BlackBerry Cylance customers should ‘explore options’ now that its immediate future is vague: Expert – Source: www.csoonline.com

At last month’s SecTor cybersecurity conference in Toronto, BlackBerry’s booth highlighted its Cylance endpoint detection and response (EDR) product, featuring the new Cylance-based managed EDR service it launched earlier in the year.

However, a week before the show, BlackBerry executives told analysts at an investor day that the future of Cylance is up in the air.

Selling Cylance — which BlackBerry acquired in 2018 for US$1.4 billion — is an option, CEO John Giamatteo made clear.

“Cylance still requires significant investment to drive growth,” he said. In fact, he said, Cylance has sopped up most of BlackBerry’s recent capital spending as it brought the original endpoint malware detection product up to an EDR solution and created the MDR offering. That spending made the company’s cybersecurity division – which also includes BlackBerry UEM (unified endpoint management), AtHoc (for critical event management) and Secusmart (for secure mobile communications) – operate only “about break-even” this year.

“We don’t believe ongoing investment [in Cylance] at the current levels is sustainable and unlikely to generate acceptable return on capital,” Giamatteo said.

As for the future, “all the options [are] on the table,” he added.

What does that mean for CISOs and infosec leaders who have invested in Cylance, or are considering buying either the endpoint or MDR solution?

“Long term prospects for the [Cylance] offering are unclear,” IT consulting firm Omdia warned its customers in the wake of the executive’s statements. Omdia analyst Fernando Montenegro, who attended that October 16 presentation, said CISOs looking for solutions may still find use cases for BlackBerry UEM, Ad Hoc, and Secusmart, “but the case for Cylance has become a lot more narrow. If your organization uses Cylance now, it’s definitely worth a conversation with your account team to understand how their stated direction affects your organization’s usage.”

Fritz Jean-Louis, principal cybersecurity advisor at Info-Tech Research Group and a former CISO, was blunter: “Luck favours the prepared,” he said. “It’s time to start engaging with other vendors to explore options.”

When BlackBerry was asked for comment, a spokesperson said, “We continue to support and service our Cylance customers as we always have.”

Asked if CISOs should be worried about the vagueness of the plans for Cylance, Montenegro replied “I’m not sure ‘worried’ is the right term, but it’s definitely something to discuss, particularly if you are considering whether or not to adopt managed services.”

Montenegro gives BlackBerry credit for aiming Cylance at the mid-market customers through the MDR solution. “If they can execute on that MDR strategy, all the AI stuff they can do may be able to give them [BlackBerry] something,” he told CSO Online this week. “But they are choosing to [mainly] compete on MDR,” he noted, “and not directly on endpoint stuff.”

Taking a step back

It’s not that BlackBerry has said it will stop spending on Cylance. But within the cybersecurity portfolio, executives noted that AtHoc is the growth driver, and there are “ample” market growth opportunities with it, UEM, and Secusmart.

“After all that investment [in Cylance],” Giamatteo said, “maybe now is the time to take a step back and say, ‘I think we can find the right balance of the continued right level of investment to be competitive and keep our innovation going, but at the same time meet the financial health of the company.’”

Where would the shift in capital spending go? Into BlackBerry’s expanding IoT division and its QNX operating system for embedded systems, including vehicles.

Asked if CISOs have tuned out financially struggling BlackBerry for cybersecurity products, Montenegro replied, “most of the conversation on cybersecurity has pretty much shifted elsewhere. At Omdia we’re looking at three main areas for 2025: security platforms, AI and risk. Despite having the heritage of Cylance, I think they [BlackBerry] are not as involved in the conversation [by CISOs] on the AI side. They are not as involved on the platform side as well.” He added that BlackBerry, over time, “has certainly fallen from, ‘They are the first person we think of in that scenario.’ Does this mean they are done [on the cybersecurity front]? Absolutely not. But they must execute on a different play with MDR that they are building up.”

Questions for CISOs

In an email, Jean-Louis said the potential divestiture of Cylance from Blackberry may introduce concerns for CISOs currently using the software in their organizations. 

These include:

• how a transition period would impact support. “During a transition, focus can be divided, and operational support could be impacted, resulting in servicing delays that are critical to timely incident response,” he said.
• how would future and existing operational features be impacted? During a transition, Blackberry may slow down research and development, resulting in new feature releases being delayed or even cancelled.  How will those decisions impact tool capabilities and performance?
• identifying new security tools and capabilities is time-consuming, both tactically and strategically difficult, and requires months of effort to drive informed decision-making.
• what happens if my organization leverages other Blackberry cybersecurity services linked to Cylance? How will that impact associated services?

Sale is just one option

Giamatteo and CFO Tim Foote emphasized that over the past year they have pruned US$135 million in expenses, hoping to bring the company to cash-flow positive by the end of the current fiscal year.

However, at the end of the investor day executive presentations, technology and financial analysts jumped on the vague statements about Cylance. Referring to his CFO’s statements, Giamatteo said selling the product is one alternative. Foote talked of exploring options for saving more money, Giamatteo said, and selling Cylance could be one.