Overview
Isovalent built enterprise networking and security software around Cilium, an open-source project for connecting applications running in containers. Cilium uses a Linux feature called eBPF to observe and control network traffic inside the operating system. That lets teams apply rules to services whose individual containers may change addresses frequently.[1]
Cisco completed its acquisition of Isovalent in April 2024. The commercial product continues under Cisco, and Cilium remains an open-source project. Isovalent's trajectory shows how a company can help create an infrastructure standard, then sell enterprise capabilities and support around it.[2][3]
Founding Story
Dan Wendlandt and Thomas Graf founded Isovalent in 2017. Graf created Cilium; Wendlandt had worked on software-defined networking at Nicira. Their work addressed a change in how applications were deployed: services became collections of short-lived containers spread across many machines, rather than fixed applications on a small set of servers.[4][5]
A network rule tied to an IP address becomes harder to maintain when containers move and restart. Graf's Cilium project used identities associated with workloads to make policies follow the application. Isovalent built a company around that open-source foundation. In 2020, a16z announced its investment; Cisco and Google were among the investors in the company's Series A.[5][6]
The founders' exact first customer and the economics of early sales are not established in the sources reviewed. Investor accounts describe the technical opportunity, but do not isolate the contribution of open-source adoption to paid revenue.
Timeline
- 2016: Cilium began as an eBPF-based container networking project.[7]
- 2017: Wendlandt and Graf founded Isovalent.[4]
- 2020: Isovalent announced its Series A, with a16z and other backers.[5][6]
- 2022: Isovalent announced a $40 million Series B and described expanding its enterprise Cilium offering.[8]
- 2024: Cisco completed its acquisition; Isovalent joined Cisco's security group.[2]
What They Built
Cilium connects and protects services managed by platforms such as Kubernetes. A Kubernetes application can have many copies, or pods, whose addresses change as the system replaces or moves them. Cilium assigns identities to groups of containers with the same security policies. The receiving machine can check that identity when traffic arrives, so a rule can describe the service rather than each temporary address.[1]
The underlying eBPF technology lets small verified programs run at selected points in the Linux kernel. Cilium uses that capability to observe and enforce network policies without changing application code. Hubble adds a view of network flows; Tetragon observes and enforces security-related events. These are related projects with distinct jobs, not one feature with three names.[1][9]
Isovalent offered enterprise software around this open-source base. Its current site still offers an enterprise platform and labs, while the Cilium project remains separately available. That distinction matters for a buyer deciding between running community software and paying for commercial features and support.[3]
Market Position
Target Customers
Isovalent targeted platform and security teams operating cloud-native infrastructure. Its 2022 announcement named adopters including Adobe, AWS, Capital One, Datadog, and Google; those names establish reported adoption, not the number or value of paid contracts.[8]
Market Size
The company addressed networking and security for Kubernetes and related infrastructure. A defensible estimate for its specific paid market was not established.
Competition
Tigera's Calico provides open-source and enterprise networking and policy, including an eBPF mode. Cloud providers also distribute managed Kubernetes services. Isovalent therefore competed both with other networking implementations and with the convenience of software supplied by a customer's cloud provider.[10]
Business Model
The commercial approach combined an open-source project with an enterprise offering. Open source gave engineers a way to evaluate and use the technology; the company sought to sell additional enterprise capabilities and support. The sources reviewed do not establish contract prices, margins, or conversion from community use to paid customers.[8]
Traction
The Cloud Native Computing Foundation reported that more than 1,000 organizations had contributed to Cilium. That is a measure of its contributor ecosystem, not Isovalent's customer count or revenue.[11] Cisco said Cilium was already used in managed Kubernetes offerings before its acquisition. Distribution through those platforms put the underlying project in reach of users who might never purchase directly from Isovalent.[6]
Outcome and evolution
An open project created distribution and a commercial challenge
Cilium's open-source status helped vendors and users contribute to a shared networking layer. Cisco cited its use in managed Kubernetes services when explaining the acquisition. That reach could make Isovalent valuable to a buyer with a large enterprise sales channel, while also creating a challenge: some users could adopt the project without buying from its creator.[6]
Cisco said Isovalent's technology would support its security platform and committed to the eBPF, Cilium, and Tetragon communities. The acquisition gives Cisco an enterprise product and a team with deep experience in these projects. The open-source project remains available under community governance, so Cisco's ownership of Isovalent should not be confused with ownership of the entire project.[2][11]
Another plausible motive is Cisco's desire to add the engineering team, rather than paid product revenue, to its security group. Cisco disclosed its strategic rationale but not a breakdown of the purchase value. The evidence does not establish a failed business or reveal investor returns.
Key Lessons
- Use the application's identity. Cilium policies follow groups of workloads, which addresses the churn of container IP addresses.
- Separate adoption from revenue. Thousands of contributors and broad distribution are useful evidence of ecosystem reach, not a paid conversion metric.
- Plan for open governance. Cisco bought Isovalent's company and team while the underlying Cilium project continued in an open community.
- Compete on operations as well as code. A commercial offer around open software must explain why a team should pay rather than maintain it itself.
Sources
- Cilium, introduction
- Cisco, acquisition completion
- Isovalent, current platform
- Dealroom, company profile
- a16z, investment announcement
- Cisco, acquisition announcement
- Linux Foundation, state of eBPF
- Isovalent, Series B
- eBPF Foundation, Isovalent interview
- Calico, eBPF data plane
- CNCF, Cilium journey