ForeScout: A start-up to watch

Counterintelligence is ForeScout's forte. The company's debut product, ActiveScout, sits on a server outside the firewall and monitors incoming network traffic. Specifically it watches for suspicious behavior in the form of reconnaissance probes, such as port scans that attackers often use prehack to gather information about system configurations or users. When ActiveScout identifies what appears to be a hacker scanning for network vulnerabilities, the Linux-based software feeds the suspected attacker bogus tagged data, such as usernames and passwords. If a hacker tries to send traffic based on the false network data, ActiveScout immediately blocks it.

ForeScout says its technology will reduce the number of false alarms that network managers have to chase down because the software only reacts when the bogus data is presented. Plus, because it works by identifying reconnaissance probes, ActiveScout doesn't require constant signature file updates for new viruses and hacking exploits as do typical antivirus and intrusion-detection products. Still, ForeScout faces the challenge of convincing enterprise security managers that they need this new kind of tool. ActiveScout doesn't replace firewall or intrusion-detection systems but supplements and integrates with them.

ForeScout, in San Mateo, Calif., wouldn't say how many customers it has, but named Akamai Technologies, Check Point Software and Risk Management Solutions among them. ActiveScout has been shipping since February at a starting price of $9,000.