Peter Christy

Cavorting on Biscayne Bay

While everyone else was holding user and analyst fetes at Moscone in San Francisco, Citrix hauled us back to the Key Biscayne Ritz-Carlton near their Florida Mother Ship. We've gotten to know the Citrix team reasonably well since they acquired our NetScaler friends. President and CEO Mark Templeton seems to be one of those guys in the same category as John Chambers -- nice person, people like to work with him while at the same time being a relentless driver for evolution and change. XenSource is the latest Citrix acquisition and the XS team was around to talk about that even though the deal hadn't officially closed. Our earlier analysis of the acquisition hasn't really changed much -- there are no shortage of challenges after you spend $500M of your stockholders' hard-earned money on a company without any real revenues (as e-Bay's Meg Whitman seems to be painfully learning with Skype on an even bigger scale). The XenSource acquisition certainly could make good sense for Citrix and in many ways represents business challenges they can't evade. There aren't a lot of details at the blocking and tackling level yet, but the story line holds our attention.

Hold the Presses -- Citrix Antes Up with XenSource

Just as we were going to press with this special VMware IPO issue Citrix strode boldly into the fray with a $500M acquisition of XenSource. XenSource is the commercial aspect of the Xen project, the Open Source hypervisor funded early on by Intel and others. XenSource has received a lot of attention because of the hotness and importance of virtualization and the role XenSource plays in leveling the playing field against VMWare (assuring alternatives to VMware solutions and limiting the impact of proprietary solutions). To date XenSource has had limited commercial success, certainly compared to the $1B run rate achieve by VMW. Given that VMware is moving aggressively into desktop virtualization -- the market strength of Citrix -- and now has a $1B war chest with which to cause problems it may well have been necessary for Citrix to counter thrust into the core VMware market which the XenSource acquisition certainly does. In the acquisition conference call Mark Templeton didn't say much about where this all goes but hinted that they will drive along the wedge of openness and community interest which is certainly the VMware Achilles Heel. This also aligns XenSource even more closely with Microsoft based on Citrix's unique and long standing synergy with Microsoft. If we needed any more evidence that infrastructure can be sexy and valuable we just got it.

Cisco Buys In

As part of the run-up to the IPO Cisco made a $150M investment in VMware in the "strategic" category with the stated intent in part to "foster solutions for enhanced datacenter optimization." We can't resist a little speculation as to what that might be. In their Data Center 3.0 announcements at Networkers Cisco painted a vision of virtualizing CPU's and memory but when questioned, state that it is in the 5-10 year timeframe, so it probably isn't about radically different computers to be virtualized. So we would instead focus on how to make today's virtualized data centers better. What could be done that would improve a virtualized data center and demonstrate incremental value in Cisco datacenter switches? A typical environment is large servers running VMware ESX connected to large Cisco Catalyst 6500 switches. Let's assume that Cisco is buying influence at the hypervisor layer (ESX) that sits between the virtual servers and the bare metal computer system so that they can make the hypervisor design more synergistic with Cisco switch design somehow. Simplistically, today, each virtual server has a virtual NIC, so in a physical server there are lots of virtual servers and lots of virtual NIC's, all of which show up on the network as IP addresses. We could speculate about putting an entire virtual Cisco switch down in the hypervisor but that's a huge amount of mechanism and doesn't seem like a smart technical idea given that the hypervisor is supposed to be light and thin. That suggests that the right answer would be something between a NIC and a whole switch. They could put a virtual switch port in each virtual server (or two). In that case, what exists in the hypervisor is like a Cat line card I guess (lots of ports but lean and fast). Hmmm... that sounds interesting but we don't know enough about how the switches are built to understand what it means in any detail. Film at 11 I guess.

nCircle Acquires Cambia

As the security business matures and necessarily focuses on things like business risk management there's going to be some consolidation going on. Rather than just sit around and wring hands and wait for one of the big boys to call, our friends at nCircle are starting a roll up of their own beginning with the acquisition of Cambia and in the process extending its product line with configuration auditing functionality.  nCircle started with innovative vulnerability scanning technology but realized quite a while ago that the dynamic and accurate "as built" system configuration data base that they manage is useful for much more than managing vulnerabilities. Cambia is their first step in broadening out the portfolio in anticipation of the consolidation. We look forward to the next shoe dropping.

Don't Try to Understand It -- It's Just Magic!

