Bromium

Bromium was established in 2010 in Cupertino, California, as a venture-backed company focused on virtualization-based endpoint security. Gaurav Banga founded the company, and Simon Crosby and Ian Pratt later joined from the Citrix and XenSource ecosystem. The founding team pursued a security model based on hardware isolation: potentially hostile activity would be executed in a small, disposable virtual machine instead of directly on the user's main operating-system environment. The company's principal innovation was the Microvisor, a late-loading hypervisor derived from the open-source Xen hypervisor. Unlike a conventional virtual machine that reproduces a complete operating-system environment, a Bromium micro-VM was designed around a particular task. Opening an application, clicking a web link, downloading a file, or opening an attachment could trigger creation of an isolated execution environment. Hardware virtualization features in compatible x86 processors separated the micro-VM from the protected desktop and from other micro-VMs. Access controls were intended to limit each task to the resources it needed, applying a least-privilege model at the virtualization layer. Bromium's approach addressed a central weakness in traditional endpoint defenses: the difficulty of reliably recognizing every malicious file or exploit before it runs. By containing the execution itself, Bromium sought to reduce the consequences of both known and unknown threats. When a task ended, its micro-VM could be destroyed, removing malicious code contained within it. The company emphasized that hardware-backed separation avoided dependence on a conventional software sandbox boundary that an attacker might escape. Bromium's first product, vSentry 1.0, shipped in September 2012 for Windows 7. The product required compatible Intel processors supporting VT-x and Extended Page Tables. By 2013, Bromium had completed three venture-financing rounds totaling $75.7 million. Investors named in reference material included Andreessen Horowitz, Ignition Partners, Lightspeed Venture Partners, Highland Capital Partners, Intel Capital, and Meritech Capital Partners. The New York Stock Exchange and ADP were identified as early customers. The product line developed through successive releases. vSentry 2.0 arrived in June 2013 with protection for document exchange. In 2014, Bromium released Live Attack Visualization and Analysis, or LAVA, which gathered attack information from activity occurring within micro-VMs and supported STIX, an emerging format for exchanging structured threat intelligence. vSentry 3.0 followed in December 2015 and added behavioral analysis of executable code. Research was another part of Bromium's public profile. In February 2014, the company published information about bypassing defenses in Microsoft's Enhanced Mitigation Experience Toolkit. The analysis focused on weaknesses arising from EMET's reliance on known return-oriented programming attack vectors. Reference material also reports that NSS Labs testing gave the Bromium architecture a perfect result against the malware and expert attack attempts included in that evaluation. Bromium expanded from software into device-level partnerships. In February 2017, HP and Bromium announced plans to build and ship a laptop with micro-virtualization technology integrated into the device, initially targeting the HP EliteBook x360. HP announced in September 2019 that it had acquired Bromium for an undisclosed sum. Bromium's technology was subsequently represented by HP Sure Click, and the standalone Bromium company was no longer active. Its history is consequently tied to the development of hardware-isolated endpoint security and to HP's effort to embed that protection into commercial computers.

1. 2019HP acquires Bromium

   HP announced the acquisition of Bromium in September for an undisclosed amount.

   Source
2. 2017HP hardware partnership announced

   HP and Bromium announced plans to integrate micro-virtualization into HP laptops, beginning with the EliteBook x360.

   Source
3. 2015vSentry 3.0 launches

   The December release introduced behavioral analysis of executable code.

   Source
4. 2014LAVA is released

   Bromium launched Live Attack Visualization and Analysis for collecting and analyzing attack data from micro-VM activity.

   Source
5. 2013Funding reaches $75.7 million

   By 2013, three venture rounds had provided cumulative funding of $75.7 million.

   Source
6. 2013vSentry 2.0 launches

   The June release added protection for document exchange.

   Source
7. 2012vSentry 1.0 ships

   Bromium shipped its first product, vSentry 1.0, for Windows 7 in September.

   Source
8. 2010Bromium is founded

   Gaurav Banga founded Bromium as a Cupertino-based virtualization and endpoint-security startup.

   Source

Bromium positioned itself as an endpoint-security innovator that contained unknown and user-triggered threats through hardware isolation rather than relying solely on detection signatures, behavioral identification, or post-compromise remediation.

• vSentry 1.0Endpoint security software2012

  Bromium's first commercial product used the Microvisor to place risky user activities into hardware-isolated micro-VMs. It supported Windows 7 and required an Intel processor with VT-x and Extended Page Tables.

• vSentry 2.0Endpoint security software2013

  The second major vSentry release extended the isolation model to protect users while exchanging documents. It represented a product-generation expansion from general task containment toward document-focused enterprise workflows.

• Bromium Live Attack Visualization and Analysis (LAVA)Threat analysis software2014

  LAVA collected information about attacks observed inside Bromium micro-VMs for investigation and analysis. It supported Structured Threat Information eXpression, an emerging structured threat-information exchange standard at the time.

• vSentry 3.0Endpoint security software2015

  vSentry 3.0 added behavioral analysis of executable code to the existing hardware-isolation architecture, combining containment with additional analysis of program behavior.

• Bromium MicrovisorVirtualization security technology

  The Microvisor was Bromium's late-load hypervisor, based on Xen and designed to create task-specific micro-VMs. It isolated vulnerable processes from the protected operating system, other isolated tasks, and the surrounding network.

• 2019HP acquires BromiumM&A

  HP pursued Bromium's hardware-isolated endpoint-security technology and announced an acquisition after the companies had already partnered on protected business laptops.

  What changed. HP acquired Bromium in September 2019 for an undisclosed amount.

  Aftermath. Bromium ceased operating as an independent company, while its technology became associated with HP Sure Click.

  Source
• 2017Integrate micro-virtualization into HP business laptopsStrategy

  Bromium sought to extend its endpoint-security technology beyond separately installed software by embedding protection into commercial PC hardware.

  What changed. Bromium and HP announced a partnership to build and ship laptops with Bromium micro-virtualization, starting with the HP EliteBook x360.

  Aftermath. The partnership preceded HP's acquisition of Bromium and the subsequent association of the technology with HP Sure Click.

  Source

• 2019HP acquires Bromium

  HP announced the acquisition of Bromium for an undisclosed amount, ending Bromium's independent corporate existence and incorporating its technology into HP's security portfolio.

  M&A
  Source
• 2017HP and Bromium announce integrated laptop partnership

  HP and Bromium announced plans to integrate Bromium micro-virtualization into HP business laptops, starting with the EliteBook x360.

  M&AProduct launch
  Source
• 2015Bromium releases vSentry 3.0

  vSentry 3.0 added behavioral analysis of executable code to Bromium's endpoint-protection capabilities.

  Product generation
  Source
• 2014Bromium publishes analysis of EMET bypass techniques

  Bromium disclosed research describing ways attackers could bypass several Microsoft Enhanced Mitigation Experience Toolkit defenses by exploiting weaknesses related to return-oriented programming attack methods.

  Other
  Source
• 2014Bromium releases LAVA attack-analysis technology

  Bromium introduced Live Attack Visualization and Analysis, which collected information from attacks detected inside micro-VMs and supported the emerging STIX threat-information format.

  Product launch
  Source
• 2013Bromium raises a third venture round

  Bromium's third reported venture financing round brought its cumulative funding to $75.7 million. The company was backed by a group of technology-focused venture investors as it developed its micro-virtualization endpoint-security platform.

  Other
  Source
• 2013Bromium ships vSentry 2.0

  The second major vSentry release added protection for users exchanging documents and extended Bromium's application-containment approach.

  Product generation
  Source

1. Bromium