A Timeline of Events

Back in early 2005, Bain Capital Ventures and Castile Ventures joined existing investors in an oversubscribed C round for Network Intelligence. The $12 million injection brought the total invested up to the $25 million mark. As part of the deal, Bain’s Benjamin Nye joined the board. Just over a year later, in June of 2006, EMC announces a definitive agreement to buy RSA for around $2 billion, which RSA shareholders approve on September 14, 2006. Two days later, on September 16th, EMC announces (in the same press release!) that they had a definitive agreement to purchase Network Intelligence and expected to close in the next 2 days.

Fast forward a year and we find Ben Nye taking another board seat, this time at Rapid7, after Bain Capital Ventures tosses them $7 million in growth funding on September 17th. Ben Holzman, also of BCV, joined the board as well. On September 8th, Jon Darbyshire also secures a place at the big boy’s table. A month later, in a what appears to be a growing trend for open source security tools, Rapid7 swoops in and buys Metasploit, effectively underwriting its continued development.

By the second week of November we see Bain Capital Ventures form a “strategic partnership with Archer Technologies which includes an estimated $29 million infusion (we’ve heard numbers as high as $42 million), netting them a 40% stake in the Overland Park, KS firm. As part of the deal, Ben Nye secures a seat on Archer’s board. Shortly after the ink on the deal dries, Archer announces that they are taking out ailing  PwC spin-off and GRC player Brabeion at a fire sale price (around the $10 million invested by Longworth and Fairhaven), closing the deal on January 22nd, 2009. This deal is largely seen as a content play by Archer to roll Braebion’s ESAS-based controls library into the SmartSuite Framework. Braebion CEO Julian Waits, along with about 25% of his employees, joins Archer. Interestingly, Yo Delmar, Braebion’s CMO, doesn’t take the bait and moves on to EMC within a few months as their Director of Strategic Offer Marketing.

By the end of the quarter, Archer announces that Rapid7 has joined as an integration partner, further deepening the ties between the two organizations. At around the same time, Network Frontiers and Archer announce the integration of the Unified Compliance Framework into the SmartSuite Framework, which leads us to question Archer’s content strategy as they are still struggling to choke down the 6000+ controls they inherited in the Brabeion deal.

By May of 2009, EMC has announced the purchase of Configuresoft. Configuresoft had hitched their wagon to the virtualization engine prior to the acquisition,  a smart move as traditional configuration management vendors began to follow suit. Configuresoft was then folded into the Resource Management Software Group at EMC, quite a distance from the RSA side of the house, firmly ensconcing the products in the management, not security and compliance, side of the business.

Still nursing a hangover from the 2010 New Year and we see EMC’s announcement to buy Archer. While we knew that this was brewing for a while, we thought the hurdles that EMC had placed in front of Archer would cause the deal to drag out a bit longer. Rumor has it that the deal was supposed to be announced and closed prior to the 2009 year end. Obviously, this is one of the facets of the deal that points to the “definitive agreement to acquire” as opposed to an outright acquisition announcement but is a press relations tactic employed by EMC regularly so is of little insight on its own.

What Does All of This This Mean?

We think that EMC/RSA might have difficulty with this acquisition. By placing the Configuresoft product line where they did, we think the silos in a company of their size will make any hope of integration between those products and the Archer SmartSuite Framework more difficult, if not impossible (depiste what Chuck Hollis says). This is further exacerbated by the existing relationships that Archer has with security configuration (nCircle and NetIQ) and vulnerability scanning vendors (Qualys and rapid7 to name just a couple)  where integration has already happened.

The ITGRC space has seen it’s fair share of acquisitions that bring together state-based security and IT GRC reporting, much as we have seen the SEIM market do with event-based security. We saw McAfee pick-up Preventsys (R.I.P.), an integration partner of Foundstone’s when they closed that deal and we have watched Symantec’s Control Compliance Suite do a reasonable job of making good on their BindView acquisition. Most recently, we watched Lumension climb up the stack by acquiring Dallas-based Security Works to layer onto their vulnerability and endpoint solutions.

