After two weeks of speculation about the fate of ArcSight following its revelation in late August that it was looking for buyers, HP’s announcement yesterday that it would pull the trigger on a $1.5 billion deal came as a surprise to no one within the IT security community.
"I’m not surprised at all by this," says Scott Crawford, research director for Enterprise Management Associates. "ArcSight has been an HP partner for years–they’ve had this relationship going for some time."
A marquee brand within the security information and event monitoring market, ArcSight provides HP with an important piece of the security puzzle and also gives the company more ammunition in the battle for enterprise supremacy with competitors such as IBM and EMC, Crawford says.
"This one is their most visible targeting of security in enterprise priority so far," Crawford says. "And I also see it in the context of broadening their enterprise strategy generally, fitting in with 3Par and some of the other deals they’ve made just in the course of this year so far. They’re at risk of being put on the sidelines on the enterprise market space by the likes of IBM and EMC. This directly answers both and gives them immediate leadership into the space."
The deal is one of a string of many such SIEM (Security Information and Event Management) M&A plays to go down in the last few years, punctuating a trend of consolidation as bigger security and general IT management vendors such as EMC, IBM, CA and Novell looked to purchase the ability to offer customers a tool to deal with the avalanche of security event information that flows from IT and security infrastructure hour by hour. Following much of this consolidation, ArcSight had remained the undisputed independent leader in the space.
"In the SIEM market, ArcSight was definitely top of that market," says Andrew Jaquith, a security analyst for Forrester Research. "They were one of the earliest movers and they had a strong market presence."