Big Overlap With Symantec Makes Carbon Black Redundant, Though Buyers May Be Sparse
It looks as if Carbon Black’s days as part of Broadcom are numbered.
See Also: Fog of War | How the Ukraine Conflict Transformed the Cyber Threat Landscape
Broadcom CEO Hock Tan told staff at newly acquired VMware in both an email and town hall meeting that he plans to “review strategic alternatives” for both Carbon Black and VMware’s end-user computing practice, according to Business Insider. The potential unloading of Carbon Black comes just four years after VMware’s $2.1 billion acquisition of the Boston-area endpoint detection and response firm (see: How Broadcom Acquiring VMware Would Shake Up Cybersecurity).
The first indication of Carbon Black’s separation came Monday, when Vice President and General Manager Jason Rolleston said Carbon Black is now an autonomous business unit within Broadcom rather than part of VMware’s security practice. Just a day later, CRN reported that Broadcom had told VMware channel partners to immediately stop bundling sales of VMware products with those belonging to Carbon Black.
Carbon Black’s endpoint security, cloud workload protection and container security capabilities overlap significantly with Broadcom’s Symantec security unit, which focuses on endpoint, network, information and identity security. Broadcom, which purchased Symantec’s Enterprise Security business for $10.7 billion in November 2019, didn’t respond to Information Security Media Group requests for comment (see: Proofpoint Snags Former VMware President Sumit Dhawan as CEO).
Broadcom has a track record of selling off security assets inherited as part of broader acquisitions that it has no interest in running itself. Two months after buying CA Technologies, Broadcom in January 2019 sold its Veracode application security testing assets to Thoma Bravo for $950 million. The private equity firm in May 2022 sold a majority stake in Veracode to TA Associates at a valuation of $2.5 billion.
Five months after buying Symantec, Broadcom sold the company’s 300-person Cyber Security Services business to Accenture for a reported $200 million to help firms anticipate, detect and respond to threats. A month later, Broadcom sold most of Symantec’s enterprise consulting team to HCL Technologies to gain expertise around endpoint security, web security services, cloud security and data loss prevention.
How Carbon Black Stacks Up to Symantec
Both Carbon Black and Symantec have a material presence in the $13.1 billion endpoint security market. Symantec ranked seventh in market share, with $450 million of sales in 2022, and Carbon Black ranked eighth, with $419 million of revenue, IDC found. Carbon Black’s device security practice is larger, raking in $390 million of revenue last year compared to $289.5 million for Symantec.
Symantec’s physical server and cloud workload security business is much larger, generating $160.5 million of revenue last year compared to just $29 million for Carbon Black. But Carbon Black’s endpoint security unit is healthier, recording 6% sales growth in 2022, while Symantec’s sales declined by 3.2%. But both companies have lost market share since the total endpoint security market grew by 29.2%.
Carbon Black and Symantec both were named as visionaries by Gartner in this year’s Endpoint Security Magic Quadrant, while Forrester named Symantec a strong performer and Carbon Black a contender in this year’s Endpoint Security Wave. Gartner praised Carbon Black for recent integrations with ServiceNow and Proofpoint but criticized the company for introducing new functionality at a slow pace.
Forrester lauded Carbon Black for sturdy prevention and runtime protection engines as well as a deep application control tool that stops sophisticated attacks from getting started. But Forrester chided Carbon Black for missing core features such as data security, relying on external management for mobile device security, requiring a lot of tuning to reduce false positives, and mixed customer support.
Longtime Carbon Black CEO Patrick Morley led VMware’s security business unit following the October 2019 acquisition until he departed the company in December 2021. Rolleston joined Carbon Black in August 2021 to spearhead product strategy and execution and became general manager for the whole business in December 2022. VMware’s security unit has been led since December by Umesh Mahajan.
Where Carbon Black Could End Up
Who might end up kicking the tires on Carbon Black is anyone’s guess. The endpoint security market is undergoing rapid consolidation, as market leaders Microsoft and CrowdStrike have gained significant share alongside challengers SentinelOne and Palo Alto Networks. The other 16 companies with at least 1% share in the endpoint security space – including both Carbon Black and Symantec – are all losing ground.
Given Microsoft and CrowdStrike’s growing dominance in endpoint security, Carbon Black might be less appealing to a strategic buyer, particularly one focused solely on cybersecurity. A technology aggregator with experience obtaining cost synergies from acquisitions such as Fortra or OpenText could pursue a deal, or a manufacturer such as Airbus or Thales wanting to offer more robust device security could take a look.
The most likely buyer of Carbon Black, though, would be a financial buyer, specifically a private equity firm. Carbon Black has languished in recent years as a small piece of a much larger technology company – VMware, and a financial buyer could turn a tidy profit by cutting noncore functions, making tuck-in acquisitions in fast-growing security areas, and pursuing an exit via IPO or sale within three to five years.
VMware made a handful of smaller security acquisitions following Carbon Black, scooping up Kubernetes security startup Octarine in March 2020 to enable cloud-native environments to be intrinsically secure and Mesh7 in March 2021 to fortify VMware’s Kubernetes, microservices and cloud-native muscle. It’s unclear whether those assets would be spun out as part of Carbon Black or remain with VMware.
For Carbon Black employees, partners and customers, the wait continues.