Tufin: The Check Point Alumni Who Built a $570 Million Category in Firewall Policy Management

Previously NYSE: TUFN · Founded 2005 in Tel Aviv by Ruvi Kitov and Reuven Harrison, both ex-Check Point · Taken private by Turn/River Capital in August 2022 for $570M · 2,000+ enterprise customers · 14 patents · The Israeli company that created the firewall policy management category — and proved there was a $570 million company inside the gap between how enterprises buy firewalls and how they manage the policies on them.

Tufin is the Israeli network-security-policy-management company that turned a niche problem — the operational complexity of managing firewall rules at enterprise scale — into a distinct software category, listed it on the NYSE, and sold it to private equity for $570 million before the broader Israeli cyber market had even started pricing its 2023–2024 correction. Founded in 2005 by Ruvi Kitov and Reuven Harrison, both alumni of Check Point Software Technologies, Tufin built the institutional platform for automating security policy changes across firewalls, routers, switches, and cloud security groups in enterprise networks. The company listed on the NYSE in April 2019 (ticker: TUFN), grew to more than 2,000 enterprise customers, and was acquired by Turn/River Capital in August 2022 in an all-cash transaction valuing the company at approximately $570 million.

The Check Point lineage

Both Tufin co-founders came from Check Point Software Technologies — the company Gil Shwed, Marius Nacht, and Shlomo Kramer built into the Israeli cybersecurity template. Ruvi Kitov held project management and development roles at Check Point before co-founding Tufin. Reuven Harrison served as CTO.

The founding insight was operational rather than architectural: Check Point had solved the firewall problem. What nobody had solved was the policy management problem — the daily operational burden of creating, modifying, auditing, and troubleshooting thousands of firewall rules across heterogeneous multi-vendor networks. In large enterprises, a single policy change could take days to implement manually, require coordination across multiple teams, and carry the risk of breaking application connectivity or creating security gaps. Tufin automated that workflow.

What Tufin built

Tufin's core product is a centralized policy-orchestration platform that sits above the firewall, router, switch, and cloud-security layer — regardless of vendor — and provides unified visibility, automated change management, compliance verification, and risk analysis across the entire network security infrastructure.

The platform evolved through four product generations:

SecureTrack — the visibility layer. Real-time topology mapping, rule analysis, and risk assessment across heterogeneous firewall and router environments. The foundation product.

SecureChange — the automation layer. Automated workflow for security policy changes — from request through risk assessment, approval, implementation, and verification. Tufin claims this reduces manual change implementation from days to minutes, with up to 94% reduction in manual effort.

SecureApp — the application-connectivity layer. Maps business applications to the network-security policies that enable them, so that changes to infrastructure don't break application connectivity.

SecureCloud and Tufin Cloud — the cloud-native extension. Policy management for AWS, Azure, GCP, Kubernetes, and hybrid environments. The product that bridged Tufin from on-premise firewall management to cloud-native security policy orchestration.

In January 2025, marking its 20th anniversary, Tufin announced a brand evolution emphasizing AI-driven network and cloud security — positioning the platform as an AI-powered control plane that unifies firewalls, cloud platforms, SASE, and microsegmentation under a single policy-orchestration layer.

The IPO and the public chapter

Tufin listed on the NYSE in April 2019 under the ticker TUFN — one of the wave of Israeli cybersecurity IPOs that included CyberArk's earlier 2014 listing and preceded the 2021–2022 Israeli cyber IPO surge. The IPO validated the network-security-policy-management category as a standalone market but coincided with a challenging period for mid-cap Israeli cyber companies navigating the transition from perpetual licensing to subscription models.

Tufin's last public quarterly report (Q1 2022) showed product revenue growth of 61% year-over-year, with subscriptions representing 77% of new license bookings — well ahead of long-term transition targets. The company had crossed 2,000 cumulative customers, spanning finance, telecommunications, energy, and government sectors globally.

