The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Brighton Park Capital announced a $112 million investment in PortSwigger on June 27, 2024—the first disclosed outside investment in the British company behind Burp Suite after roughly 16 years of bootstrapped growth. It was presented as an investment, not an outright acquisition, and the public announcement did not disclose PortSwigger’s valuation, the percentage sold, or detailed transaction terms.
The deal in brief
| Item | What is publicly known |
|---|---|
| Investor | Brighton Park Capital, a US growth-focused investment firm |
| Amount | $112 million |
| Announcement | June 27, 2024 |
| Company | PortSwigger, the UK application-security software provider behind Burp Suite |
| Funding history | Described by the company and its advisers as its first external investment |
| Terms | Valuation, ownership percentage, security type, governance rights and spending timetable were not disclosed |
SecurityWeek reported the headline on July 1, 2024, following the company and investor announcement. TechCrunch identified Brighton Park as the sole investor in its contemporaneous coverage, while PortSwigger continued under founder and CEO Dafydd Stuttard’s leadership.
As an Amazon Associate I earn from qualifying purchases.
Who are PortSwigger and Brighton Park Capital?
PortSwigger
Founded by Stuttard in 2008, PortSwigger develops tools for testing web applications and APIs. Burp Suite grew from software Stuttard built to make his own penetration-testing work more efficient. The company now serves individual security practitioners as well as enterprise security teams. Its own announcement said it had nearly 20,000 customers, naming Microsoft, Amazon, FedEx and Salesforce among them; those are company-stated customer claims, not endorsements or disclosed contract details.
TechCrunch reported users in about 170 countries, more than 80,000 individuals, and more than 1,000 enterprises and organizations using the paid enterprise edition. The announcement also said millions of people had used PortSwigger’s free tools and training. These figures were supplied by the company or reported from company information rather than independently audited metrics.
#1 Best Overall
Brighton Park Capital
Brighton Park invests in growth-stage software, healthcare and technology-enabled services businesses. The firm said it viewed PortSwigger as a leader in web security with room to expand as organizations expose more applications, APIs and cloud services.
Sources: Brighton Park announcement; TechCrunch coverage; Paul, Weiss adviser announcement.
Why accept outside capital after years of bootstrapping?
TechCrunch reported Stuttard describing PortSwigger as cash-flow positive and saying money was not the primary reason for the transaction. Instead, the company was seeking a partner with market, international and go-to-market expertise. That profitability description is attributed to Stuttard’s reported comments, not an independently audited financial disclosure.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Institutional capital can let a founder-led software company pursue several goals simultaneously:
- Hire more product, engineering, customer-success, sales and marketing staff.
- Build enterprise capabilities without abandoning practitioner-focused tools.
- Expand US and international operations, support and sales coverage.
- Increase investment in application-security research.
- Provide more free education and community resources.
For PortSwigger, the choice appears to have been about acceleration and expertise rather than rescuing a distressed business. It also illustrates the trade-off of taking growth capital: an investor may bring useful operating knowledge, but institutional ownership can increase pressure for faster expansion or a future liquidity event.
What PortSwigger sells
Burp Suite Professional
Burp Suite Professional is the commercial toolkit for hands-on web-application and API penetration testing. It is aimed at individual testers, consultants, red teams and security professionals who need to intercept, inspect, modify and replay traffic while combining manual analysis with automation.
Rank #3
Burp Suite Enterprise Edition
Burp Suite Enterprise Edition is positioned for recurring, centralized automated scanning of web applications and APIs. It better fits organizations with a portfolio of applications than teams that only perform occasional manual assessments.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchCommunity Edition and Web Security Academy
The free Community Edition provides a low-cost entry point for learning and basic testing. The Web Security Academy adds free lessons and practical labs covering common vulnerabilities and testing methods. These offerings help develop application-security skills and can introduce future practitioners to Burp’s workflow.
Where the $112 million was intended to go
PortSwigger and Brighton Park publicly described broad priorities rather than a line-item budget:
- Product and engineering: faster development and stronger capabilities for larger organizations.
- Enterprise delivery: improved support, scale and integrations for customers testing many applications and APIs.
- Hiring: growth across product, engineering, customer success, sales and marketing, according to a later CyberWire summary.
- International expansion: including a larger US presence.
- Research: continued work on emerging web and API security problems.
- Community investment: free tools, education and other resources for practitioners.
Sources: The CyberWire business briefing and the company announcement.
Why the investment matters to application security
Modern organizations depend on internet-facing applications, APIs, cloud services and software dependencies. That expands the number of places where authentication, authorization, input handling and business logic can fail. Burp Suite sits between expert-led penetration testing and automated dynamic application-security testing.
Free tools Windows power users keep installed
One-click scans. No signup required.
Stuttard and Brighton Park emphasized a human-plus-automation model: automation can handle repetitive discovery and scanning, while skilled testers interpret complex behavior and business risk. That is a strategic view expressed by the parties, not proof that automation will or will not replace particular jobs.
Best Value
PortSwigger is also different from bug-bounty marketplaces. Platforms such as HackerOne and Bugcrowd organize outside researchers and vulnerability programs; they are adjacent to, rather than like-for-like replacements for Burp Suite’s testing tools.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the investment means for Burp Suite users
Likely areas of opportunity
- More engineering capacity for web and API testing features.
- Broader enterprise support, integrations and deployment options.
- Improved international sales and customer-success coverage.
- Additional research and training content.
What has not been confirmed
- No public announcement established a price, licensing or availability change caused by the deal.
- No post-investment product roadmap or performance result is proven by the 2024 coverage.
- Community promises are stated priorities, not guaranteed milestones.
Users should therefore treat the investment as a capacity signal, not evidence that Burp Suite is automatically technically superior to every alternative.
How buyers can assess the product family
| Need | Potential fit | Important qualification |
|---|---|---|
| Expert-led manual testing | Burp Suite Professional | Designed for individual testers and hands-on workflows |
| Centralized recurring scanning | Burp Suite Enterprise Edition | More appropriate for larger application portfolios; pricing was not stated in the available sources |
| Learning or basic testing | Community Edition and Web Security Academy | Free entry points, but not the full commercial feature set |
| Open-source scanning | OWASP ZAP | A category alternative for teams prioritizing zero license cost |
| Automated commercial DAST | Invicti or Acunetix | Compare current coverage, integrations, deployment and licensing directly with each vendor |
Any serious comparison should examine manual-testing depth, API coverage, scan automation, CI/CD integration, reporting, remediation workflows, collaboration, deployment model, support and total cost of ownership. The sources available for this article do not establish current prices for PortSwigger or these alternatives.
What remains unknown
- PortSwigger’s valuation and the percentage of ownership transferred.
- Whether the investment was common equity, preferred equity or another security.
- Board seats, voting rights, liquidation preferences and other governance terms.
- Revenue, profit, annual recurring revenue and growth rates.
- A detailed allocation and timetable for the $112 million.
- Operational or financial results after the 2024 announcement.
The bottom line
Brighton Park’s $112 million investment marked a major change in PortSwigger’s financing history, not a sale of Burp Suite or a disclosed acquisition. The company entered the deal with a large practitioner and enterprise user base, free education and tools, and a founder-led operating model. The test now is whether new capital can expand enterprise and international reach while preserving the product quality and community access that made Burp Suite influential in application security.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
