Antivirus software company McAfee Inc. is buying Foundstone Inc., which makes software for detecting and managing software vulnerabilities, for US$86 million in cash, McAfee said Monday.
The acquisition will add Foundstone’s line of vulnerability management software to McAfee’s growing list of security products. McAfee plans to combine Foundstone’s technology for spotting and remediating software vulnerabilities with its intrusion detection and security policy management products, allowing companies to identify and shield high-priority computer assets from attack.
As part of the deal, Foundstone’s professional services group will become part of McAfee’s services team, McAfee said.
McAfee’s purchase of Foundstone, based in Mission Viejo, California, follows moves in the last year to focus its product offerings and bolster its standing in the intrusion detection and prevention market. In April 2003, McAfee, formerly Network Associates Inc., paid US$220 million to purchase two companies: IntruVert Networks Inc. and Entercept Security Technologies Inc., both of San Jose.
The acquisitions gave McAfee, of Santa Clara, Calif., a jump start in detecting both network-based attacks, IntruVert’s specialty, and attacks targeted at network servers, or “hosts.”
McAfee in recent months has also shed products and business units. In December 2003, the company announced the sale of its Magic help desk and management software division to BMC Software Inc., an enterprise management products maker, for US$47 million. In April, the company said it was selling its Sniffer family of network management products for US$275 million in cash to an investment group including Silver Lake Partners and Texas Pacific Group, which relaunched the product under the auspices of a reconstituted Network General Corp.
McAfee will focus initially on getting Foundstone’s technology to recognize and interact with the IntruVert and Entercept technologies, as well as McAfee’s VirusScan 8, said Vince Rossi, senior vice-president of product management at McAfee.
The goal is to give customers the ability to assess their exposure to Internet and network-borne threats using a constantly updated threat profile provided by McAfee’s other products. With detailed information on which of their computer assets are the most exposed to threats, IT departments can focus their efforts on dealing with the biggest threats to their most critical assets, saving time and effort, he said.
“Entercept and (IntruVert’s) IntruShield are primarily focused on delivering proactive risk mitigation, but there’s little guidance to customers on how to best use those technologies given their business environment,” Rossi said. “Foundstone provides us with a front end that allows customers, in an automated way, to discover their environment and prioritize their resources based on business risk and on threats.”
The purchase of privately held Foundstone, which began in 1999 as a security consulting services company and more recently began marketing and selling security software and hardware, will complement McAfee’s investment network and host intrusion prevention technologies, said John Pescatore of Gartner Inc.
“Now that you have host and network intrusion detection, companies need to know where they’re vulnerable, so vulnerability management becomes important,” he said.
Foundstone also gives McAfee access to Foundstone’s marquis vulnerability management customers, many of them large enterprises, and boosts McAfee’s otherwise unremarkable professional services group, Pescatore said.
Foundstone’s head of professional services will lead McAfee’s professional services group after the acquisition is complete. The company’s security consultants will also be allowed to continue working in a “boutique” fashion within McAfee’s professional services group, Rossi said.
McAfee has promised Foundstone that the company’s security experts will not be pressured to recommend only McAfee technology, said Rossi and George Kurtz, chief executive officer of Foundstone.
McAfee said it expects its acquisition of Foundstone to be complete in the next 60 days and that it will update its financial guidance for the fourth quarter 2004, and for fiscal year 2005 to account for the Foundstone purchase.