Another contributing factor in the hot mess of post-acquisition integration is around Documentum. A number of large organizations are still storing audit testing and controls information in document-centric systems such as SharePoint or even the purpose built solutions such as those from Paisley (now ThompsonReuters) and OpenPages (built on PwC’s Internal Controls Workbench) which have historically shown little to no integration with compliance automation products.

Considering the deep involvement of Bain Capital Ventures in this deal, along with the cross-pollination of board seats and personal/professional history among the players, it would come as no surprise to see RSA pick up Rapid7 in a wired deal to accelerate the automation of state-based device compliance reporting while they figure out the rest of the integration story.

We also agree with the guys over at Rook that this might mark a bit of a thaw in security deals. The  price tag (rumored to be anywhere from $120 million to $225 million) has woken the sleeping VC giants which have started sniffing around this space for interesting start-ups to fund. Specifically, Thomas Weisel Venture Partners, who has a good bit wrapped up in BigFix could arrange a marriage with an up-and-coming IT GRC player or maybe even an established one such as Agiliance who already has an integration story. Speaking of Agiliance, with their partnership with McAfee, and McAfee’s churn around IT GRC we think that their integration story holds some weight in the context of state-based security and compliance management and could be picked up fairly easily. A start-up in the space that bears mention is Lockpath. Founded by two early members of the Archer team, Chris Caldwell and Chris Goodwin have deep experience in this market and were recently named Microsoft Start-up of the Day.

From the client side of the equation, you rest assured that this has put a chilling effect on burgeoning integration Symantec was working on whereby they were pumping CCS data into the Archer SmartSuite Platform, bypassing their own dashboard. We also think that Archer’s fragmented content strategy will create some issues as RSA figures out how and what to pile into the platform which could drive some simplification in the long term but some pain in the here and now.

Related articles:

1. LogRhythm Takes Down $3million B Round
2. Choosing a Controls Framework – UK vs. US Perspective
3. WhiteHat Security Gets $7M 4th Round

Had we not been distracted by the holidays, we should’ve called this one. Quite frankly, with the composition of the Orchestria management team, we should have called this one a long time ago. As we noted in our breakdown of Palo Alto’s latest round of funding (article here), it’s all about who you know and where your roots are laid down. In this case, all of the following Orchestria management team members were CA alumni:

• Paul Dean, SVP of Product Management: Formerly an AVP of storage at CA overseeing the ArcServe and SurviveIT product lines.
• Peter Malcolm, Founder and CTO: He joined CA from the acquisition of Cheyenne Software where he was the VP of Engineering and went on to become the SVP of Business Management at CA. He was also over the SurviveIT product line and then went on to tackle the entire storage line. After that, he moved over to Benchmark Capital as their European “Entrepreneur in Residence”. It’s no surprise then that Benchmark is an investor in Orchestria.
• Andrew Stickler, SVP of Engineering: Stickler and Malcolm date back to IQ International, a company founded and led by Malcolm that was acquired by Cheyenne in 1996. p[ost-acquisition, Stickler worked on the SurviveIT and ARCserve products.

We continue to encourage our community, specifically those of you buying technologies but also those VARs with a portfolio to manage, to research the companies you do business with. While you may be very happy with the relationship thusfar, as more and more of the big players look toward “off balance sheet R&D”, we will see more smaller players getting picked off (if they survive long enough). By understanding where the relationships are, you can gain some insight into who possible suitors are and where the technology might be headed.

As always, we are here to help. Don’t hesitate to submit a research inquiry before you make a purchasing decision. We can also help you narrow the field to those companies that are best aligned with your currently portfolio of tools.

