John Katsaros

"Fixing a Hole"

DLP Continued — On Monday Trend announced that it was acquiring St. Louis based Mobile Armor. Once again Trend finds a small security/compliance company (Mobile Armor has about 40 employees) which they can integrate across their product line. After several years of hype by DLP startup companies, the Data Loss Prevention market essentially turned out to be mostly an OEM opportunity with full disk encryption being the initial path customers pursue. Like its major competitors, Trend used the acquisition route instead of growing the product internally. But they didn't spend nearly as much as McAfee did when it purchased SafeBoot ($350M in October, 2007) or Symantec when it acquired PGP ($300M in April, 2010) and GuardianEdge ($70M in April, 2010). Trend has an interesting history of acquiring small security companies and then rolling them into the Trend product line.

"Revolution"

Telling It Like It Is — Using a slightly different approach, Symantec's CEO Enrique Salem told a Reuters reporter, "The beauty of the stock market is that it is open from 9:30 to 4 every day and (investors) get to vote with their dollars," giving existing and potential investors a good idea of what to expect while the company charts its growth path. Enrique got hammered in the blogosphere despite the fact that he was sending a clear signal for setting expectations. Would the bloggers prefer that he attend the John Chambers CEO Charm School and start using metaphors like A Big Air Pocket?

Nine Lives

Speaking of acquisitions, here's one that made a lot of sense — Symantec's $300M acquisition of encryption vendor PGP. (Symantec also announced its $70M acquisition of GuardianEdge.) The only comment that you can make about this deal is why didn't Symantec do this sooner? $300M for PGP sounds like a lot but not when you consider McAfee's acquisition of SafeBoot for $350M in late 2007 which left a huge hole in the Symantec product line the bar was already set high. But talk about resilience — you need to read the Wikipedia history of PGP — despite many failures they just kept the faith and stayed in the game — for almost 20 years.

Dave's Shopping Spree

 Dave's Shopping Spree — McAfee's acquisition of MX Logic makes this the second anti-spam acquisition for McAfee - the first one occurred when McAfee acquired the CipherTrust product line as part of its acquisition of Secure Computing. Secure claimed to have its own SaaS offering and if left to its own devices probably would have tried to grow the business organically but McAfee apparently couldn't wait. Symantec made three acquisitions in this space (BrightMail, TurnTide and MessageLabs). Cisco might have a shoe or two to drop in the anti-spam SaaS arena. Since he was hired in March, 2007 McAfee's Dave DeWalt has spent over a billion dollars on seven acquisitions which completely reshape McAfee's security offerings and puts more McAfee branded security products out into channel. That works out to roughly $1.3M daily since he took over. McAFee ended 2007 with $1.3B in cash. That's now come down to $594M so there might not be room for any more major deals. And then there are the HP rumors which pop up regularly. Hopefully, some of its acquisitions will start paying off.

 Dave DeWalt's Shopping Spree

 

MessageLabs Rings the Bell

Do you remember back in early October? (Just last month -- when your 401K actually had money in it!) In an announcement that occurred just as the bottom fell out of the stock market, Symantec announced its intentions to acquire MessageLabs, provider of online messaging and Web security services, for $695M in cash (of which £310 million in Pounds Sterling which turns out to be a pretty good financial move by Symantec as the Dollar gained significantly over the Pound in the past month). We've followed the anti-spam market for years and what never ceases to amaze us is how much startup valuation has occurred in this market segment over the years. We always like to remind people that there are just a few hundred high volume spammers out there who have created over $3B in liquidity events in the past five years. MessageLabs' stats were pretty impressive: Sales of $145M, 19,000 customers (8 million users) in 86 countries (63% of its business from EMA). This is Symantec's third acquisition in this segment (Brightmail and TurnTide were added in four years ago).

