Zero trust security is an emerging paradigm in enterprise IT. It means that no one is trusted by default from inside or outside a network and verification is required from everyone trying to gain access to resources on the network. This added layer of protection has been shown to prevent data breaches, but surveys reveal that IT teams are struggling to implement it at their organizations. According to a February report from security vendor Optiv Security — admittedly not a neutral third party — only 21% of businesses have adopted zero trust as a “foundational model.” A separate report from Fortinet released the same month found that over 80% of companies believe implementing a zero-trust strategy across a network would be challenging.
Avery Pennarun says that the solution lies in Tailscale, a security networking startup he co-founded with David Crashaw, David Carney, and Brad Fitzpatrick. Pennarun makes no claim that Tailscale, which today announced that it raised $100 million in a Series B round co-led by CRV and Insight Partners with participation from Accel, Heavybit, and Uncork Capital at an over-$ 1 billion valuation, is a cure-all. But he argues that Tailscale removes much of the overhead and complexity from the “long tail” of connectivity problems in the enterprise.
“Tailscale sits at the intersection between network infrastructure (connectivity) and security. Often, the IT or DevOps team will adopt a connectivity tool, then run into interference from the security team who is concerned with the resulting risk. Or, a security team implements new protective policies that slow down the work of other teams,” Pennarun told TC in an email interview. “By bridging the two, Tailscale provides an option that makes teams more productive, eliminating connectivity problems and complex network architecture, but also secure by default, because every connection is always secure.”
Tailscale’s product is built on WireGuard, a communication protocol and open source software that implements encrypted VPNs in enterprise environments. Designed by Jason A. Donenfeld, WireGuard aims to provide a better alternative to protocols like IPsec, which Pennarun argues can be complex to set up and take substantial time to negotiate reconnections.
Pennarun co-launched Tailscale in 2019 to commercialize the technology. Pennarun was previously a senior staff software engineer at Google, where he worked on Google Wallet features and some of the infrastructure for Google Fiber. Crashaw and Fitzpatrick were also staff software engineers at Google, while Carney co-founded of Format, an online portfolio platform for photographers.
“Every security team nowadays has a zero trust networking initiative, but most teams aren’t sure exactly what that means,” Pennarun said. “The first step toward zero trust is to eliminate trust in the physical network, which means eliminating reliance on ‘perimeter defenses’ like network-level firewalls. If you can’t trust the physical network, then every connection between any two devices must be encrypted. Zero trust systems are typically very complex and fragile to deploy. Tailscale’s unique approach makes zero trust rollouts incremental and risk-free, so security teams can see value right away.”
Tailscale can be installed on a server and used as a way to share software services or replace a corporate VPN likeCisco AnyConnect, OpenVPN, and Palo Alto Global Protect. Recently introduced, an AirDrop-like feature called Taildrop allows file transfer between devices connected to the network.
Pennarun says that, even if a company uses Tailscale to route public-facing browser traffic through nodes like Linux, Windows, macOS, and Android TV devices, only these devices see decrypted traffic or have any view into what traffic they’re sent. It’s also mesh-based, meaning that Tailscale’s capacity increases with the number of nodes.
“Many dev teams use no VPN at all, instead opening SSH ports and dashboards to the outside world and attempting to lock them down through obscurity or simple IP address-based block lists,” Pennarun said. “By making connectivity easier and more secure, we empower small teams to build systems that scale, without scaling overhead.”
Tailscale isn’t revealing revenue numbers today. But by other metrics, the company has performed well in the face of competition from ZeroTier and Cloudflare One. In addition to hundreds of thousands of users on its free plan, which Tailscale recently debuted, the startup claims to have paying government clients as well as private sector customers including Oxide Computing Company, Dusty Robotics, and VersaBank.
Driving the growth in part is the expanding appetite for cybersecurity startups. Venture capital funding for cybersecurity companies in 2021 surged to nearly $30 billion, more than doubling the tally from the previous year, according to Momentum Cyber.
“Security and ease of use should not be mutually exclusive concepts,” CRV general partner Reid Christian said in a statement. “The pandemic abruptly brought a shift to work-from-anywhere for companies of all sizes, and they were faced with this decision between enabling their employees access and trying to manage their stretched, insecure networks. Tailscale is razor-focused on user experience and security.”
Pennarun says that the money from the latest funding round will be put toward establishing more partnerships and integrations while tripling the size of 30-person workforce. Toronto, Canada-based Tailscale’s total capital raised stands a $115 million.
“The money will be used to continue doing what we’ve been doing: a focus on high quality, highly secure network infrastructure that ‘just works,’ with surprisingly tight integration and ease of use. By raising money now, we make sure we can ride out any upcoming market fluctuations. It removes the pressure to boost short-term growth by sacrificing product quality and organic community building,” Pennarun added. “[We’ll be] expanding our marketing and sales teams, but especially investing in building additional product features. In particular, we want to focus on adjacent “tail scale” problems that suck the joy from day-to-day development tasks.”
