IBM's ISS Buy Smacks of Services Play

IBM's scooping up of threat-prevention pioneer Internet Security Systems (ISS) -- for $1.3 billion today -- in an instant establishes Big Blue as one of the most formidable players in the IT security market.

The acquisition, announced jointly by IBM and ISS executives, brings into IBM a stable of intrusion prevention and other security software and appliances, filling major gaps in the Armonk, N.Y.-based giant's portfolio. But perhaps more significantly, ISS gives IBM a platform from which to deliver managed security services, a major area of IT growth as more companies choose to outsource their security needs in the face of escalating costs.

"This is about delivering security in pre-emptive, scalable, cost-effective way," said Valerie Rahmani, general manager of infrastructure management services at IBM. "We want to create the world leader in Net security services."

Rahmani said the ISS acquisition, once gaining regulatory approval, will further IBM's growth ambitions in the security market, and in particular bolsters its managed security services strategy. She cited estimates of a $22 billion of untapped opportunity among customers that are finally reaching a level of comfort with the idea of letting outside experts handle their security and compliance needs.

ISS CEO Tom Noonan echoed those sentiments. "The next generation of security is a model whereby the vast majority [of protection] is delivered as services over an extensible, open platform," he said, adding that ISS' flagship security appliances and software are really just enabling technologies for the services model.The focus on services might explain why ISS will fall under the aegis of IBM Global Services (IGS) and not one of IBM's product groups, namely the Tivoli brand where systems management software and other security products are housed. Rahmani explained that ISS will run as an independent operating entity inside of IGS, with ISS headquarters remaining intact in Atlanta and Noonan staying on to manage the unit. Future development of the ISS products, however, will be done in lockstep with engineering inside of Tivoli to ensure tight integration and compatibility, she said.

Paul Stamp, senior analyst at Forrester Research in Cambridge, Mass., said the ISS acquisition gives IBM the broadest security portfolio in the business and ups the competitive ante with the likes of Computer Associates, Symantec and Cisco. Big Blue has always lacked a "good, old-fashioned" threat-protection offering to complement its extensive identity-, application- and systems-management lineup, Stamp said, but now it is competitive on all fronts.

IBM plans to use ISS' X-Force security intelligence service, which Noonan says proactively protects networks by analyzing in advance online vulnerabilities and other threat conditions.

The deal also underscores IBM's strategy of turning a mlange of hardware, software, managed services and consulting into a set of automated, repeatable services to be sold by partners, IGS itself or IBM, according to Stamp.

"IBM is at forefront of blending product and services and of doing software as a service" he said. "The are also at the forefront in pricing model changes. As this market develops, it will be a powerful at IBM."ISS is just one of a flurry of acquisitions IBM has made this summer, which include most recently asset-management software firm MRO Software and FileNet, which offers a suite of enterprise content management products. Both of these companies will be added to the IBM Software family. Rahmani reiterated today that IBM is always on the hunt to buy companies that fill a particular technology, industry or other need, and that that strategy remains unchanged.

From a partner perspective, Rahmani anticipates IBM's and ISS' respective channels will reap opportunity from the security products and services, although it remains to be seen if the lion's share the business goes through IGS. In one key area, service providers, Rahmani and Noonan said they see tight alignment. In particular, ISS has an offering called Protection on Demand, which allows security services to be turned on and off as needed. This is an SMB play, according to Noonan, and a natural for solution providers that offer managed services.

"This allows small to mid-sized firms to enjoy the value of elite security protection without deployment costs and complexity," Noonan said.

IBM's shares were down 32 cents by mid-afternoon.