Sourcefire To Shell Out $21 Million For Immunet

Network intrusion prevention specialist Sourcefire will pay a total of $21 million--$17 million now and $4 million to be paid over the next 18 months upon achievement of product delivery milestones--for Immunet, a developer of cloud-based anti-malware technologies. The acquisition is expected to extend Sourcefire's malware protection to the cloud and provides the company's first endpoint protection offering, according to company officials.

Immunet said that its cloud computing, collective intelligence, data mining and machine learning capabilities enable it to provide real-time protection--from more than 14 million threats daily--to its more than 750,000 users in 192 countries. With the acquisition, Sourcefire will be able to immediately provide end point protection from client-side attacks and advanced persistent threats (APTs). Sourcefire stated that the cloud-based platform will enable new approaches to reputation services, data loss prevention and forensics.

According to Gartner's "Magic Quadrant for Network Intrusion Prevention Systems" report, released last month, IPS is Sourcefire's primary market, and Sourcefire is well-known for being the commercial manager for the Snort and ClamAV open-source security products. However, the report adds, the company's offerings lacked a Web capability. Gartner expects the 2010 IPS market to have grown 20 percent over 2009, to $1.4 billion, while the appliance-only IPS portion would hit $1.1 billion, up 10 percent year-over-year.

The acquisition comes just a month before the security industry's annual RSA conference. At about the time of the last RSA conference, the two companies had first partnered. It was at RSA 2010 that they announced a free, Windows-based version of the widely used ClamAV antivirus solution. Sourcefire says it leveraged Immunet's cloud-based Collective Immunity technology, linking together a user's network of friends to identify new threats in real-time and providing instant protection across the product's user base.

Last year Sourcefire also rolled out its Next-Generation Intrusion Prevention System (NGIPS), Next-Generation Firewall (NGFW) and Razorback, an open-source framework designed to deliver deep inspection capabilities for combating complex threats.Immunet has only recently started to convert its customer base to a paid subscription model, so one of the first opportunities the acquisition will open up will be an acceleration of that initiative, says Sourcefire. The other immediate opportunity is to start selling Immunet's endpoint protection to Sourcefire's enterprise customers.

One of the problems of endpoint protection, and Immunet's competition, is that the majority of threats, 75 percent, threaten only one person. Trying to track down all of these instances soaks up resources, whereas Immunet's community-based automation approach provides faster, less resource-intensive capabilities, according to the company. It can cull the single threats and focus on the others.

Immunet employees will join Sourcefire within the Office of the CTO. Sourcefire plans minimal disruption, bringing all full-time personnel--including Immunet founders Oliver Friedrichs, Alfred Huger and Adam O'Donnell--on board and keeping open the company's existing facilities in Palo Alto, Calif., and Calgary, Canada.