In a deal set to reshape the network security landscape, Cisco today announced its intention to acquire Sourcefire for $2.7 billion. Cisco will pay $76 per share for Sourcefire. The deal is expected to close in the second half of 2013.
Sourcefire is a leading vendor of Intrusion Prevention System (IPS) technology; its founder, Marty Roesh, founded the popular open source SNORT IPS technology. Once the deal closes, Roesh will join Cisco as VP and Chief Architect of Cisco’s security group, reporting to Chris Young, Senior Vice-President for Security at Cisco.
During a conference call with analysts to discuss the deal, Young said that with the acquisition of Sourcefire, Cisco takes a step forward in accelerating its security business. The deal will add to Cisco’s existing security assets and its many acquisitions over the years. Prior to the acquisition of Sourcefire, Cisco’s largest security acquisition had been the 2007 acquisition of Ironport for $830 million.
According to Young, the Cisco/Sourcefire combination will strengthen how organizations can address the entire modern threat continuum, from data center to endpoint.
At the heart of Sourcefire’s success over the years is its open source community. Roesch started the company as a means to grow a commercial service around the open source SNORT IPS. Over the years, the company expanded its commercial technologies with FireAMP, which provides visibility into malware before, during and after an attack.
FireAMP in part leverages the open source ClamAV community, which Sourcefire also leads.
“Sourcefire and Cisco look forward to the continued partnership with the open source community,” Young said.
Roesch strongly echoed the sentiment. During the analyst call, he spoke directly to the open source community.
“You have my and Cisco’s unwavering commitment,” Roesch said. “I’ve said that SNORT is now and always will be free, and we will continue that tradition.”
Cisco and Sourcefire’s current product portfolio now overlap in a number of respects. Young noted that Cisco is now in the IPS business, just like Sourcefire, but he’s confident that the combination of Cisco and Sourcefire goes beyond what the two companies offered individually.
They plan to build a common architecture that will leverage the best capabilities of both sets of platforms.
“We’re the market share leader in firewall today, and what we’re doing is adding capabilities,” Young said. “We’ll leverage that strength with Sourcefire to understand intrusion, malware and threats and deliver it to customers in an integrated way.”
Much of Cisco’s existing IPS business is attached to its ASA firewall appliance business. Young also admitted that some work remains in order to achieve the joint product consolidation.
“We’ve looked at the combined architectural potential and we think it aligns well,” Young said. “Our path to integration that combines the best of best portfolios is very achievable in a near term fashion.”
Sean Michael Kerner is a senior editor at Enterprise Networking Planet and InternetNews.com. Follow him on Twitter @TechJournalist.