May 2nd, 2007
Wow, the security industry is consolidating!
All right I'll be the first to admit it - Websense acquiring a competitor, Surf Control, is indeed industry consolidation. The news broke last week and, as could be expected, it was labeled "security sector consolidation". I am somewhat constrained from commenting on industry matters now that I am not an independent analyst. But, because I have been ranting for years that the industry was *not* consolidating, I must chime in. (See previous blog postings here, here, here, here, here, here, here and this column here).
This event is so unusual that it deserves to be highlighted. It is just about the only industry consolidation move since Secure bought Cyberguard. All of the big acquisitions in the last two years have been of two types. The first is when a security company buys into a developing sector to round out their portfolio. McAFee buying Onigma and Websense buying PortAuthority to get into the nascent leak prevention space are great examples. Checkpoint buying PointSec is another good example. The other type is when a big infrastructure company buys a security player to add security cred to their brand. EMC+RSA and IBM+ISS are the prime examples.
But consolidation is different. To see signs of that you have to look for companies in the same space, competitors, that get bought up. If consolidation were the game of the day you would see well funded roll-ups occurring. Some private equity group would decide they wanted to own the SMB appliance space and buy up Watchguard, Sonicwall, Borderware and Barracuda. This is not happening and I doubt it will. The risks from disruptive innovation are too great. This type of merger activity does not make sense until the day that the threats stop changing. And that day is a long way off.
So what about Websense and SurfControl? This is consolidation pure and simple. It creates a much bigger Websense with a bigger footprint, more customers, and more products. So maybe it is time for the industry to consolidate. But contrary to Art Coviello's prediction this past February that there would be no stand alone security players by 2010, I believe that three years from now there will still be a handful of large security companies, about 2,000 point product companies, and yes most large IT infrastructure companies will finally have security components in their offerings. In other words, there will still be work for security industry analysts!
Disclosure: I work for Fortinet, Inc. A competitor to every company mentioned in this post.
Richard Stiennon is an industry consultant. See his full profile and disclosure of his industry affiliations.
