ScaleFT

ScaleFT
Name	ScaleFT
Type	Private
Founded	2015
Founders	Zane Lackey, Eric Grosse
Fate	Acquired by Okta, Inc.
Headquarters	San Francisco, California
Industry	Identity and access management

ScaleFT

ScaleFT was an American cybersecurity company focused on identity-based access controls and zero trust networking for cloud and hybrid infrastructures. Founded by security engineers with roots at prominent technology firms and open-source communities, ScaleFT developed a software-defined perimeter and certificate-based authentication products that challenged legacy virtual private network models. The company gained attention from enterprises, venture capital firms, and standards bodies before being acquired by Okta, Inc..

History

ScaleFT was founded in 2015 by Zane Lackey and Eric Grosse, both with prior experience at organizations such as Twitter, Google, and open-source projects in the IETF ecosystem. Early funding rounds included participation from investors tied to the Silicon Valley startup ecosystem and security-focused venture capital firms. The startup emerged amid industry debates sparked by incidents like the Office of Personnel Management data breach and calls for replacements to traditional perimeter defenses exemplified by products from Cisco Systems and Palo Alto Networks. ScaleFT positioned itself alongside contemporaries such as Cloudflare and Akamai Technologies in discussions about edge security and toward initiatives inspired by the Forrester Research formulation of "zero trust" models. Over its operational years ScaleFT engaged with standards bodies and published design goals that referenced work from the IETF and identity efforts like OAuth 2.0 and FIDO Alliance-related developments. The company was ultimately acquired by Okta, Inc..

Technology and Architecture

ScaleFT's architecture centered on a software-defined perimeter that leveraged cryptographic primitives and short-lived credentials rather than static VPN tunnels. Core technical influences included research from Google's internal zero trust initiative and public-facing proposals from the IETF for secure transport and authentication. The platform used certificate-based machine identities, integrating with PKI principles popularized by organizations such as DigiCert and protocols standardized by IETF working groups. The system components were designed to interoperate with cloud providers including Amazon Web Services, Microsoft Azure, and Google Cloud Platform, as well as on-premises environments maintained by enterprises like Goldman Sachs and General Electric that required hybrid connectivity. ScaleFT emphasized ephemeral key issuance, mutual TLS, and automated certificate lifecycle management informed by practices from projects like Let's Encrypt and the ACME protocol discussions. The architectural model sought to reduce lateral movement risks discussed in analyses by MITRE and to support identity-centric authorization patterns promoted by research from Harvard University and Stanford University.

Products and Features

ScaleFT shipped a suite of products and features aimed at replacing legacy remote access tools. Key capabilities included certificate-based SSH access, short-lived machine certificates, and a centralized policy engine that mapped to identity providers such as Okta, Inc. and Microsoft Azure Active Directory. The product set integrated with orchestration and configuration management systems from HashiCorp and Puppet as well as container platforms like Kubernetes and Docker. Features for audit and visibility exported logs compatible with SIEM solutions from Splunk and IBM's suite, while workflow integrations referenced ticketing systems such as Jira (software) and ServiceNow. ScaleFT also provided developer-focused SDKs and APIs inspired by developer platforms at GitHub and Atlassian to enable custom automation. The design prioritized interoperability with identity standards embodied by SAML and OAuth 2.0 to allow enterprises using identity providers such as Okta, Inc. and Ping Identity to adopt certificate-based access without wholesale directory replatforming.

Security and Compliance

Security engineering at ScaleFT emphasized principles from the National Institute of Standards and Technology and threat models cataloged by MITRE ATT&CK. The approach used short-lived credentials and mutual TLS to limit credential theft vectors noted in incidents analyzed by Verizon's data breach reports. Compliance-oriented features targeted frameworks such as SOC 2, ISO/IEC 27001, and regulations enforced by agencies like the European Commission under the General Data Protection Regulation; product controls and logging were designed to support auditability required by these regimes. ScaleFT engaged in threat modeling and third-party assessments common in the supplier ecosystems of firms like Deloitte and Ernst & Young to provide assurance to financial services and healthcare customers subject to oversight by bodies such as the U.S. Securities and Exchange Commission and Health and Human Services.

Use Cases and Deployments

Enterprises adopted ScaleFT for remote developer access, privileged access management, and securing service-to-service connections across cloud environments. Typical deployments replaced traditional VPN products from vendors like Cisco Systems and Juniper Networks for scenarios involving remote contractors, cross-team SSH access, and ephemeral build infrastructure in continuous integration pipelines managed by Jenkins and CircleCI. Financial institutions and technology companies used ScaleFT to meet zero trust objectives articulated in whitepapers from Forrester Research and Gartner, Inc., while research institutions and higher education organizations applied the solution to protect datasets governed by HIPAA and FERPA compliance regimes. Integrations were reported in engineering blogs from firms such as Stripe and Dropbox describing transitions toward identity-driven access.

Acquisition and Corporate Affairs

ScaleFT operated as a privately held company in the San Francisco Bay Area prior to its acquisition. Its purchase by Okta, Inc. was part of a broader consolidation trend in identity and access management where incumbents absorbed startups to expand zero trust offerings. Post-acquisition, elements of ScaleFT's technology were integrated into product roadmaps and go-to-market motions coordinated with partner ecosystems including cloud providers Amazon Web Services and Microsoft Azure, as well as channel partners and systems integrators such as Accenture and Deloitte. The acquisition reflected strategic moves by major identity vendors to incorporate certificate-based and software-defined perimeter capabilities into enterprise access portfolios.

Category:Identity management companies