The take-private

In April 2022, Tufin entered into a definitive agreement to be acquired by Turn/River Capital — a San Francisco-based private equity firm specializing in software companies executing subscription-model transitions. The deal valued Tufin at approximately $570 million, or $13.00 per share — a 44% premium over the prior closing price and a 54% premium over the one-month volume-weighted average.

The transaction closed on August 25, 2022. Both co-founders voted their shares in favor. The strategic rationale was explicit: as a private company under Turn/River's ownership, Tufin could complete its transition from perpetual to subscription licensing without the quarterly earnings pressure of public markets. Turn/River brought operational playbooks specifically designed for subscription-model acceleration — including customer-success frameworks, pricing-tier simplification, and go-to-market expansion.

Kitov framed the deal as enabling Tufin to "accelerate our growth through investments in our technology, people, and go-to-market." Turn/River founder Dominic Ang described Tufin as "an industry leader in network security policy management, helping enterprise customers secure their most critical network infrastructure and cloud assets."

Why the timing was right

The August 2022 close is notable in hindsight. Tufin's take-private closed at a 44% premium just before the broader Israeli cyber market entered its 2022–2024 valuation correction — the period that saw multiple Israeli cyber SPACs trade well below listing prices and several peers execute painful restructurings. Turn/River's timing gave Tufin shareholders a clean exit at a premium, and gave the company private-market runway to invest through the cycle. The $570 million valuation represented a substantial outcome for a 17-year-old Israeli security company that had raised only $8 million in venture funding before its IPO.

Tufin in the Israeli cybersecurity landscape

Tufin sits in the operational-security-management layer of the Israeli cybersecurity stack — adjacent to but distinct from the firewall layer (Check Point), the identity-security layer (CyberArk), the network-intelligence layer (Allot), and the data-security layer (Varonis). Where Check Point blocks threats at the perimeter and CyberArk secures privileged credentials, Tufin manages the policies that govern how all of those security controls interact.

The Check Point founder lineage is the Israeli cyber pattern in miniature: Shwed, Nacht, and Kramer built the firewall, then their alumni built the adjacent categories — Kitov and Harrison in policy management (Tufin), Mokady and Cohen in privileged access (CyberArk), and the broader wave of Check Point alumni across dozens of Israeli cyber startups.

Watch points

• Subscription transition — whether the perpetual-to-subscription shift under Turn/River generates the revenue predictability and margin expansion the take-private thesis requires.
• AI-driven orchestration — whether the 2025 AI-platform evolution creates meaningful product differentiation against competitors and cloud-native alternatives.
• Exit path — whether Turn/River pursues a secondary sale, a strategic acquisition, or a re-IPO as the exit vehicle, and at what valuation relative to the $570 million entry.
• Cloud-native competition — whether Tufin's hybrid-network position holds as enterprises shift security policy management to cloud-native tools built into AWS, Azure, and GCP.

Frequently Asked Questions

What is Tufin?
Tufin is an Israeli network-security-policy-management company that automates firewall, router, and cloud security-policy orchestration for large enterprises. Founded 2005 by ex-Check Point alumni Ruvi Kitov and Reuven Harrison. Taken private by Turn/River Capital in 2022 for $570 million.

Who founded Tufin?
Ruvi Kitov (Chairman, CEO, Co-founder) and Reuven Harrison (CTO, Co-founder), both former Check Point Software Technologies employees.

Is Tufin still public?
No. Tufin listed on the NYSE in April 2019 (ticker: TUFN) and was taken private by Turn/River Capital in August 2022 at $13.00 per share (~$570 million).

What does Tufin's product do?
Tufin's platform provides centralized visibility, automated change management, compliance verification, and risk analysis across multi-vendor firewall, router, and cloud security environments. It reduces manual policy-change implementation from days to minutes.

Who owns Tufin now?
Turn/River Capital, a San Francisco-based private equity firm specializing in software companies executing subscription-model transitions.

How many customers does Tufin have?
More than 2,000 enterprise customers globally, including AT&T and IBM, spanning finance, telecommunications, energy, and government.

Related Olam Coverage

See also: Gil Shwed · Shlomo Kramer · Udi Mokady & Alon Cohen · The Builders

---

The Olam Editorial Team