Symantec Seals $350M Acquisition of Vontu

Most everyone in the IT security industry knew that Symantec was serious about buying data loss prevention vendor Vontu. Now they know just how serious it was. (See Symantec to Announce Purchase of DLP Vendor Vontu and Symantec to Acquire Vontu.)

Symantec last night pulled the trigger on the Vontu deal, announcing that it will pay $350 million in cash and options for the upstart, which is widely regarded as the first and best-known DLP specialist.

In making the announcement, top executives at Symantec and Vontu threw down the gauntlet to other "enterprise security" vendors.

"We're the only vendor now that covers all three layers of vulnerability," said Steve Roop, vice president of products and marketing at Vontu, in a press conference following the announcement. "If you're going to secure the enterprise, you've got to secure the end points, the network, and inside storage. If you don't cover all three, your customers are still at risk of a breach."

Rich Mogull, founder of consulting firm Securosis LLC, agrees that Symantec's acquisition of Vontu is "way smarter" than Trend Micro's acquisition of DLP provider Provilla a week ago or McAfee's purchase of SafeBoot last month. Both of those acquisitions focus primarily on end point security, he notes.

But Mogull also wonders how well Vontu will fare under Symantec management. The DLP vendor will operate as an "autonomous unit," according to Symantec CTO Ken Schneider, but observers say the company's history suggests that such autonomy is short-lived following an acquisition by Symantec.

"I'm not convinced Symantec will be able to maintain Vontu's value," Mogull says. "Symantec has a wretched history of acquisitions, and DLP is well outside its normal security vision. It will take serious commitment on Symantec's part to maintain a leadership position [in DLP]."

Several observers also questioned the high price that Symantec paid for Vontu. John Katsaros, a principal at Internet Research Group, has estimated that 2007 revenues for privately held Vontu would be "closer to $25 million than $50 million," and Mogull estimates that 2007 revenues for the entire DLP market won't be higher than $180 million -- and that includes companies that sell DLP functionality as part of a larger product line.

"The [DLP] infrastructure sector makes you scratch your head and wonder how this whole thing plays out in the long run," Katsaros says in his blog.

But Symantec and Vontu executives say DLP will play a key role in future security and compliance efforts, not only preventing employees from breaching policy, but also providing a platform for e-discovery and management of sensitive information.

"If you're going to focus on security from an information-centric view, you need to know where your sensitive information is, take policy action to secure it, and protect it from loss," said Schneider. "The combination of Symantec's and Vontu's solutions will help to make that possible."

The acquisition is currently in legal and regulatory review and is expected to be complete in about a month, the companies said.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.