Related articles:

1. P-Synch Maker M-Tech Acquired by Hitachi
2. Archer and EMC: More To The Story

Last week, U.K.-based Marshal and U.S.-based 8e6 Technologies announced that they are merging to create a company that will offer a suite of products to protect corporate and web-based e-mail, instant messaging, and web surfing. While the deal was nearly a year in the making, the new combined company – Marshal8e6 – has wasted no time in driving their 250 person global team since the papers were signed on November 12th. During this flurry of activity, we were fortunate enough to get some time with Marshal8e6’s Senior VP of Corporate Development, Paul Myer to pepper him with questions about the new company and where they are headed.

Myer works out of the company’s headquarters in Orange, CA, the same building where he was President and COO of 8e6 Technologies. He is joined by longtime 8e6 colleague George Shih, former 8e6 CEO, who is now the interim CEO of the combined entity (pending a new CEO search) and President of the Americas region. Meanwhile, across the pond, Bruce Green, former CFO of Marshal, will be President, International operating out of the international headquarters in Basingstoke, UK while Ed McNair, former Marshal CEO, and now Chief Strategy Officer, busily packs his bags for the move to Orange, CA in January.

Once a deal was hammered out, both firms moved quickly, this was easy according to Myer since both firms were privately held. The exact financial details are not public, but from our discussion, we know that Updata Partners invested $10 million into the deal. James Socas joins the board as a result, bringing his experience in M&A work from Symantec with him. Socas feels that investing in a down economy is like bargain shopping and the cash infusion will empower the new firm to go out and look for technology buys that fit the growth model.  Look for him, McNair and Myer to start shopping for good deals in this down market with that $10 million warchest. We speculate that they may move into enhancing their perimeter protection play by picking up some technology around intrusion prevention or more traditional firewall. This would give Marshal8e6 a significant boost in terms of competitive advantage against the larger players.

The combined trailing revenues are about $50 million per year, and the team has plans to grow that to $100 million by 2010. This aggressive growth plan includes strong upselling/cross-selling to respective markets (Marshal strong in EMEA, 8e6 in Americas) and technologies. With 75% of Marshals’ past 12 months of revenue from the mail security products, this is fertile ground for 8e6’s mature content filtering technology. Similarly, 8e6’s market strength around web filtering makes a compelling case for layering on messaging protection. The cross-sell opportunities gain momentum from the rapid work toward integrating the product lines that has already started.

According to Myer, the #1 development priority is to integrate Marshal’s existing TRACE threat lab and 8e6’s web site databases into a single threat store that feeds both sides of the business. Within the next week or two, they expect the TRACE database to be feeding the 8e6 platform live data. By Q1 they expect tighter integration of the data and feeding the Marshal platforms with 8e6’s store of malicious sites. This is a boon for blended threat attack detection and speaks volumes of the positive working relationships the two companies have formed over the past year. The sheer speed of the integration efforts, and the rapid value addition, if sustainable, should give them a leg up on competing with more entrenched players in the market. The larger companies (Symantec, McAfee, CA, etc.) are still suffering indigestion from their rounds of acquisitions and in most cases have had a difficult time integrating technologies.

The future product roadmap includes merging the reporting products into a single appliance that can manage and report across both messaging and web defense appliances. The early expectation is that the first phase of this will be completed in Q2 2009. Future integration of the defensive appliances may include a single hardware footprint for unified threat protection. This also is a clear winner when it comes to minimizing the total installation footprint, as well as giving strong messaging to the sales and channel teams. We expect some serious cross-training of the new combined channel to enable rapid cross-product adoption in each market.

Speaking of the channel, it will remain largely untouched for now, as will technical support, with both companies continuing to operate much as they always have. This is a huge relief for the customers of the combined company since there will be little to no disruption to their support mechanisms, something else the big boys have struggled with in nearly every way with their acquisitions.

We look forward to seeing how Marshal8e6 fairs in the coming months, and whether or not they can continue their blistering pace on the integration front. If so, then we think they will have a compelling story to start the new year with, and one that should make the competition take notice.