Our favorite device in the "Magic" category is the Turntide system that Symantec acquired just after acquiring Brightmail.  We had a chance to catch up with Carlin Weigner recently (Symantec's Mr. Spam now that Enrique has been called to even bigger challenges). After some struggles productizing Turntide, Carlin now reports the much sought after market traction. If you don't know what we're talking about, the Turntide box sits in an incoming mail stream and builds a model of the reputability of each mail server sending mail.  As a server's reputation diminishes, the Turntide box throttles what they receive from that source. What's really clever about the approach is that since the Turntide box never rejects or quarantines a message (just slows its arrival) it never loses good mail (zero false positives). After the acquisition, Symantec was able to improve the Turntide offering by leveraging all the Brightmail spam detection and reputation capabilities.  Prior to that, each Turntide box independently determined the spaminess of senders using only local Bayesian algorithms with the resulting limitation that it took a lot of protected mailboxes to tune up the reputation. Leveraging the Brightmail algorithms and services a Turntide box can be more effective with many fewer mailboxes in back of it. So you turn on the box and after awhile 70% of your incoming mail volume just doesn't show up anymore (magic!). Carlin reports the biggest problem is that when the service renewal comes up some of the customers, noting that they don't get much spam any more, don't renew. Of course with the box off it isn't long before the mail volumes rise dramatically again illuminating the mistake in reasoning (Carlin denies that a Symantec controlled BotNet fed with subscription renewal information had anything to do with it).

EMC's Security Thrust

We wormed our way onto our old friend Dennis Hoffman's calendar and talked to him just before EMC announced closing the RSA deal and the acquisition of Network Intelligence.  Dennis has kept us informed about his quest to build a major new business for EMC in security (the problem with the storage business is that the underlying disk drives keep getting cheaper and cheaper). EMC has reasoned that unless you can adorn storage with higher level values such as information life-cycle management and security it's got a pretty grim future. Dennis has been working on the security plan for about a year and we think his accomplishments to date are pretty impressive. There is great merit in the notion of securing the data as a key component in a comprehensive security strategy, and despite the purchase price, RSA provides an important brand with very high market share in key storage-related technology and applications. In his devious past Dennis used to be a strategy consultant so maybe we shouldn't be impressed by his accomplishments but we really like the strategy. Now all would agree it moves to that nasty execution phase and then the market has a chance to comment on the "dogfood."

Back to the Future

For those of us who have tracked Internet caching more or less from the beginning, it marks the end of an era to see Blue Coat (nee CacheFlow) acquire the caching business from NetApp. NetApp got into the caching business by buying Peter Danzig's company; Peter can reasonably be thought of as one of caching's founding fathers because of the Squid proxy code he had created earlier in academia that formed the beginning for many commercial offerings. The deal included some additional financing which allowed Blue Coat to make the acquisition and put some money in the bank perhaps to make another big move.  The NetApp product team in India stays with NetApp so Blue Coat is really buying access to the NetApp customer base along with the product line, an attractive target given NetApp's blue ribbon filer customers. Although we doubt that Blue Coat will revert to the CacheFlow name, with this acquisition and Blue Coat's latest product announcements the business has swung a lot back from security to the use of advanced proxy technology for acceleration -- sort of déjà vu all over again.

Cisco Acquires NetWare

Did that get your attention? OK, we really meant that Cisco bought Arroyo Video, the current brainchild of Drew Major, the creator of NetWare (and if you're a regular reader one of the gods in our firmament).  Arroyo builds video servers for the cable and IP SP business. Drew's theory was that the time had come where that could be done with commodity technology. There turned out to be devil in the details of making it as rock solid and automatic as the media business demanded (little quirks while watching a movie are not appreciated) but those problems were overcome. The more serious limitations were the resistance of buying from a small vendor (buying from Cisco is much better). The more serious business issue is getting the networks and the cable companies to sort out what can be seen on demand and at what price. As anyone who has Comcast on demand knows that still is a mess. Anyway Cisco's $92M is a nice return on the investors and Cisco now has one of the best software architects around.

Those June Marriages

In a fit of corporate connubial bliss EMC marked the marriage season by gobbling up RSA.  EMC has been unable to really get organic revenue growth following the dot com implosion and this clearly reflects a goal to build significant new business as fast as reasonably possible.  At first blush RSA and EMC makes more sense than Symantec and Veritas in the sense that identity and authentication are key to practical security and storage is a critical asset to secure (if you remember the initial Symantec/Veritas thesis was that Symantec's awareness of broad security issues could be leveraged to trigger locking down data assets when the threat level climbed beyond some threshold). On the other hand RSA's revenues have pretty much milled about for quite a while and EMC paid a pretty penny for a relatively small acquisition without any obvious organic growth. So the value must be in the synergy. The relevant problems are certainly there. It remains to be seen if and how the merged forces can compete with other entrenched security and identity providers including IBM, Microsoft and CA, not to mention Cisco.