Pros And Cons Of HP's ArcSight Acquisition

Having just outbid Dell for 3Par by more than doubling the initial agreed-upon price--$2.4 billion versus $1.15 billion--HP is back at it, offering $1.5 billion for ArcSight Inc. According to analysts, HP paid a very stiff premium to outbid Dell, more than 14.9x 3Par's book value, 342.3x its cash flow and 10.1x its sales. Based on ArcSight's latest financial results, HP is again paying top dollar to expand its security portfolio. Its fiscal first quarter ended July 31, 2010, and ArcSight reported non-GAAP operating income of $8.5 million on total revenues of $48.1 million.

According to HP, the upside of buying the cybersecurity and compliance vendor is huge. During the analysts' conference call to discuss this morning's deal, HP's Bill Veghte, executive vice president, software and solutions, said the security market is growing in double digits and that ArcSight's product set is a good fit with HP's security and operations portfolios. Even better, the security company has only penetrated 29 percent of the Fortune 100 and 12 percent of the Fortune 1000 markets where HP has a strong position and a 'world-class' sales force, he added.

Analyst Rob Enderle, Enderle Group, agrees that the potential upside is significant. Large organizations face a daunting task of assuring their sites are secure and well managed. Particularly in banking, healthcare and government, the requirements for a high level of control and demonstrable security are extremely high. However, ArcSight's size was working against them, he says. "Companies in this range like to work with other multi-national and large corporations, and ArcSight was relatively small, making it unable to address, without partners, the market opportunity in front of them."

Together, the increased sales potential is significant. "ArcSight will provide both a stronger lock for existing HP accounts and a big foot in the door for accounts that currently don't rely on HP broadly."

The acquisition is a good fit, states Greg Shipley. CTO of Neohapsis, a risk management and security consultancy, given HP's background in network management, the nearing of the traditional Network Operations Center (NOC) with the Security Operations Center (SOC) in many firms, and HP's desire to broaden its reach. "I also think the acquisition is good validation for the SIEM (Security Information and Event Management) market in general. However, it will be interesting to see how HP handles ArcSight, as we have all experienced acquisitions that have resulted in product stagnation."Shipley notes that two previous SIEM deals, Cisco buying Protego in 2004, and Symantec's acquisition of Mountain Wave in 2002, didn't pan out. "ArcSight is, of course, a much more mature company than Mountain Wave or Protego, but it will take some time before we can judge whether or not the HP umbrella is a good one for ArcSight and its customers."

Another element to bear in mind, adds Enderle, is ArcSight's reliance on Oracle technology. If HP's war with the database giant continues, HP will have to repoint this to Microsoft or SAP/Sybase. "This could be an opportunity for one or both of those companies."

Finally, Enderle thinks this rush of acquisitions in the post-Mark-Hurd era could just be the beginning. He says Hurd didn't like acquisitions, which "dramatically limited" HP's ability to buy valuable properties during a time when many of these properties are undervalued. "HP now has nearly five years of analysis of properties they have vetted but couldn't buy. I'd anticipate a number of additional purchases in the coming months as a result as they blow through this backlog."