Related articles:

1. VMware to Acquire Blue Lane Technologies
2. Symantec Nabs MessageLabs for $695 million
3. Archer and EMC: More To The Story

1. November 1^st, 2003: $5million from Benchmark Capital and Matrix Partners
2. June 17^th, 2005: $13.8million led by Duff Ackerman & Goodrich with Benchmark Captial and Matrix joining the mix
3. December 18^th, 2006: $8.3million from all the above mentioned plus Presidio STX

This brings their total to a whopping (considering the exit) $27.1million. If indeed, they got picked up for $15million, then VMware got a sweet deal.

Related articles:

1. A River Runs Through Mazu
2. Archer and EMC: More To The Story
3. The Sun Still Shines on GRC

This acquisition will extend the capabilities of Big Yellow's SaaS play, the Symantec Protection Network. This is a great opportunity for the small/medium buiness (SMB) market to have a myriad of solutions available in one location with "one throat to choke" and only a single monthly invoice. This combined offering will now bring lightweight data loss prevention (DLP), compliance, endpoint security and archiving solutions within reach of the SMB market.

Essentially, the SYMC SaaS offering is a brand flanking move similar to The Gap, with Old Navy on the bottom and Banana Republic on the high end. Only in this case, the Symantec Protection Network is the middle tier with Norton on the low side and their enterprise solutions targeting the higher price points. Some will say we are incorrectly lumping Norton into this mix because it is a consumer brand, but if you have ever worked for or with a small professional firm, you know that many of them buy their PCs from the big box retailers which bundle Norton products in the purchase. As these firms grow, it will become natural for them to migrate to SaaS offerings instead of ramping up an IT shop of their own. Coupled with the August announcement to buy Australian anti-spyware vendor PC Tools,  and the summer acquisition of consumer-focused online backup company Swapdrive , they are poised to be the IT shop in the cloud. The real trick is in whether or not they can pull it off, and based on past performance, we are skeptical. According to the press release , John W. Thompson, CEO of Symantec thinks they can do it (of course he does), saying “By combining MessageLabs with our Symantec Protection Network team, we have one of the strongest portfolios of cloud-based infrastructure services and a great foundation on which to grow.”

What remains to be seen is how customers will transition between layers of the model without losing major functionality, or interrupting their increasingly important IT services.

Related articles:

1. Midwest Security Services Firm FishNet Nabs Additional Funding
2. Application Security Provider Imperva Nabs $20 Million
3. Lumigent Takes $6 million, Keeping GRC Hot

Founded in 1997, as NetSense, LLC, by Nitai Alush , IDFocus launched their product by engaging a large top tier company as a sugar daddy for their first version. effectively building a custom IdM solution as a consulting project, they later parlayed that first effort into engagements with other large scale organizations, most notably (and publicly) with International Paper. Continuing slow organic growth, and hooking some marquee clients along the way, IDFocus attracted 5 year CA Development Architect Charly Setbon in January 2006. Underscoring his technical understanding of the space, Setbon also had a tour at Business Layers before their acquistition by Netegrity.

We will see much more of this model in the coming 18-24 months. As we indicated in an earlier piece however, Wall Street won’t be the proving ground for these new start-ups to hone their products. Also, look for more “insider deals” like this one where deep ties to larger companies unfold into cheap technology acquisitions through sheer force of intimacy.

It is believed that in true CA form, the ACE line of products will be integrated into CA’s existing Identity Management software line and lose its branding along the way.

Related articles:

1. Wall Street Meltdown Poisons Security’s Greenest Pasture

Related articles:

1. Marshal and 8e6 Technologies Tie the Knot
2. RSA to Acquire Tablus

What we all know today as ControlPath, has had a turbulent and difficult time since it was first concieved as "consultingware" by Alderrman Consulting, LLC back when the world was being roiled with SOX audits for the first time and the GRC market was just glimmer in Gartner's eye. Colorado-based VAR, Accuvant picked up Alderman Consulting and their IP to form the backbone of their compliance practice back in 2004, keeping founder Matthew Alderman on to lead that charge under Accuvant founder and VP, Bill Strub.

