Cisco’s Splunk deal shows the appeal of AI in cybersecurity

“Cisco is simply responding to market demand by offering this technology stack,” said Mitchell Schneider, senior principal analyst at consultancy Gartner..

Because Cisco doesn’t have significant experience in security operations, it will likely rely on Splunk’s expertise, he said.

Industry observers widely view the acquisition Cisco announced Thursday as a deal rooted in artificial intelligence. Splunk uses various forms of AI in its products, which primarily handle threat detection and management, while Cisco is known for its hardware such as routers and switches, although it also provides software products and services of security.

“This acquisition fills two major gaps for Cisco: data and cybersecurity,” said Rama Sekhar, a partner at venture capital firm Norwest Venture Partners who was an engineer at Cisco early in his career.

“AI is nothing without data, and the Splunk acquisition not only allows Cisco to sell more recurring software, but also takes Cisco out of the plumbing business and out of the data business,” Sekhar said .

In July, Splunk announced that it had integrated generative AI capabilities through a suite of software called Splunk AI, designed to analyze data generated by large networks and help human staff detect potential cyberattacks.

With Cisco’s resources, Splunk can develop more AI capabilities, said Gary Steele, Splunk’s chief executive officer. Combining machine learning tools that detect unusual activity on corporate networks with a generative AI interface can help businesses detect and stop threats faster, Steele said.

“The modern security operations center requires a high degree of automation,” Steele added.

The combined company plans to provide a cybersecurity platform that collects intelligence from many sources, even from competitors, said Chuck Robbins, Cisco’s chief executive.

Splunk’s estimated $4 billion in recurring revenue from product and service subscriptions gives Cisco a greater presence in cybersecurity, Robbins said, as the company continues to shift its focus toward software . “It’s a very good deal financially,” he said.

Yet Splunk hasn’t had a profitable year since its founding in 2003 and reported a net loss of $3.7 billion for fiscal 2023. In February, Splunk announced it would lay off 4% of its workforce, or around 320 of its nearly 8,000 employees. employees.

Mergers and acquisitions can help reduce the number of vendors offering similar services, but market consolidation risks locking security executives into doing business with fewer vendors, said John-Claude Hesketh, chief executive of Marlin Hawk. , a global recruitment company.

To reduce this risk, security chiefs should negotiate the right to revise contracts in the event of acquiring a key vendor, Hesketh said, noting that as the landscape evolves, “customers ask a lot of questions , in particular on the right to terminate contracts”.

As consolidation among cyber vendors continues, companies face a tradeoff between fewer choices and more integrated products and services, said Scott Hawk, chief information security officer at the wireless networking company. Velaspan thread. The Splunk acquisition “is definitely further evidence of consolidation. The same thing happened in telecommunications years ago,” he said.

Splunk customers may face initial challenges in dealing with a larger company, said Roger Thornton, co-founder and general partner at venture capital firm Ballistic Ventures. On the other hand, he said, the acquisition could bring stability to Splunk’s customers, given the company’s financial woes.

Steele and Robbins said their respective large customers were supportive of combining complementary products.

“In the long run, it may have just made the Splunk product line more likely to be around for a long period of time,” Thornton said. A giant company spanning hardware and software security could also prompt competitors to seek acquisitions, he said, to keep pace with their new, larger competitor.

—Catherine Stupp contributed to this article.

Write to James Rundle at james.rundle@wsj.com and Kim S. Nash at kim.nash@wsj.com