. Recognizing the program’s name alone does not establish that every action it takes belongs.

This places Virsec in the workload-security market, alongside application control, cloud workload protection and endpoint defense. Its competitive argument concerns where enforcement happens and what it knows about application execution. An endpoint detection tool, a web firewall and a memory control have different jobs; Broadcom’s evaluation describes the value of adding a layer, rather than proving every other layer disposable.

The old server has a very current problem

Consider the operator of an aging business application. The operating system may be out of support. The application may depend on components nobody wants to disturb. Replacing it requires money, testing and a maintenance window. Meanwhile, a vulnerability does not wait for the calendar invitation. This is the uncomfortable gap Virsec targets with its legacy-workload offering.

Its materials describe runtime instrumentation that restricts processes, files, libraries and dependencies on older Windows and Linux systems. The practical benefit is a compensating control when immediate patching is difficult. Protection against exploitation and repair of vulnerable code remain separate tasks. Buyers gain the most from understanding exactly which task they are purchasing.

“Virsec focuses on what applications should be doing”Satya Gupta, co-founder and CTO, speaking to SecurityWeek in 2019

The customers fit that problem: enterprises, healthcare organizations, government and critical infrastructure. A testimonial in Red Hat’s ecosystem catalog describes SHBC using Virsec on more than 100 servers. Together with Broadcom’s application-instance count, it offers a glimpse of deployment scale. The units differ, and neither number is a census of Virsec’s business.

A firmware mind meets the sales department

Co-founder Satya Gupta did not begin with a computer-science degree. He studied chemical engineering at IIT Kanpur, then earned a master’s at the University of Massachusetts Lowell. His subsequent work included firmware, networking and embedded industrial-control systems. His university biography dates his Virsec founding role to 2015. It is a background suited to asking what a machine is supposed to do.

Building the control was one challenge. Getting it purchased was another. In June 2020, founding investor Dave Furneaux became CEO, while Atiq Raza moved to executive chairman. CRN described a company sharpening its sales and marketing after introducing its product in late 2018. The evidence points to a commercial adjustment: an engineering-led organization needed a more developed route to buyers.

Partners supplied part of that route. Raytheon helped reach government and public-sector customers; Tech Mahindra brought systems-integration reach. Red Hat’s catalog now lists a Virsec offering using Ansible Automation Platform. For a buyer managing a fleet, repeatable deployment and administration belong in the product conversation alongside attack prevention.

The capital was public. The price is a conversation.

Virsec announced a $24 million Series B in March 2018 and a $100 million Series C in July 2021. The latter announcement put total funding at $137 million then. Investors were financing product development, staffing and expansion. Those amounts measure capital raised, not what an enterprise pays to protect its servers.

The sales journey begins with a demo request and discussion of the environment. For a buyer, the useful cost calculation extends beyond a license: deployment effort, performance, policy administration and the operational price of blocking something legitimate. A pilot should make those costs visible before a fleet-wide decision.

The evaluation also needs a definition of success. Blocking a test attack is one result; preserving scheduled jobs, integrations and recovery procedures is another. Those checks turn an appealing security principle into an operational decision. They also give procurement something concrete to compare across products whose marketing language can sound remarkably similar.

Keep the verbs. Check the nouns.

In April 2025, Virsec launched OTTOGUARD.AI around patchless vulnerability mitigation. Its current homepage describes OTTOGUARD.AI as a new startup and directs visitors there, while continuing to promote VSP. That distinction matters when evaluating today’s offering. A dated launch announcement and a current product catalog answer different questions.

The transferable idea is precise: begin with a bounded workload, establish permitted execution, and test the exceptions. A sensible evaluation would include a planned upgrade, an unusual authorized task and an attempted unauthorized action. Fast-changing applications demand particular care around trust updates. An inaccurate permission boundary can obstruct useful work, while unprotected workloads remain outside it. Virsec’s proposition earns its place when the boundary holds and the business keeps running.