Akamai Bets on ‘Zero Trust’ Approach to Security

“It’s a scary mindset change,” said Tom Leighton, Akamai’s chief executive. By guarding access to each business app within an IT network, rather than the entire network, “there is no inside” for attackers to get into, Mr. Leighton said.

Akamai launched its first fully zero trust applications this year, he said.

The concept dates back to at least 2010, when Forrester Research started using the term zero trust to describe stricter cybersecurity efforts. Similar approaches have been advanced by Alphabet Inc.’s Google as BeyondCorp, while Gartner Inc. has dubbed its method “continuous adaptive risk and trust assessment,” or Carta.

Akamai is playing a role in pushing the idea into the mainstream. The strategy is to create a new architecture in which users are authorized for access to specific apps. When they log into these apps, their browser actually lands at an Akamai server that has the information they need or gets it for them, Mr. Leighton said.

Like the approach, Akamai itself is not a conventional cybersecurity service.

Founded in 1998, the company gets most of its business from banks, retailers, tech firms, e-commerce companies, streaming video services and other corporate clients who rely on its global network of more than 200,000 servers to juice download speeds and keep their websites running smoothly.

But starting in 2016, large customers including Apple Inc. and Facebook Inc. began channeling more data through their own systems rather than outsourcing the job to Akamai.

As revenues declined, the company created an offshoot security service, offering to guard the intersection of a company’s digital systems and its online services. Because its clients’ online traffic is routed through Akamai, it is uniquely positioned to monitor these ebbs and flows for malicious activity.

In October 2016, Akamai acquired Soha Systems Inc., a cloud-security startup, and a year later, it bought Nominum Inc., a cybersecurity company, both for undisclosed amounts.

Mr. Leighton, who co-founded the company, says these and other investments in security are paying off for both Akamai and its clients.

He said its security services have helped reduce both the number and impact of attacks on banks, retailers and media websites. Hackers and bots in recent years have attempted to shut down or take over commercial websites in a range of industries.

Akamai this week posted a first-quarter profit of $107.1 million, up from $94 million a year earlier, on a 7% revenue increase to $706.5 million. The gains were led by its security business, which grew 27% year-over-year, the company said.

Mr. Leighton wants to extend that business to the enterprise level, guarding a company’s internal network of business apps from malware and other cyber risks hidden in workers’ mobile devices.

“It’s all about access,” he said. “Anything associated with the enterprise, you want to know where it goes and where it came from.”

Instead of having a single entry point to a company’s full network of business apps, tools and data—which can be accessed by workers via mobile devices with a password or other form of authentication—Mr. Leighton said access should happen app-by-app.

That way, he says, workers can only access the apps they need to do their jobs, avoiding opening up a company’s entire system to bots or malicious software—often without anyone knowing about it until it is too late.

His biggest challenge, he said, is getting CIOs and chief security officers to give up ingrained strategies for enterprise cybersecurity, such as firewalls, two-factor authentication and other aging tools that hackers have learned to bypass.

“There is a level of trust,” Mr. Leighton said. “We’ve got to change how enterprises are architected and that’s not going to happen overnight.”

Write to Angus Loten at angus.loten@wsj.com