Why Cisco Bought Splunk

In a deal that has been rumored and discussed since early 2022, Cisco (Nasdaq: CSCO) announced this morning that it will acquire data management and analytics company Splunk (Nasdaq: SPLK) in a $28 billion deal aimed at strengthening Cisco’s position in security, observability, and artificial intelligence (AI), including generative AI.

Cisco will pay $157 per share in cash and debt to acquire Splunk. That is a 30% premium over Splunk's closing share price of $119 on Wednesday, cheering Splunk investors. Splunk's shares rose 20% today to close the gap with the announced premium, trading up $25.36 (21%) to $144. Cisco's investors were not as happy, as Cisco's shares plunged 3.7% in early trading, losing $2.06 to $53.44.

The deal is expected to close in the third calendar quarter of 2024. Executives said it will add to Cisco's cash flow and gross margin by the end of the first year after the deal’s closing. It is expected to add to non-GAAP earnings per share (EPS) in the second year. According to Cisco CEO Chuck Robbins, Splunk will add $4 billion to Cisco’s annual recurring revenue (ARR) on closing.

It's All About ARR - and Security

From a financial perspective, the deal makes a lot of sense and Robbins has shown discipline in waiting to get Splunk. When the deal was first discussed two years ago, Splunk’s market price was a few billion more. The company’s stock price peaked at around $220 per share in 2020. With the current deal price at $28 billion, that's a little better. When the Wall Street Journal first reported the talks, Cisco didn't get the deal. Probably because Splunk was in a better position with a higher share price.

The ARR component is probably the strongest part of the deal, as Robbins and Cisco’s executive team has been stressing the company’s strategic mission to add to ARR. Splunk has a large number of companies under contract to buy its data services as ARR, and this will boost Cisco to more than $30 billion in ARR. It’s a big step in reducing Cisco’s identity as a hardware company and pivoting it to a software company.

Another interesting part of the deal is how Splunk can be leveraged in Cisco’s sprawling security portfolio, which includes heavily data dependent areas such as Extended Detection and Response (EDR) and intrusion detection and response systems (IDRS). Many security operations professionals use Splunk’s security information and event management (SIEM) systems to underpin security operations.

Executives on a conference call this morning touted the opportunity to build on Cisco’s EDR platform with Splunk’s SIEM. And of course -- AI.

“Our combined capabilities will drive the next generation of AI-enabled security and observability," said Robbins in a statement.

Gary Steele, CEO of Splunk, who will join Cisco’s executive leadership team and report to Robbins, added: “Together, we will form a global security and observability leader that harnesses the power of data and AI to deliver excellent customer outcomes and transform the industry.”

The deal was anticipated as early as last year, but reportedly talks fell apart at that time.

SIEM Questions Loom

The increased cash flow will be nice, but Splunk will also present strategic issues for Cisco on the integration front. Cisco customers regularly grouse about being nickel-and-dimed by additional licensing costs layered on to Cisco products, and Splunk’s SIEM is seen by many cybersecurity professionals as expensive – which could further enhance Cisco’s reputation for maximizing revenue by increasing costs for customers.

The SIEM market is also complex, evolving, and presents risks. Splunk is no longer seen as the leader it once was. Startup players such as Exabeam are attacking the SIEM market with more modern solutions, and customers are also looking at cobbling together more economical open-source solutions to manage data. SIEM systems function by logging, managing, and analyzing huge amounts of data, and the thinking among some cybersecurity professionals is that it is an aging approach that demands new thinking, using modern cloud-native databases and/or even open source solutions to reduce the cost of managing huge SIEM installations.

For example, a recent RSA Survey indicates that security teams feel overwhelmed by SIEM systems and don’t feel like they are sufficiently automated. In addition, data from the survey indicated that integrating new data sources into existing SIEMs is seen as difficult. Only 19.74% of teams were very confident their SIEM could detect unknown threats and 37.34% were somewhat confident.

Critics of the deal emerged on this morning’s conference call. Oppenheimer managing director and senior analyst Ittai Kidron pushed back on the deal, asking if Splunk's approach is antiquated.

“Splunk’s transition to the cloud has been somewhat underwhelming and many customers view its technology as legacy technology that’s been forced and pivoted into a cloud solution," said Kidron. "I’m kind of wondering if clearly the acquisition is not a limitation for you. Why not go after more modern architectures that can drive probably a longer-lasting impact on your model? Why go for companies that have still a significant size of their base on premise rather than in the cloud?”

Cisco executives pushed back on the overlap. CEO Robbins was adamant: "I think when you talk to our customers today and you look at their security operations centers and the dependency that they have on Splunk's technology and the positive comments that I've heard from our customers, particularly over the last eighteen months with the progress that's been made, and you couple that with the diligence we did with Gary's technical team and looked at the progress they're making on the cloud transition and I think more specifically many customers have actually asked them to make sure they maintain an on-prem and a cloud version."

Executives from both Cisco and Splunk hope there will be clear sailing on the regulatory front. China doesn’t need to approve this deal.

One camp will certainly be happy: Splunk shareholders. The deal prices offers a 20% premium over Splunk’s shares on Wednesday.

As Splunk CEO Steele said, “This is a great outcome for shareholders.”

Futuriom Take: This is a smart deal from a short-term financial perspective, but in the long term Cisco is going to have challenges maintaining control in the SIEM market.