John Katsaros

"Fixing a Hole"

DLP Continued — On Monday Trend announced that it was acquiring St. Louis based Mobile Armor. Once again Trend finds a small security/compliance company (Mobile Armor has about 40 employees) which they can integrate across their product line. After several years of hype by DLP startup companies, the Data Loss Prevention market essentially turned out to be mostly an OEM opportunity with full disk encryption being the initial path customers pursue. Like its major competitors, Trend used the acquisition route instead of growing the product internally. But they didn't spend nearly as much as McAfee did when it purchased SafeBoot ($350M in October, 2007) or Symantec when it acquired PGP ($300M in April, 2010) and GuardianEdge ($70M in April, 2010). Trend has an interesting history of acquiring small security companies and then rolling them into the Trend product line.

The Messaging Fabric Report

We're pleased to announce our intent to create a new research report on the role of messaging infrastructure in the quickly evolving landscape of IT. This is the infrastructure that runs between the outside world and the systems that provide mailboxes internally — all big companies have it in some form. It seems to us that with the changing demands on email (e.g., compliance, DLP) and the evolving email alternatives (e.g., malware filtering in the Cloud or even mailboxes in the Cloud) this infrastructure layer could play an even more important role in the future orchestrating all the pieces. We're going to invite vendor participation in the form of briefing us on their offerings and market participation, and, helping us contact representative customers to better learn about the usage and business value of the solutions they provide.  We'd also like to hear from organizations running large e-mail systems.  For now we're calling it "The 2010 Messaging Fabric Report" and are planning on completing it in July.  If you're interested send us a note: jkatsaros@irg-intl.com.

Another DLP Acquisition

2009 started off with CA's acquisition of Data Loss Prevention vendor Orchestria for an undisclosed amount. That's the eighth DLP acquisition in 26 months bringing the total acquisition costs to over $800M and leaves only a few independent DLP vendors remaining. It's not clear how much the venture investors got out of this deal but it's likely that the range of the acquisition was $50M and that Orchestria had about $40M in venture capital investment. Those numbers are par for the course for most of the DLP acquisitions with the big exception being Vontu which sold itself to Symantec over a year ago for $350M, netting the investors a big return. This is CA's third acquisition in 90 days (the other two were IDFocus in the identity and role management space and Eurekify in the management space). With $2.4B in cash, CA may continue its shopping spree to broaden its product line. The DLP business has always been a difficult market for startups because what customers want (data protection) is much broader than what a DLP appliance can deliver. At about the same time that the DLP sector began, another group of companies started down the disk encryption path with a similar mission in mind —  protecting customers' data —  but with a simpler concept —  encrypt the disk so that if a laptop gets lost or is stolen, the information is unavailable. Since 1% to 2% of laptops get lost or stolen each year, disk encryption makes sense as a first order response to protecting information. Organizations spent nearly ten times as much on disk encryption products than they did on DLP/ILP technology. And the exit results reflect this. While the eight DLP companies sold for a total valuation of $834M, three disk encryption companies were sold for $1.2B during the same timeframe.

Running to the Exits

Whoever said "these are interesting times that we live in" must have been talking about the Data Loss Prevention/Information Loss Prevention market. In four short months four of the startups have been taken out of the game by big security companies. Toward the end of October Trend Micro announced its plans to snap up Provilla whose client side DLP technology has been out on the market since only January. But the bigger news came less than two weeks later when Symantec announced its (long rumored) $350M acquisition of Vontu -- the earliest DLP/ILP vendor and the one which got the most customer traction. Symantec has a long history of making acquisitions and then taking a year or so to "Symantec-ize" them into the product line, so it will be interesting to see what comes out of this acquisition. The good news is that finally a decent sized liquidity event occurred in this space. There have been plenty of startups focused on saving the corporate world through DLP/ILP technology, but there wasn't much in the way of adoption (as we've noted here before, market growth in this space has been anemic compared to other security segments). Vontu seemed to be the player with the most traction, especially in the financial services market segment where its product was a good fit. Even they seemed to be growing slower than their investors would have preferred. But in the end, you can't argue with a $350M outcome.

                                          DLP/ILP Hall of Fame

Date	Acquiree	Acquirer	Amount	Estimated Sales Multiple
10/06	Onigma Ltd	McAfee	$20	?
12/06	Port Authority	Websense	$90	20x+??
8/07	Tablus	EMC/RSA	???	???
9/07	Oakley Networks	Raytheon	???	???
10/07	Provilla	Trend	???	???
11/07	Vontu	Symantec	$350M	12x??
Total			$460+M

And The Beat Goes On

New things continue to happen in the DLP/ILP arena. Despite all the liquidity events, there are still startups in this category that are doing interesting things. Toward the end of October, DLP/ILP vendor Workshare introduced what it called its Unified Content Protection (UCP) solution which, in addition to other functionality, adds full disk encryption capability to an ILP client. As we've mentioned here before, although the full disk encryption market started at about the same time as the ILP/DLP segment, it grew at a much faster rate and clearly was more broadly accepted. So combining DLP with full disk encryption on the same client platform sounds interesting.