Bill Brenner just published the results of his quick survey on “what mergers would you like to see in the security industry?” A few follow up comments are in order. Brenner implies that there is something wrong with having lots of vendors in a space while also saying the industry is consolidating.
He says:
After all, the market has become saturated with so many vendors it can be difficult determining who sells what your enterprise truly needs to tackle a given malware or compliance issue.
Well, I don’t know about “saturated”. I guess every market fills to meet demand. I really don’t think that acquisitions are good just because they reduce options as Bill seems to argue. Acquisitions are usually pretty good for the investors and founders of startups. Sometimes, rarely, they are good for the acquirer. Certainly the owners of Alteon made out alright when they sold to Nortel for $7.8 billion. And I believe Radware is going to do OK with the acquisition of the same assets for $18 million.
The security industry is driven by a different dynamic than the rest of Information Technology. That’s why I enjoy being an analyst in the space. Journalists have been talking about the “consolidation” of the security industry for the ten years I have been covering it. Consolidation comes with maturity. The security industry will not reach that phase until the threats stop changing. And, obviously, we are in a phase of very rapid escalation in the threats. So look for more innovation, more company startups, and yes, more acquisitions.
Let me expand on five acquisitions I pointed out to Brenner.
Reflex + RSA. Reflex was born as an IPS vendor, arguably the inventor of IPS but late to maketing their solution. Two years ago Reflex developed tools to provide security for dynamic virtual environments; a way to see and control deployments of virtual machines in a data center. They sidelined the IPS solutions in favor of the virtualization security. EMC acquired RSA Security with the stated intent to acquire their way to $1 billion in security revenue by 2010. They have some catching up to do and should have no problem finding great companies to buy. Their strategy is to focus on solutions that have synergy with their storage and data center operations. As many have pointed out, data centers are moving to virtualization in one of the most dramatic shifts in computing since the days of CDC and Boeing Computing Services and time shared computing. EMC should acquire Reflex if they want a security play in the future data center.
Juniper and Fortinet. This recommendation is slightly on the flippant side. Fortinet is growing at a tremendous rate. I expect them to have 30% growth in 2009 which is extraordinary in a time of global recession. I estimate that Fortinet has over 50,000 customers world wide. They are much more successful than Netscreen was when Juniper bought it. I really do not expect any acquirer to have either the vision or the capital to acquire Fortinet which is my number one candidate for a technology IPO in 2009. (Full disclosure: I was employed by Fortinet up to January 2008. I do not have any knowledge of their IPO plans.)
Kaspersky, Eset, AVG, Panda, and AhnLabs (for an uber-AV company)
There are dozens of successful anti-virus companies. I could add BitDefender and Avira to this list. Obviously, the Big Three, McAFee, Symantec, and Trend, are not dominating what should be a mature space. The combined revenue of these seven companies is probably $560 million. Think of the synergies to be realized by combining research, sales, and marketing teams! To my knowledge there has never been a vertical roll-up in the security space (Network Associates was a horizontal roll-up). In another time the private equity players would have been all over this.
(Of course, Secure Computing ended up with all the also-ran firewalls but there is another word for that.)
Crossbeam and StoneSoft
I was never enthralled with Crossbeam’s strategy of building a hardware platform to run best-of-breed security products in a load balanced blade configuration. It seemed like a play at carving out the high end of what Nokia was doing with their Ipsilon derived product line. Now that Check Point has acquired that business Crossbeam is in direct competition with their most important partner.
I have worked with StoneSoft’s products for fourteen years. They have the most mature software firewall with the most sophisticated management console. As StoneSoft created their firewall to be a replacement for Check Point’s FW-1 it would make a perfect combination if they joined forces with a top notch appliance vendor.
AlgoSec and Cisco
Another flippant suggestion. Thanks to the maturity of the firewalls in most organizations the management of firewall policies had become a major challenge, one that is giving rise to a new sector that I am covering: firewall policy management. Watch this blog as I post video interviews with the major players and spell out the requirements for selecting a firewall policy management solution. The firewall vendors have been caught out with a lack of features to help manage thousands of rules, detect redundancies, and optimize rule sets. Third party product vendors are coming on the scene and seeing rapid deployments of their products. Tufin has what I believe to be the most well thought out strategy for this space that goes beyond just firewalls and has had the most success in the large enterprise where the need is highest. Athena Security, Algosec, and Secure Passage (spin off from the security reseller Fishnet) have great tools and are getting traction.
Cisco is the firewall vendor with the least mature management capability and could profit from acquiring technology from one of these vendors. Of course, one of the primary strengths of the firewall policy management vendors is that they support multiple platforms. So an acquirer would not benefit from their complete value proposition. The real story here is the combination of firewall policy management and network management. More later.
I can’t resist commenting on the other suggested acquisitions in Brenner’s article.
First Lawrence Pingree:
* 1. McAfee bought by Microsoft. No way. Won’t happen. Too many conflicts.
* 2. Sourcefire absorbed by Symantec Nope. Symantec tried the IDS space already.
* 3. Imperva bought by Checkpoint I don’t think so. Too much history.
* 4. Palo Alto Networks bought by RSA Gag! RSA is not making network security purchases. PAN is too immature.
* 5. Sophos bought by IBM Yawn. Whatever.
Mike Rothman’s
* 1. HP and a Big AV vendor TBD Ha! Not likely. The AV space is too fraught with challenges for HP.
* 2. Cisco and Fortinet Well, why not. Cisco can afford it.
* 3. Oracle and Imperva (or Guardium) Hmmm. Maybe.
* 4. Symantec and GuardianEdge (or CREDANT) Also Maybe.
* 5. IBM and Fortify Could work.
There are over 1,200 vendors in the security space and I am briefed by new ones every week. There are many acquisitions to come as the fun continues.
I had a chance to talk about the topic of cyber warfare with Steven Fox of 
Lecut
