Making sense of Websense's SurfControl buyout

The move makes the combined companies more attractive as a potential acquisition by one of the big three IT security firms

Websense's $400 million buyout offer for rival network filtering specialist SurfControl should help position the two companies for short-term growth and possible acquisition in the future, according to market watchers.

Company officials and industry analysts agree that the marriage of the two network security filtering specialists should provide both firms with immediate opportunities to tap into each others' customer bases and create new integrated products.

By pulling together two sizable players in a rapidly maturing segment of the IT security market, experts said, the deal could also serve to accelerate future consolidation of the overall sector.

With enterprise customers consistently demanding packaged products from smaller numbers of security vendors, most parties agree it seems logical for Websense's Web content filtering technologies to be married to SurfControl's messaging and anti-malware tools.

After the two firms integrate their various products, analysts said, security market leaders, including Symantec, McAfee, or Trend Micro, could come calling when looking for their next sizable acquisition.

"These companies don't want to be relegated to a single feature, which is sort of where they were going, but this merger brings together a lion's share of the filtering market and gives them both breathing room for a while," said Jon Oltsik, an analyst with Enterprise Strategy Group. "There are too many players in the market, and these are two of the more mature, compelling technologies, so this deal could make a lot of sense."

However, unlike Websense's $90 million buyout of data leakage prevention specialist PortAuthority in December 2006, which he labels as "very strategic," Oltsik said the SurfControl buyout is much more about the larger trend of security market consolidation.

Websense is touting the SurfControl deal as another step toward competing against the security market big three of Symantec, McAfee, and Trend Micro, said the analyst, but it may be that the merger makes the combined company an attractive target for one of the larger firms.

He likened the deal to network security appliance maker Secure Computing's August 2005 buyout of firewall and content security specialist Cyberguard for $295 million, another case where the analyst said a merger was based on market rationalization, rather than strategic goals.

"These companies needed to diversify because they can't charge as much, the filtering problem is becoming a lower priority, and people have dealt with it," said Oltsik. "This deal gives Websense and SurfControl some stability, and they also become a more attractive acquisitions target for any bigger player who wants to own this piece of the market."

In the meantime, Oltsik said he expects Websense to continue to look for additional targets such as PortAuthority that give the company a footprint in new and emerging markets.

Websense executives said they truly believe the firm can compete more closely with its larger rivals based on the buyout of SurfControl -- even though the two firms' combined annual revenues of roughly $275 million don't approach those of anti-virus market leader Symantec, which has sales of more than $4.1 billion.

"From our perspective, that's why we're doing this deal," said Leo Cole, vice president of marketing at Websense. "We believe that this acquisition allows us to build better content security solutions that put us in direct competition with those firms; we've got the security technologies that are more proactive than antivirus at catching threats on the Web."

Cole also cited the addition of SurfControl's security services business -- built largely around technology it acquired via BlackSpider in July 2006 -- as a significant element of the proposed Websense merger.

Getting into the outsourced content security service, where SurfControl's BlackSpider competes with vendors such as Postini, MessageLabs, and ScanSafe, presents another attractive opportunity for Websense to grow demand for content filtering technologies, he said.

Websense is also planning to use the acquisition to get a foothold in the emerging hosted security applications or SaaS (software as a service) market, which Symantec entered only in April.

"We believe this will eventually give us the ability to provide everything we sell in both a traditional software format and as software-as-a-service platforms," said Cole. "SaaS is a significant vision for Websense to reach more customers, and we already see a lot of demand for services coming from small and medium-sized businesses."

Whether Websense can eventually steal revenue away from its larger rivals by integrating SurfControl and pursuing SaaS remains to be seen, but in the very least, the deal should increase the strategic value of both companies as the market for their technologies matures, said Paul Stamp, an analyst with Forrester Research.

Rather taking a wait-and-see approach and focusing on respective areas of expertise in security, Stamp said, both Websense and SurfControl are wise to have sought each other out.

"This certainly doesn't put them on the same scale as the companies they want to compete with, but it gives them a complete content filtering offering and the ability to deliver that via SaaS, which is interesting," Stamp said. "We believe that both filtering and SaaS could be areas of growth over the next few years; many companies are still not protecting Web traffic or they're still using older ideas around software and appliances that don't scale to the largest environments."

Copyright © 2007 IDG Communications, Inc.

How to choose a low-code development platform