Amit Ghate • 31 Comments
Stephen Simpson, CFA • 10 Comments
Oct. 21, 2015, 12:34 PM
- Several security tech plays, including ones that were tech sector darlings earlier this year as a torrent of hacking incidents led corporate cybersecurity spend to jump, are selling off on a quiet day for equities.
- Major decliners include Palo Alto Networks (PANW -4%), FireEye (FEYE -4.9%), Fortinet (FTNT -4.3%), CyberArk (CYBR -4.8%), Imperva (IMPV -5.3%), Proofpoint (PFPT -3.9%), Qualys (QLYS -2.8%), and Rapid7 (RPD -6.8%).
- No major news has arrived to trigger a selloff. Meanwhile, hacking-related stories have continued producing ink in recent weeks. Notable ones: China is reportedly continuing hacking attacks on U.S. firms in spite of a pact that banned government spying on companies; authorities are probing a potential Russian hack of Dow Jones; and ISIS has reportedly tried (without much success) to hack the U.S. electrical grid.
- The PureFunds ISE Cyber Security ETF (HACK -1.6%) is down 24% from a June peak of $33.91. YTD, it's only down modestly.
- Proofpoint reports earnings after the close, and Fortinet tomorrow afternoon. Qualys reports on Nov. 2, FireEye on Nov. 4,, CyberArk on Nov. 5,, and Rapid7 on Nov. 12,
- Update: One potential culprit: Server virtualization software leader VMware is cratering due to its soft Q4/2016 guidance (partly blamed on cloud adoption). A smattering of other high-beta enterprise tech names are also selling off.
Feb. 18, 2015, 1:13 PM
- Check Point (CHKP +0.5%) has acquired Hyperwise, a stealth-mode Israeli startup declared to have "developed a unique and cutting-edge CPU-level threat prevention engine that eliminates threats at the point of pre-infection." Calcalist reports the purchase price is $80M.
- Check Point asserts Hyperwise's software "provides a higher catch rate of threats and provides organizations an unmatched level of protection against attackers," in part by blocking malware before it become active on a network, and that its CPU-level blocking can stop previously undetected attacks. It will be added to Check Point's Threat Emulation solution, which runs suspect code in a virtual sandbox to determine if it's a malicious.
- FireEye (NASDAQ:FEYE), whose virtual sandbox solution has often been praised, is arguably the leader in the threat-prevention space. Next-gen firewall vendor Check Point rival Palo Alto Networks (NYSE:PANW) is also going after the market, aided by technology obtained from startup Cyvera. Corporate interest has been growing rapidly following a string of well-publicized hacks.
Mar. 24, 2014, 6:25 PM
- Though Palo Alto Networks' (PANW -4.3%) $200M acquisition of endpoint security startup Cyvera might lower its 2014 EPS by 10% and 2015 EPS by 20%, it also stands to increase the company's addressable market by a quarter to ~$20B, thinks FBN's Shelby Seyrafi.
- "We view this acquisition as a logical expansion of the company’s end market that enhances its ability to provide end-to-end threat protection," says Baird's Jayson Noland. He notes Palo Alto's management plans to create an "overlay sales force" to sell endpoint security solutions.
- FBR's Daniel Ives sees the deal, the latest in a string of high-profile security acquisitions (I, II), as part of a "massive consolidation in the security landscape" set for 2014. He thinks Fortinet (FTNT), Proofpoint (PFPT), and Imperva (IMPV) could be among the companies snapped up this year by larger tech firms.
Mar. 24, 2014, 11:38 AM
- Palo Alto Networks (PANW -4.2%) is acquiring Israeli cybersecurity startup Cyvera for $200M. The deal is expected to close in 2H14.
- Cyvera attempts to prevent zero-day attacks via software installed on Windows endpoints (PCs, servers) that scans for known exploit techniques. The company asserts is solution is superior to alternatives that require a threat to be triggered before action is taken.
- The purchase comes on the heels of FireEye's (FEYE -7.1%) purchase of leading endpoint security software/services firm Mandiant; that deal has a value of $1.5B+, after factoring the post-acquisition gains seen by FireEye's shares. Symantec and Cisco's Sourcefire unit also offer endpoint security solutions.
- Much as FireEye aims to integrate Mandiant's software/services with its threat-prevention hardware and services, Palo Alto plans to integrate Cyvera's software with its next-gen firewalls and cloud-based security services (e.g. WildFire).
- Palo Alto: "Cyvera is an absolute standout. They’ve come up with a completely different approach: one that will forever change the endpoint security industry ... they’ve successfully stopped every published zero-day attack since they first began deploying their product."
- Palo Alto bought threat-intelligence startup Morta Security in January. Both Palo Alto and FireEye are selling off on a rough day for tech stocks.
Jan. 6, 2014, 4:30 PM
- Palo Alto Networks (PANW +4.5%) has bought Morta Security, a cybersecurity startup in stealth mode, for an undisclosed sum. (PR)
- Palo Alto asserts Morta's team "brings additional valuable threat intelligence experience and capabilities," and suggests it will help develop (together with Palo Alto's next-gen firewalls and security services) a comprehensive platform for the burgeoning cybersecurity market.
- Palo Alto suggests such a platform would mesh security controls, traffic/port/protocol inspection, threat detection and analysis, and automatic policy changes to deal with new and unknown threats, and would thus be superior to traditional point solutions that "address only specific types of attacks, or phases of the attack."
