In 1999, Schneier co-founded Counterpane Internet Security, a managed security monitoring company based in Cupertino, California. The founding of Counterpane was the institutional expression of the central idea Schneier was developing in secrets-and-lies: that security is a process requiring continuous monitoring and response, not a product achieved through installation of tools.
The Managed Security Concept
Counterpane's service model was built around the insight that most organizations lacked the expertise and attention to monitor their own security infrastructure effectively. Rather than selling security products — firewalls, intrusion detection systems — that customers would then operate themselves (often poorly), Counterpane offered continuous expert monitoring as a service. Its Security Operations Centers watched client networks around the clock, identifying anomalies, investigating potential incidents, and coordinating responses.
This model was simultaneously a business and a demonstration of security-is-a-process in practice. Schneier had argued in the-process-of-security and would argue more extensively in secrets-and-lies that the product mentality was the defining failure mode of security practice. Counterpane built a company around the alternative.
Connection to Security Research
Counterpane employed significant technical talent and contributed to the broader security research community. niels-ferguson and john-kelsey, Schneier's twofish-algorithm co-designers, were among the researchers affiliated with the organization. The company published security research, contributed to open standards discussions at ietf, and maintained the technical credibility that Schneier's public writing depended on.
The managed security model Counterpane pioneered became a major commercial category. By the mid-2000s, managed security services were a substantial segment of the security industry, and the model Counterpane had developed — continuous monitoring, expert triage, response coordination — was widely emulated.
Transition to BT Acquisition
Counterpane operated successfully through the early 2000s, but the managed security market was consolidating and the capital requirements for global security operations centers were substantial. In 2006, bt-group acquired Counterpane, and Schneier became BT's Chief Security Technology Officer. The counterpane-bt-acquisition marked the end of Counterpane's independent existence and the beginning of a different institutional phase for Schneier — one that gave him a global corporate platform alongside his established public intellectual role.
The founding of Counterpane is significant for Schneier's intellectual biography because it demonstrated his commitment to translating conceptual arguments into operational practice. He was not merely arguing that security is a process; he built an organization that implemented that argument commercially. The company's success validated the model, and its acquisition validated the commercial significance of the insight.