WatchGuard Buys CyGlass to Bring NDR to Midmarket Customers

WatchGuard purchased a newly independent Massachusetts company to extend network detection and response capabilities traditionally reserved for high-end enterprises to the midmarket through MSPs.

See Also: OnDemand | Best Strategies for Transferring Sensitive Financial Data

The Seattle-based platform security firm said its purchase of Boston-area CyGlass will give WatchGuard customers more visibility into east-west network traffic as well as activity taking place on the cloud. The WatchGuard deal follows U.K.-based Nominet’s February 2020 purchase of CyGlass and CyGlass’ June 2022 management buyout, which enabled Nominet to return to its internet registry roots (see: CyGlass Separates From Nominet, Pursues XDR Partnerships).

“One thing we do really well … is looking at technologies that really fit with our platform,” WatchGuard CEO Prakash Panjwani told Information Security Media Group. “CyGlass had been on our list for at least two years. The technology always made sense, but what really came together was the fit in how we think about the market. Then it was just about finally reaching the maturity of being able to strike a deal.”

Bringing Enterprise-Grade Capabilities to the Midmarket

CyGlass was founded in 2017 and employs more than 30 workers and contractors. All of CyGlass’ R&D employees will join WatchGuard – including founder and CEO Ed Jackowiak – while some contractors focused on go-to-market work will exit the company. Jackowiak previously led security sales at Oracle, Vordel, Aurionpro and Nutonian – the latter three all acquired – before he joined CyGlass in 2017.

Midmarket organizations and their managed service providers need a network detection and response tool with simple deployment, but Panjwani said a lot of the existing technology on the market still requires a hardware component. WatchGuard will put CyGlass’ technology in the hands of its vast network of MSP and MSSP partners, and it plans to price and package the service in a way that appeals to the midmarket, he said.

“The technology always made sense, but what really came together was the fit.”


– Prakash Panjwani, CEO, WatchGuard

Terms of the acquisition – which closed Tuesday and was announced Wednesday – weren’t disclosed. The company will begin cross-selling CyGlass’ NDR as a stand-alone service to existing customers and will integrate it into WatchGuard’s platform so that endpoint, identity and wireless technologies can be managed from one place. After that, WatchGuard will integrate CyGlass’ network flow data with existing telemetry.

“Every time we acquire, we get more data sets to include in telemetry, and our XDR just improves dramatically,” Panjwani said. “We’re getting the network flow data that they bring, which they already do today as part of the network discovery process that they have. And from there, we’ll be able to add third-party feeds from switches and everywhere else.”

Bringing NDR and Network Firewalls Together

WatchGuard’s heritage in firewalls means the company’s existing customers understand networking well and have been clamoring for the ability to analyze network traffic from different places to look for anomalies. Incumbent network security tools providing visibility into east-west and cloud traffic are expensive and hard to deploy, so Panjwani expects a fairly rapid adoption process from existing clients.

“Many of our partners know network security inside and out, so the use case for NDR is much clearer in their mind,” Panjwani said.

From a metrics standpoint, Panjwani said, WatchGuard will focus on the number of partners cross-selling the CyGlass technology. Between 20% and 25% of WatchGuard partners are currently cross-selling endpoint security technology acquired from Panda in June 2020, and Panjwani hopes to get 20% of WatchGuard partners to CyGlass within 12 months of integration since they understand the space well (see: WatchGuard CEO Prakash Panjwani on Making XDR Easy for MSPs).

“The biggest thing is making NDR accessible to everybody,” Panjwani said. “It’s a technology that’s been out there but just not available to the midmarket. What excites us is that we can truly make it available across a much wider segment than it is available today.”