What we learned shortly after was that a VAR may not be the right home environment to raise a young application. Our sources tell of a difficult time ensuring that the fledgling product was properly nutured and allowed to grow. Specifcially, a lack of resources (funding and attention) as well as clear leadership around the IP, along with a sales force unaccustomed to such solutions made it difficult for this youth to truely blossom.

Foster care being a transition period, Accuvant spun the venture out in 2006 to become ControlPath. It was really a sink or swim time for ControlPatch, thankfully, the arrangement kept Accuvant as a partner/reseller, giving them time to find their footing. Alderman stayed on in the new company as CTO, a role he held up until the Trustawave acquisition. Alderman continues to shepard his baby into adolescence as VP of Compliance Management Solutions inside of Trustwave.

It will be curious times as Trustwave begins their planned integration of the ControlPath GRC technology into their existing suite of SaaS compliance management solutions. How will they integrate their content model, a formidable part of the original offering? What will the move to "on-demand" do the ability to integrate with on premise solutions that feed the data hungry compliance monster?

According to Alderman, "This technology fits well with Trustwave's compliance suite, which currently includes solutions for a variety of regulatory mandates as the Payment Card Industry Data Security Standard (PCI DSS), Health Insurance Portability and Accountability Act (HIPAA) and Sarbanes-Oxley (SOX)."

Will they be able to scale out their content offerings to meet increasing demands in the still evolving GRC space or will they fall behind like some many of the other content rich GRC players in the market? Rest assured, we'll be keeping a sharp eye on Mr. Alderman and baby as they get acquainted with their new adopted parents.

Related articles:

1. Accuvant Follows Fishnet’s Footsteps
2. Symantec Nabs MessageLabs for $695 million
3. P-Synch Maker M-Tech Acquired by Hitachi

Now, all the major players  (CA , Symantec , RSA)  have a DLP play. How long untli this feature actually starts to get baked into the existing product footprints? Symantec has already openly stated a desire to wrap Vontu into the Endpoint Protection client, will they beat McAfee's drive of putting DLP on the endpoint in 2009?

Related articles:

1. Lumigent Takes $6 million, Keeping GRC Hot
2. Symantec Loses Vision, McAfee Maintains Focus
3. A Rose By Any Other Name…

In a deal announced on Tuesday, but signed last week, UTM (Unified Threat Management) company Fortinet has acquired the software and additional rights from IPLocks, a San Jose, California, database security software vendor.

The deal was not an outright acquisition of IPLocks, but instead an asset purchase with additional licensing and resale rights baked in. According to Searchsecurity.com, IPLocks unwound its US activities that supported the database vulnerability assessment product, but retained the Japenese operation, which centered on database auditing and monitoring tools. As part of the deal, Fortinet acquired the intellectual property for IPArmor, and the rights to continue to develop and resell the Audit Center and Audit control outside of Japan. This bundle of technology will continue to be sold under the IPLocks brand, at least for the time being.

The Japanese division, IPLocks Japan, will continue to operate independently, selling the database vulnerability scanner in Japan.

In an effort to retain organizational knowledge post-acquisition, Fortinet extended offers to the company’s 28 US employees (mostly engineering and sales), many of whom have accepted to join their new corporate parent. Having been in a similar situation twice in my own career, I'll be curious to see how long those employees stick around and waht the long term effect on technology integration efforts is going to be.

This acquisition is a high water mark for the year in terms of the number of deals we have seen. It also provides further evidence of companies being built around missing features and that then get acquired to round out the portfolios of market leaders.

Related articles:

1. Perimeter Buys a Checkbox
2. Enterprise Risk Managment Still Draws Funding
3. Microsoft & RSA Deal Feeds the Rumor Mill