McAfee buys Reconnex - another DLP vendor gets acquired

For those that read this blog for Data Security/DLP reasons, you have good reason to complain that I've been neglecting that area in favour of Identity lately. On the flip side, anyone who doesn't give crap about Data Security or DLP can tune out this time around.

Despite Matt P, Clayton and Nishant jokingly suggesting I should write for sitcoms, I'll put that career on hold for now and get back to business...although if Nishant and Paul Walker continue their thread, I could have more paraphrasing fodder :-)

On to the topic at hand...

McAfee announced late last week that they are acquiring Reconnex for $46 million USD. They acquired a few other companies (Onigma for $20 million USD and Safeboot for $350 million USD) to start themselves along the DLP track and have now filled out the portfolio with assets to address some holes in their offering. What were the holes? Data discovery and network monitoring.

The acquisition wasn't a huge surprise. Symantec have traditionally been McAfee's main competitor and happen to also be their biggest competitor in this space.

Symantec started themselves along the DLP track by acquiring Vontu for $350 million USD. Vontu's strength was in its data discovery and network monitoring capabilities. I should also mention they had lots of customers and were considered to be the market leader in DLP. They've only recently branched out into offering endpoint monitoring and control (I assume this is thanks to Symantec's development budget).

Onigma's technology was an endpoint monitoring and control product. This meant that when McAfee compared itself to Symantec, it found itself sorely lacking from an overall solution standpoint (at least from a marketing perspective). Reconnex fills the void.

Let me take Safeboot out of the picture for a minute because it doesn't compete directly with the Vontu technology. McAfee's only had to pay a fraction ($20+$46 = $66 million USD) of the amount Symantec spent ($350 million USD) to get a comparable set of products. If you do the maths, it's less than one fifth! At face value either McAfee got a steal or Symantec got screwed. To be fair to Symantec, they did have to pay a premium because they were buying "the market leader" and also the set of customers Vontu had. DLP was also a much "hotter" topic at the time (it still is, but the buzz isn't as crazy) and in case you haven't noticed the world economy is in a bit of a slump at the moment. Even after taking these factors into consideration however, I'm not sure that premium should have been 5 times the amount McAfee forked out.

Your move Symantec...which brings me back to Safeboot. Symantec announced their Endpoint Encryption offering earlier this year. In reality, this is an OEM agreement with GuardianEdge and a direct response to McAfee's Safeboot offering. I wonder how long it'll take Symantec to buy GuardianEdge now that McAfee's filled their gaping DLP hole?

McAfee acquires SafeBoot

McAfee announced earlier this week that they were acquiring SafeBoot for $350 million USD. It's actually a good move, despite what I'm about to say.

It's almost like the McAfee product strategy people have been going through the PCI-DSS standards and acquiring technology to address gaps in their portfolio so they can sell a portfolio that "solves" all of a customer's PCI issues (or so they say):

1. They've had their Anti-virus and Anti-spyware solutions for a long time.
2. They acquired Onigma at the end of 2006 for its data leakage/loss prevention/protection (DLP) capabilities. They also just updated the DLP product with functionality to catch up with its competitors somewhat (although they're still behind in functionality).
3. They've got network access control software.
4. They've got a so called policy engine.
5. And now they've just shored up their encryption capabilities with the SafeBoot acquisition.

The gaps left are:

1. Firewall - but McAfee will probably say they've got that covered with their intrusion prevention solutions working in conjunction with their network access control solution.
2. System passwords and restricting access to information. In other words, Identity and Access Management.
3. Testing and monitoring all accesses to resources and data. Again, more Identity and Access Management - although McAfee will also claim their DLP product working with their network access control product and their policy engine gives them the tick in the box here.

It all looks very nice on a marketing slide of course. They still have to integrate all this technology. The technical integration of acquired products takes time and they usually don't play nicely with each other until the N+2 or N+3 release post acquisition.

Another thing. Their list of products is growing. If they aren't careful, they'll end up like Tivoli's portfolio from a few years ago, where half the products overlapped in functionality with the other half and very few of them worked nicely together. Tivoli have since fixed that, but it took a few years.