Dive Brief:
- Cisco reached a deal valued at $28 billion in cash, or $157 per share, to buy software observability firm Splunk, the companies announced Thursday. The deal, which marks Cisco's largest-ever acquisition, is built around the "complementary capabilities" across AI, security and observability between Cisco and Splunk.
- Cisco expects the deal to become cash flow positive and gross margin accretive within the first fiscal year after the deal closes, which is expected in Q3 2024. The agreement, which has been unanimously approved by the board of directors at Cisco and Splunk, remains subject to regulatory approval.
- Splunk President and CEO Gary Steele will join the executive leadership team at Cisco, reporting directly to Chair and CEO Chuck Robbins.
Dive Insight:
Splunk has made a name for itself with its abilities to search, analyze and visualize data, a level of observability that has become more important for application security and compliance.
Already, Cisco and Splunk have a history of partnerships, which Steele highlighted in Splunk's announcement. The deal will allow the companies to build "comprehensive visibility and insight in the market across security, observability and network operations," he said.
Cisco previously tried to buy Splunk for $20 billion, The Wall Street Journal reported in 2022.
“This acquisition is a massive win for Cisco's security business," Allie Mellen, principal analyst at Forrester, said in a statement. “Cisco has long been a case study for acquisitions that don’t live up to their initial promise and suffer from underinvestment and a lack of focus. That said, in recent years they have maintained the Duo acquisition."
"To keep Splunk’s massive, loyal user base, Cisco needs to let Splunk deliver what Splunk does best: a flexible, powerful SIEM and observability offering," Mellen said.
Alongside Cisco's greater resources, go-to-market capabilities and scale, Splunk will be able to innovate more quickly, Steele said.
There's no question of Cisco's scale. The Fortune 100 company has a market cap of $215 billion, with annual revenue of $57 billion, up 11% year over year, for the fiscal period ending July 29. End-to-end security revenue was flat in Q4, but revenue for the segment was up 4% year over year, reaching $3.8 billion.
Mellen said the acquisition solidifies Cisco as a key player in both the extended detection and response and security information and event management market. "Most XDR vendors have shifted to having a SIEM or SIEM-alternative offering in their portfolio," Mellen said. But with the Splunk deal, Cisco adds depth to its SIEM portfolio.
It also stokes SIEM market tension. Microsoft's Sentinel is the biggest SIEM competitor to Splunk, "and users will flock to or expand their Sentinel deployments as they hedge their bets between where Cisco takes Splunk and where Microsoft takes Sentinel," she said.
There are concerns among security leaders that the merger may degrade the quality of a SIEM tool they've come to rely on, Mellon said.
Economic volatility this year had many experts forecasting an uptick in merger deals in the cybersecurity sector, particularly as funding dropped and customer demand pushed for tool consolidation.
The Splunk deal spans the security and information technology ecosystem, particularly as both vendors highlight the rise of AI. It also eclipses other major security deals, including Google Cloud's $5.4 billion purchase of Mandiant last year.
For Roger Thornton, co-founder and general partner of Ballistic Ventures, "it's surprising."
"Cloudflare or Akamai would have been easier for Cisco to digest," Thornton said in a statement. "It will be great for Cisco if they can retain the team as it expands their capabilities and cements their transition from a hardware vendor to a software company.”