Milestones

A couple of interesting company transitions took place recently. E-mail trust guarantor Habeas was acquired by its New York based rival Return Path for an undisclosed amount which now boasts of having 1,500 e-mail sender customers for which Return Path improves e-mail delivery results. That leaves it down to two main players in the e-mail sending space -- Return Path and Goodmail systems -- to battle it out. On another front, Instant Messaging security provider Akonix was quietly acquired by Quest Software also for an undisclosed amount of money. In January, 2006, Symantec acquired IMlogic and eventually bundled IM security functionality with its BrightMail e-mail security products. This leaves FaceTime as the major independent provider with an IM security product family.

Tale of Two Technologies

In early August, McAfee announced its plans to acquire Reconnex for $46M in cash, about equal to the capital invested in the company and a price that almost certainly left little or no booty for the common stockholders and certainly only a shadow of the $350M that Symantec paid for Vontu less than a year ago. That pretty much draws to a close the Reconnex story, one of the pioneers in the Data Loss Prevention arena. It's probably for the better as the data loss prevention products are more saleable to organizations when packaged within a broader product family like McAfee's. DLP/ILP is interesting technology but, it's also difficult to sell. DLP never really established its market value. Initially these systems were sold as something like a firewall -- "Buy this box and install it and bad things won't happen!" But the truth was more complicated and had to do with the complexity of language. DLP never avoided the tradeoff between precision (few false positives) and recall (not missing anything). If you wanted to configure these boxes to find everything they created a mountain of data someone had to wade through. If you cranked the configuration down to avoid these false positive it didn't find everything. So the products weren't the neat solution that the investors had wanted. This brings to seven the number of acquisitions in this space over the past two years, leaving just a few independent, possibly struggling, startups. It's not that the technology doesn't provide value; it's just that what the customer wants -- protection of information -- is much broader than any single offering provides. At about the same time that the DLP/ILP sector began, another group of companies started down the disk encryption path with a similar mission in mind -- protecting customers' data -- but with a simpler concept -- encrypt the disk so that if a laptop gets lost or is stolen, the information is unavailable. Since 1% to 2% of laptops get lost or stolen each year, disk encryption makes sense as a first order response to protecting information. Organizations spent nearly ten times as much on disk encryption products than they did on DLP/ILP technology. And the exit results reflect this. While the seven DLP companies sold for a total valuation of $784M, three disk encryption companies were sold for $1.2B during the same timeframe. Interestingly, McAfee is playing on both sides of these markets -- having acquired Onigma, Safeboot and now Reconnex.

Shaping Up

Symantec used its Vision conference earlier this month in Las Vegas to point out that the company has gotten its act together in relation to its product line. You might remember that as recently as a year ago there was a lot of "post acquisition product line anxiety," especially with the Veritas pieces. Basically the story goes something like this -- the core business groupings are Data Protection (including the Backup Exec and NetBackup pieces separated out from the storage group), Endpoint Security and Management (including Alteris), Storage Management, Information Foundation, Compliance and Security Management (IFCSM), Consumer Security (over a billion dollars in revenue) and Services. Symantec talks about its emerging growth areas meaning things like virtualization, SaaS and Cloud Computing which the company is still coloring in -- along with doing creative things like a relationship with Waway for a storage appliance initially targeting the China storage market and its acquisition of SwapDrive which is part of its consumer group's SaaS offerings. The good part was that getting their core businesses aligned puts them in a position to figure out how they can innovate off of this base. And it's always nice to see a John Thomson keynote -- he's a delight to listen to and we've yet to see him with a PowerPoint slide.

Cross Roads

At Vision, Symantec announced its Veritas Virtual Infrastructure which basically combines storage management capabilities from Veritas Storage Foundation with the Citrix XenServer virtualization technology from Citrix Systems. It's an interesting idea -- to extend a server virtualization platform with its own built in storage management functionality, but it does raise the question of whether Symantec should partner with VMware as it has successfully done with its award winning NetBackup for VMware products (also including PureDisk) and with similar partnerships as it moves its security products into the virtualization world? Or is it better in the long term to compete head on in the virtualization arena directly against products like VMware's ESX and Microsoft's Hyper-V? Perhaps co-opetition is to the point where you can do both. WE always love a good fight -- we're looking forward to see how these battles shape up.