Startup 'Ignites' Security Strategy for Channel

Sourcefire develops ‘Snort’ for enterprise

Printer-friendly version Email this CRN article

Sourcefire is looking to the channel to help it take advantage of the huge opportunity it sees with its commercial version of Snort, its open-source intrusion-detection system.

The startup, based here, recently rolled out its Ignite Partner Program, which provides partners with tools and training to sell and deploy its products. Sourcefire has a dozen partners so far and expects the majority of its revenue to come through partners in the next 12 months.

"Engaging the channel heavily is really the way to go to make the most of this opportunity," said Martin Roesch, Sourcefire founder and CTO.

Roesch says projections call for the majority of Sourcefire's revenue to come through partners in the next 12 months.

The opportunity Roesch refers to is Snort's large user base. Snort has been downloaded more than 500,000 times since he created it four years ago. Last year, he developed a commercial product around the open-source code and founded Sourcefire after a number of users told him that without commercial support, their companies wouldn't allow them to use Snort in the enterprise.

Paul Volkman, Sourcefire's vice president of domestic channels, added, "In the channel community and the enterprise, there is a lot of adoption, knowledge and acceptance of Snort. They were looking for the commercial version of the product to provide the consistency, training and support."

Roesch said he knew a Snort-based commercial product would have to add a lot of value. The best way to do that, he decided, would be to take away the "pain points" associated with managing and deploying Snort.

Sourcefire sells an appliance that Roesch said makes the intrusion-detection technology easy to deploy. The Sourcefire Network Sensor features an easy-to-use graphical user interface as well as data analysis and management capabilities. Sourcefire also offers a Management Console device that correlates data from multiple, distributed sensors.

The Network Sensor 2000 is priced at $9,995, and the Management Console is $14,995. Volkman said partners can earn margins ranging from 15 percent to 35 percent.

"A lot of companies have been appreciative of the open-source flexibility [of Snort, but they wanted a little more meat behind it," said John Gorman, president and CEO of Columbia-based Oleran Net Solutions. "It's going to have more acceptance in the enterprise as a commercial product."

Oleran Net Solutions was an early Sourcefire partner and had deals in the pipe-line before the company had a channel program in place, Gorman said. "They understand the importance of the channel," he said. "They appear very friendly and appreciative of what the channel can bring them."

Gorman said he believes the company will do well, based on Roesch's reputation and because of the "critical mass" behind Snort.

Sanjay Kalra, CEO of Icons, a North Brunswick, N.J.-based security firm and Sourcefire partner, agreed. "Snort has a very strong following," Kalra said. "It's great to see a company building upon the feature set that has already received the 'seal of approval' from a large security community.

"From everything we have seen, they are right on the mark with executing their business plan. They have raised funding in very difficult economic conditions. They seem to have a very talented development team that understands the complex intrusion-detection issues we face today," Kalra added.

Plus, the appliance model appeals to large corporations, Kalra said. But Sourcefire, like other security companies, faces the challenge of overcoming limited corporate budgets for security, he said.

Under Sourcefire's channel program, partners can sign up as an agent, referral or reseller partner. Partners achieve the status of Authorized, Managed, Gold or Platinum based on their level of resources and monetary commitment. In return, partners can earn product discounts or commissions, lead referrals, account management, training and marketing support.

Printer-friendly version Email this CRN article