It's long been a knock on the region's technology community that its ingenuity, which otherwise might spawn the next Google, is instead sucked up by the federal government's massive presence.
But with each revelation of another big corporate data breach — and as federal budget pressures squeeze potential profits — it makes less sense for the region's top cyber minds to stick strictly to government contracting. It's looking a lot more lucrative now to seek out businesses willing to spend big bucks to protect their and their customers' sensitive data.
That's translating into a surge of companies looking to turn the cybersecurity expertise gained at defense and intelligence agencies into potentially more profitable businesses selling software and services to the private sector.
Former National Security Agency Director Gen. Keith Alexander is among those entrepreneurs, while companies like JPMorgan Chase & Co. are looking to the region to recruit technology talent.
The commercial cybersecurity industry here remains immature but is showing promise — and a record-setting $250 million investment Columbia-based Tenable Network Security announced Tuesday should help speed its growth along.
But it's not an easy transition for companies like InfoTek, a Hanover information technology company that recently began offering its services detecting "insider" security threats to other businesses, in addition to the government.
"It's been difficult and challenging. We're still getting our name out there," CEO Jacky Kimmel said. "I think it will turn around at some point, but at this point, [government contracting] is not really a fruitful place to work."
The region's community of tech companies serving the government is well-established — the Maryland Department of Commerce estimates that 11,480 IT businesses earn $11.5 billion in federal contracts each year. Fourteen Maryland companies appeared on research firm Cybersecurity Ventures' list of the top 500 cybersecurity companies in the world this year, including Lockheed Martin, Tenable and Hanover-based KEYW Corp.
But that list also includes up-and-comers like Baltimore startup ZeroFOX and commercially focused companies like Hexis Cyber Solutions, a KEYW subsidiary focused on commercial cyber business.
Around Fort Meade, the NSA and U.S. Cyber Command, there are signs of the private sector making inroads. JPMorgan recently opened an office in the area and is hiring. Alexander's IronNet Cybersecurity moved to Maple Lawn this spring and last month announced it had received a large, first-round venture capital investment of $32.5 million.
Tim O'Ferrall, general manager of the Fort Meade Alliance, a community group dedicated to supporting the Anne Arundel County installation, said the moves aren't surprising.
"The reality is, a lot of the technologies and processes that are going to be common defenses down the road haven't been developed yet, but they're going to be developed around here," he said.
Ventures from government work into the private sector have shown mixed results so far.
Investors from Silicon Valley and New York showed confidence in Tenable's business continuously monitoring networks for threats — the $250 million round was the largest ever for a cybersecurity company, according to data firm CB Insights. The commercial side of Tenable's business accounts for about 80 percent of its revenue, while it also works for government defense and intelligence agencies.
But there are other companies still working to break into private-sector business. KEYW launched Hexis in 2013, but the subsidiary's growth has been slow, accounting for about 3.5 percent of KEYW's sales. CEO William J. Weber said earlier this month he expects Hexis sales to accelerate in the fourth quarter of this year and into 2016.
The opportunity in protecting corporate data is growing rapidly. Gartner Research estimates it's about a $77 billion market this year and will surpass $100 billion in 2018. A report from MarketsandMarkets estimates it reaching $170 billion by 2020.
"It's an increasingly complicated threat environment out there," said Steve Vintz, Tenable's chief financial officer. "Lots of competitors are going to make noise here."
While Tenable counts Fortune 500 companies such as Microsoft, Apple and PNC Bank among its clients, cyber entrepreneurs see opportunities selling to businesses of all sizes that have data to protect. Local IT firm Raven Data Technologies, with offices in Reisterstown and Millersville, is in the process of rebranding to become Phalanx Secure, shifting from networking services to threat detection and security analysis.
"Everyone's forgetting the small and medium businesses," Phalanx CEO Matt Johnson said. "They're the bulk of America."
The likes of Tenable may help spread the wealth. For one, news of the $250 million investment, led by Insight Venture Partners of New York along with Accel Partners from Silicon Valley, is boosting the region's reputation in cyber, potentially attracting more venture capital attention.
"The industry around the country will probably have more awareness of it than most folks in Maryland," said Art Jacoby, founder and chairman of the Cybersecurity Association of Maryland Inc., a trade group. "Silicon Valley is watching us."
The association is working to teach entrepreneurs savvy in the ways of winning government contracts but without the experience or contacts to sell their services to other businesses. It is doing that through networking events in partnership with other large regional business groups, and also by publishing a directory of Maryland cyber firms, encouraging local companies in need of data security to "buy local."
Stacey Smith, a former cyber community manager for the state Commerce Department who is now heading the association's "Buy MD Cyber" program, said many of the companies have been so focused on government jobs they don't know how to connect with other types of organizations.
"One of the No. 1 asks I got from the companies I engage with is, 'Can you introduce me to potential customers?'" she said.
Advocates for the state cyber economy say they also hope the success of companies like Tenable and IronNet inspires other entrepreneurs.
Tenable CEO Ron Gula said he wants his company to do for cybersecurity what Advertising.com did for digital marketing in Baltimore — the Internet advertising pioneer's success led to the founding of other local companies, including Millennial Media and Videology.
"We really want Maryland to be known as a center for cybersecurity," Gula said. "We think this [investment] is a good bet on the region, not just on Tenable."