- The purchase comes less than a week after FireEye (FEYE) announced the acquisition of leading endpoint security and incident response software/services firm Mandiant for $1B+, with the goal of creating an unmatched cybersecurity platform.
- While Palo Alto (naturally) asserts firewalls should act as "the core enforcement vehicle within the network" for cybersecurity, FireEye offers dedicated threat-prevention hardware that interacts with firewalls.
- PANW +3.8% AH. FEYE -0.4%.
Jan. 3, 2014, 10:39 AM
- Several security hardware and software vendors are trading higher in response to FireEye's $1B+ acquisition of cybersecurity software/services firm Mandiant, and perhaps also FireEye's Q4 guidance hike. The acquisition, which comes six months after Cisco agreed to buy top intrustion prevention system vendor Sourcefire for $2.7B, is fueling hopes the industry will see additional M&A.
- KEYW (KEYW +9.9%), a cybersecurity software/services provider for defense and security agencies, is the biggest gainer. Other winners include Palo Alto Networks (PANW +3.6%), Barracuda (CUDA +3.2%), Imperva (IMPV +2.4%), Proofpoint (PFPT +5.3%), and Qualys (QLYS +2.3%).
Sep. 17, 2013, 2:06 PM
- Looking to challenge Cisco (CSCO +0.3%), Check Point (CHKP +0.9%), and market leader Palo Alto Networks (PANW +1.1%) in the growing next-gen firewall (NGFW) hardware market, H-P (HPQ -0.4%) has launched its TippingPoint NGFW line. (PR)
- Five models are being offered, the most powerful of which offers 10Gbps of throughput. Palo Alto's high-end PA-5060 firewall offers 20Gbps of throughput. Though H-P plans to continue selling TippingPoint intrusion prevention (IPS) appliances, the functionality of its new hardware leads Gartner's Greg Young to view the latter as a replacement for the former.
- Young estimates NGFWs have grown to make up 15% of the $8B firewall market.
- H-P is also launching Threat Central, a cloud-based service that analyzes potential threats detected by the company's ArcSight security software.
- Consider the moves an escalation of H-P's rivalry with Cisco. Cisco is set to acquire IPS leader Sourcefire, which has also rolled out hardware that combines NGFW and IPS features, and recently formed a managed security services unit.
- Meanwhile, F5 (FFIV +0.8%) has acquired Versafe, a developer of online fraud protection software and a cloud-based monitoring service, for an undisclosed sum. F5 declares Versafe's products will complement its firewall and access/policy management hardware, as well as its mobile app management software.
- Versafe can already be integrated with F5's mainstay application delivery controllers. In a blog post discussing the deal, F5 argues the ongoing rise of remote/mobile file access increases Versafe's value.
- H-P and F5's moves comes amid growing corporate interest in cybersecurity, following well-publicized hacking events.
Jul. 23, 2013, 9:29 AM
Cisco (CSCO) appears to have two main goals with the Sourcefire (FIRE) acquisition: 1) To grow its exposure to the intrusion prevention system (IPS) space, which is growing rapidly as reports of major hacking incidents put governments and enterprises on edge. Sourcefire, the IPS market's leader, has been expected to grow 25% in 2013. Cisco's security sales fell 4% Y/Y last quarter. 2) To develop end-to-end security platforms that combine traditional firewall tools with more software-centric offerings providing application/service-level security and a deeper understanding of user activity. Palo Alto Networks (PANW - next-gen firewall leader) and Fortinet (FTNT - UTM hardware leader) are each addressing this trend in their own ways. (PR) (John Chambers' security "blank check")| Jul. 23, 2013, 9:29 AM
Jul. 23, 2013, 8:18 AM
Jan. 14, 2013, 2:08 PMJohn Chambers recently said he gave Chris Young, the SVP in charge of Cisco's (CSCO) security ops, a "blank check" to hire and acquire as necessary over the next 2-3 years. Moreover, sources tell Reuters Cisco has been actively looking for security acquisitions. Chambers' motivation: while Cisco's security ops post modest growth, upstarts such as PANW, FTNT, and FIRE are growing much faster thanks to their focus on segments such as next-gen firewalls, UTM hardware, and IPS systems, products that offer deeper analysis of content/apps than traditional firewalls. | Jan. 14, 2013, 2:08 PM | 1 Comment
Jan. 11, 2013, 1:19 PMFortinet (FTNT -0.1%) has bought content delivery network (CDN) software startup XDN, XDN discloses on its blog. A Fortinet exec tells Light Reading XDN, whose software handles domain name requests and other Web traffic, was purchased to strengthen Fortinet's cloud security management offerings. He adds Fortinet envisions businesses adopting a "hybrid" security model that combines security hardware and cloud services over the long run. Rival Palo Alto Networks has also taken an interest in cloud security services. | Jan. 11, 2013, 1:19 PM
Aug. 15, 2012, 10:23 AMEMC COO David Goulder re-affirms his company's interest in buying security companies (previous). EMC, whose Q2 security software sales rose 13% Y/Y, has been looking to reduce its storage hardware exposure lately, as storage value-add increasingly shifts to software running on servers. Potential targets include richly-valued names such as Palo Alto Networks, Fortinet, and Sourcefire, and less costly vendors such as Vasco Data, IntraLinks, and Websense. | Aug. 15, 2012, 10:23 AM