Shopping List: Cybersecurity Acquisitions In 2016
Last year saw several large IPOs in the cyber security sector, including Sophos and Rapid7. This year has already seen several big companies buying up smaller, privately held firms as they look to plug the gaps in their solutions.
Four big cyber security acquisitions that have already taken place this year - and why they happened.
1. IBM: Resilient Systems
When: 29 February
How much: Although neither party confirmed the amount involved, various reports suggested that the acquisition had cost IBM more than $100 million.
What: The Massachusetts-based company automates and orchestrates the processes required during cyber incidents. The platform provides a set of response playbooks for the different types of incidents, driven by a knowledge base of regulatory and compliance requirements.
Why: Alongside the acquisition, IBM announced the X-Force Incident Response Services unit, which is a consultancy arm working directly with clients to help them prepare for and mitigate cyber attacks. Within this setup, the Resilient Systems platform will be combined with the QRadar Security Intelligence Platform.
According to Bruce Schneier, CTO of Resilient Systems, his company's platform makes QRadar actionable, while QRadar makes Resilient Systems’ platform more powerful.
2. Infoblox: IID
When: 8 February
How much: $45 million
What: IID, based in Washington, collects threat data from thousands of sources such as law-enforcement agencies, Internet infrastructure providers, and open-source providers.
The threat research team verifies and aggregates this data to create threat intelligence that works with automation standards. This threat intelligence is then distributed to customers.
Why: Infoblox, which helps clients manage DNS, DHCP and IP addresses by alerting them of suspicious activity, will use the technology to provide more context-aware security by combining contextual network data with the federated threat intelligence and dedicated threat research team.
Infoblox claims to offer enterprises better operational control, which will allow network and security teams to prioritise threat response at scale, based on the context and risk. Infoblox will also be able to go beyond protecting on-premise devices to company-managed devices that are off-premise.
3. BlackBerry: Encription
When: 24 February
How much: Unknown
What: Encription is a UK-based cybersecurity firm, providing a range of services including penetration testing, training and forensics.
Why: Encription will form part of BlackBerry's new consulting practice, the Professional Cybersecurity Services, which will help organisations assess and thwart cybersecurity risks. It is split into four main services: strategic, technical, automotive & IOT and detection, testing & analysis.
Strategically, BlackBerry's move into services is an attempt to pivot away from its device business. While it is still best known as a handset manufacturer, it has struggled to compete with Apple and Samsung's high-end consumer-focused smartphones in the enterprise.
Part of BlackBerry's response to this was to create its first Android phone, combining security with the user experience benefits of Google's operating system.
A larger part has been to switch to providing software and services, a segment which has seen revenues more than double year-on-year to $162 million in the company's Q3 results.
4. FireEye: Invotas
When: 2 February
How much: Unknown
What: Invotas works in security automation and orchestration, allowing organisations to consolidate data from multiple sources.
Why: FireEye will integrate the technology into FireEye's platform, allowing customers to purchase security technology and consolidate this into a customised incident response plan.
FireEye will be able to unify the security product, threat intelligence and incident response elements of the FireEye platform within a single console. Enterprises will then be able to respond more quickly to attacks through automation.
FireEye wants to use the technology to help customers deal with shortages of resources by automating security processes through including intelligence in their operations. Invotas should allow organisations to quickly move from alert to remediation.
The high level of activity among the big players is in line with expectations. According to 451 Research's survey of technology investment bankers in December 2015, cybersecurity had displaced mobility as the area where M&A spending was expected to grow over the next year.
20 percent of the investment bankers surveyed expected 'substantially more' activity, while 52 percent anticipated 'somewhat more' activity.
Part of the focus seems to be on services around cyber security rather than the technology itself. Both IBM and BlackBerry are using their new acquisitions to build new consultancy services.
Two of the acquisitions above, IBM's and FireEye's, focused on automating responses to cyber-attacks, perhaps indicating a keenness among organisations to move away from hiring security staff, who are currently in very high demand.
