John Katsaros

Consolidation Continues

McAfee opened the week by announcing its intention to acquire Secure Computing, further consolidating the security market. At the ten thousand foot level, this acquisition makes sense. McAfee doesn't have a strong presence in the Web Security Appliance market nor in the E-mail Security appliance market, two of Secure's strengths. This combination gives it an opportunity to pick up market share in each of these interesting markets, although the growth of IronPort after their acquisition by Cisco makes you sort of wonder how big of a mountain needs to be climbed here. Secure had a portfolio of interesting security products but it was unfortunately spread out into many different categories and its acquisition of CipherTrust two years ago, while expanding its product line, reduced its cash position at the very time the company needed to expand product development and marketing. Since his arrival in March, 2007, McAfee's CEO Dave Dewitt has spent nearly a billion dollars buying a collection of security companies, each with at least one product that can be put in the hands of the McAfee channel. It's going to be interesting to see what happens next.

 McAfee Recent Acquisitions

 

Company	Date	Key Products	Acquisition Price
SafeBoot	10/07	Disk Encryption	$350M
ScanAlert	10/07	Secure Transactions	$75M
Reconnex	8/08	Data Loss Prevention	$46M
Secure Computing	9/09	Web Security & E-mail Security appliances	$465M
Total (so far)			$936M

 

 

Tale of Two Technologies

In early August, McAfee announced its plans to acquire Reconnex for $46M in cash, about equal to the capital invested in the company and a price that almost certainly left little or no booty for the common stockholders and certainly only a shadow of the $350M that Symantec paid for Vontu less than a year ago. That pretty much draws to a close the Reconnex story, one of the pioneers in the Data Loss Prevention arena. It's probably for the better as the data loss prevention products are more saleable to organizations when packaged within a broader product family like McAfee's. DLP/ILP is interesting technology but, it's also difficult to sell. DLP never really established its market value. Initially these systems were sold as something like a firewall -- "Buy this box and install it and bad things won't happen!" But the truth was more complicated and had to do with the complexity of language. DLP never avoided the tradeoff between precision (few false positives) and recall (not missing anything). If you wanted to configure these boxes to find everything they created a mountain of data someone had to wade through. If you cranked the configuration down to avoid these false positive it didn't find everything. So the products weren't the neat solution that the investors had wanted. This brings to seven the number of acquisitions in this space over the past two years, leaving just a few independent, possibly struggling, startups. It's not that the technology doesn't provide value; it's just that what the customer wants -- protection of information -- is much broader than any single offering provides. At about the same time that the DLP/ILP sector began, another group of companies started down the disk encryption path with a similar mission in mind -- protecting customers' data -- but with a simpler concept -- encrypt the disk so that if a laptop gets lost or is stolen, the information is unavailable. Since 1% to 2% of laptops get lost or stolen each year, disk encryption makes sense as a first order response to protecting information. Organizations spent nearly ten times as much on disk encryption products than they did on DLP/ILP technology. And the exit results reflect this. While the seven DLP companies sold for a total valuation of $784M, three disk encryption companies were sold for $1.2B during the same timeframe. Interestingly, McAfee is playing on both sides of these markets -- having acquired Onigma, Safeboot and now Reconnex.

McAfee's Big News

Monday McAfee announced its plans to acquire full-disk encryption software maker SafeBoot for $350M in cash just days before SafeBoot was about to complete its IPO.  It's a bold move for McAfee's new CEO Dave DeWalt and it's more or less his announcement that he's planning on broadening McAfee's focus. SafeBoot is one of the leaders in the $400+M mobile encryption market and McAfee's 125M endpoints should be an ideal way to grow this franchise. What's more, McAfee says it's planning to integrate SafeBoot technology with its Data Loss Prevention (DLP) product line -- last year McAfee acquired Onigma and used it as the basis for its DLP product family -- which probably will be the impetus for others in the DLP space to add encryption to their client side products -- and in the process broadening up that category to Data Protection (no "L" anymore).

Rising Star

McAfee's new president and CEO Dave DeWalt also gave a refreshing keynote at Interop .  Since taking over McAfee a short time ago, Dave has been working to rebuild McAfee's image as a pure play security company.  His Interop talk was along the lines of "it's a frightening world out there" which may not have been terribly new to the audience but were, in fact, interesting observations for someone making the transition into the security business.  DeWalt says he's going to be working hard to keep McAfee front and center in the security business.  It should be interesting to watch.

DLP on YouTube

McAfee's marketing group has posted a 3 minute commercial for their new DLP (Data Loss Prevention -- difficult acronym to say the least) on YouTube (Here is the link). Since the opening pitches for DLP products are pretty much the same (you've got lots of risk, really bad things can happen, look at all the places where things can leak) it's actually a clever way to introduce the topic without looking like everyone else.  It's mildly entertaining and good to see that they're thinking about new ways to spread their messages.