Cisco Buys IPS Specialist Sourcefire for $2.7 Billion

Cisco this morning announced it was acquiring IPS/IDS vendor Sourcefire for $2.7 billion. Cisco will pay $76 per share for the publicly traded company. Cisco also announced that Sourcefire founder and CTO Martin Roesch will serve as VP and chief architect of Cisco's security group. Sourcefire has approximately 2,500 customers worldwide, including numerous customers in the U.S. government and military.

Cisco was attracted to Sourcefire in part because of Snort, said Christopher Young, senior VP of Cisco's Security Group, during a call with analysts this morning. Snort is the open source IDS engine created by Roesch before he founded Sourcefire. Sourcefire is built in part with code and IDS/IPS rules from Snort. On the analyst call, Roesch spoke directly to Snort developers to pledge both his and Cisco's "unwavering commitment" to the community. He promised Snort would always be free.

Cisco Systems has been making efforts of late to reach out to open source developers. Prior to the Sourcefire acquisition, Cisco announced its participation in OpenDaylight, a project to build an open source controller for software-defined networks. Cisco has contributed code to OpenDaylight from its ONE Controller software.

Aside from the open source angle, Young said Cisco recognized the "synergy" between Cisco's and Sourcefire's view of the role the network should play in a security strategy, both as a resource to defend as an information source that can be used to detect and respond to threats. Young also emphasized FireAMP, Sourcefire's file analysis software for malware detection.

Young acknowledged that Cisco and Sourcefire have competing security products, but he declined to provide specifics on how the two companies will integrate Sourcefire into Cisco's portfolio, and would not comment on whether Cisco would discontinue certain product lines in favor of Sourcefire.

Cisco said it expects the acquisition to close in the second half of 2013.