IBM To Acquire Resilient Systems Undercut Cisco Symantec FireEye

Tech giant IBM (IBM) plans to undercut Cisco Systems (CSCO), Symantec (SYMC), FireEye (FEYE) and Rapid7 (RPD) by acquiring incident response firm Resilient Systems and partnering with endpoint security provider Carbon Black, the company announced Monday.

The announcement comes a week after IBM unveiled a deeper tie to No. 1 cybersecurity pure-play Check Point Software Technology (CHKP) to pool research and integrate systems. IBM stock slipped 0.8% to close at 131.03 on the stock market today.

IBD’s 25-company Computer Software-Security industry group was down a fraction Monday as companies headed to the RSA Conference, a massive cybersecurity industry gathering that runs all week in San Francisco.

Caleb Barlow, vice president of IBM Security, described the Resilient Systems acquisition as the cornerstone of a three-prong strategy to protect, defend and respond to cyberbreaches. Per IBM policy, he wouldn’t disclose the price tag for the privately held, 100-employee company.


“This ultimately gives us the ability to expand from protecting and defending the enterprise to also being able to respond to a breach,” Barlow told IBD. “This combination of a new acquisition and the associated partnerships really make a move into the incident-response space.”

Carbon Black Has Big Share Of Endpoint Security

In conjunction with the acquisition, IBM will partner with endpoint security firm Carbon Black. Privately held Carbon Black owns 37% of the endpoint market, according to industry tracker IDC. Carbon Black’s platform will allow IBM analysts to conduct security forensics on compromised endpoint devices.

Resilient Systems will be integrated into IBM’s incident-response platform, dubbed X-Force Incident Response Services. Via X-Force, IBM will counsel clients through all parts of a cyberbreach and on ways to avoid such breaches.

Barlow likened the service to a fire drill.

“Most companies don’t have good incident-response plans,” he said. “There’s a binder on the shelf for what to do in the case of a fire or what to do in the case of a flood, but not necessarily what to do in the case of a cyber incident.”

That “binder” includes pertinent leadership, disclosure and public relations keys in case of a breach, he said. IBM’s move allows the company to “pivot” from protecting and defending to responding to a breach, he says. It’s all part of IBM’s push into the cybersecurity market.

In 2015, IBM pulled in $2 billion in security revenue. That was up 12% but still accounted for only 2.4% of IBM’s total revenue of more than $81 billion, which fell 12%. But the dollar amount topped total sales for security pure-players Palo Alto Networks (PANW), Proofpoint (PFPT), Fortinet (FTNT) and FireEye. And IBM’s security business also outgrew Symantec and Check Point.

The security unit was launched four years ago, Barlow says. Since then, it has added 7,300 employees — 1,000 last year alone — and operates in 133 countries globally.

“Imagine if that were the conversation about a Silicon Valley startup,” he said.

IBM gets a not-strong IBD Composite Rating of 53 out of a possible 99. Shares are down 5% year to date, like the S&P 500 index.