HyTrust

HyTrust

Eric Chiu and Boris Strongin launched HyTrust in Mountain View in 2009, targeting a specific architectural vulnerability: the hypervisor layer that controls virtualized infrastructure. Early customers were government agencies and financial institutions that needed to virtualize classified or regulated workloads but could not pass audit without restricting administrator access. The founders previously worked on security and systems infrastructure at VMware and Oracle; their insight was that virtualized and software-defined data centers required a new authorization model — policy enforcement tied to the virtual object, not the physical rack. HyTrust's product suite covered three zones that converged under the banner of cloud workload governance. Its flagship Boundary Controls enforced role-based access on vCenter and ESXi hosts, logging every privileged action. CloudControl extended the same posture to AWS, Azure, and OpenStack, letting security teams write a single policy that followed a virtual machine across on-prem and public clouds — a capability institutional buyers cited when comparing against native cloud tools. The third pillar, KeyControl, handled encryption key management for virtual machine disks and multi-cloud key distribution in a format that integrated with HSM hardware from Thales and Utimaco. The Department of Energy and several large US banks deployed HyTrust across their VMware footprints, per public case studies published by the firm and VMware. At the time of its acquisition by Entrust in January 2021, the company employed roughly 55 people and had raised $85 million in venture funding across seven rounds, per Crunchbase public filings, with backers including Trident Capital, Intel Capital, and Sway Ventures. Entrust, a 50-year-old identity and payments infrastructure company owned by private equity firm Thoma Bravo, bought HyTrust to stitch workload encryption into its certificate authority and hardware security module product line — building what Entrust described publicly as a "single source of truth for machine identities" across container, virtual, and bare-metal infrastructure. HyTrust's structural distinction was its policy-attached-to-workload model rather than policy-attached-to-network. Before distributed firewalls and microsegmentation became native cloud features, HyTrust made the virtual machine or container the enforcement point, which meant policy survived vMotion events, cloud migration, and infrastructure replacement. That architecture put it in a small peer set — alongside Catbird and CloudPassage — that treated the workload itself as the security boundary. The integration into Entrust, a Thoma Bravo portfolio company, imposed a predictable operating-company governance model: HyTrust's products now appear as Entrust CloudControl and Entrust KeyControl in a catalog aimed squarely at compliance-sensitive enterprises modernizing their on-prem data centers.