XDR provider Arctic Wolf buys BlackBerry’s Cylance suite – Source: www.csoonline.com

US provider Arctic Wolf has struck a deal to buy BlackBerry’s Cylance endpoint security suite, which it will integrate into its Aurora extended detection and response (XDR) platform.

Arctic Wolf said Monday morning that if the deal is approved by regulators, the company will be able to offer one of the largest open XDR security platforms in the industry, enabling customers and partners to have the option to leverage more than 15 supported endpoint solutions.

BlackBerry will continue to offer other enterprise cybersecurity products, including Unified Endpoint Management (UEM) for securing devices; AtHoc, for critical event management; and SecuSUITE, for secure messaging and phone calls.

In October, BlackBerry essentially said that Cylance was on the auction block when CEO John Giamatteo told investors during a briefing, “We don’t believe ongoing investment [in Cylance] at the current levels is sustainable and unlikely to generate acceptable return on capital.”

“All the options [are] on the table,” he added.

In a statement, Arctic Wolf said that, under the terms of the agreement, it will give BlackBerry a total of US$160 million in cash, subject to certain adjustments, and approximately 5.5 million common shares of Arctic Wolf. After allowing for the purchase price adjustments, BlackBerry will receive approximately US$80 million in cash at closing of the deal, expected in late February, and approximately US$40 million in cash one year later.

A win-win, says BlackBerry

“Security has an operations and effectiveness problem and endpoint solutions alone have failed to live up to the outcomes they have promised for years,” Arctic Wolf CEO Nick Schneider, said in a statement. “By incorporating Cylance’s endpoint security capabilities into our open-XDR Aurora platform, we will be addressing a rampant need for a truly unified, effective security operation that delivers better outcomes for customers. We believe we will be able to rapidly eliminate alert fatigue, reduce total risk exposure, and help customers unlock further value with our warranty and insurability programs.”

BlackBerry CEO John Giamatteo said he sees the deal “as a win-win for our shareholders and all other stakeholders. Our customers will realize the benefits of continuity of service and the expertise that a global cybersecurity leader like Arctic Wolf provides. Arctic Wolf benefits by adding Cylance’s endpoint security solutions to its native platform. Finally, as Arctic Wolf leverages its scale to build upon and grow the Cylance business, BlackBerry will benefit as a reseller of the portfolio to our large government customers and as a shareholder of the company.”

 In a late afternoon business update call on Monday, Giamatteo said that the deal will also “resolve the majority” of financial losses Cylance has been piling up since the company bought it in 2019. During its October update, BlackBerry indicated that would lose US$51 million this year.

The deal allows the company to focus on its QNX products and its portfolio of secure communications products, he said. Those three products are profitable “for the time being,” he added. However, if there are opportunities to increase shareholder value, BlackBerry will look at selling them, he said.

Cylance a ‘perfect fit’

As an Arctic Wolf reseller, BlackBerry will continue to offer the former Cylance XDR solution in bundles with UEM, AtHoc or SecuSuite, Dan Schiappa, Arctic Wolf’s chief product officer said in an interview, though ultimately the Cylance name will disappear. Pricing of the Arctic Wolf bundles has not yet been announced.

He said CISOs who are currently Cylance customers should note that the XDR suite “will be part of a company that’s investing significantly and does nothing but cybersecurity … They’re going to get the benefit of being part of that ecosystem and the opportunity to expand beyond the Cylance portfolio and into the Arctic Wolf portfolio and the services we can offer them.”

Arctic Wolf won’t push customers into adopting its new EDR service, he added. They can continue using their existing EDR product.

Schiappa said his company has been looking to add an EDR solution for some time. Cylance is “the perfect fit” for a number of reasons: Both Arctic Wolf and BlackBerry have similar technology on their infrastructures, he said, making it easier to merge the platforms; BlackBerry already offerings a managed EDR service to go with Arctic Wolf’s managed service.

The companies also have several locations in common — Arctic Wolf’s research and development office is in Waterloo, Ontario, where BlackBerry is headquartered; both companies have offices in India; and BlackBerry has a SOC in Ireland, where Arctic Wolf has been looking for a site.

‘What a writedown’

“What a writedown by BlackBerry!” commented Rik Turner,  a senior principal analyst on Omdia’s IT security and technology team, noting BlackBerry paid about US$1.4 billion in 2019, and now has to take US$160 million plus Arctic Wolf shares.

The acquisition was seen at the time as BlackBerry making a major move into security, he said.

He suspects the sale shows that endpoint security is moving increasingly towards managed services, which may be a route BlackBerry decided it didn’t want to go down, while Arctic Wolf is fully invested in that business.

Could be a bumpy ride

The addition of Cylance’s endpoint solution to Arctic Wolf makes sense, said Felix Jean-Louis, principal cybersecurity advisor at Info-Tech Research Group, because both companies are well-known as top-tier security service providers, although some aspects of the deal make it a merger rather than an acquisition.

In the short term, he added, “it could be a bumpy ride.” During the transition period, he said, there are a few potential operational impacts that businesses and CISOs should consider:

• Integration challenges: Merging two different technologies and teams can be complex and may lead to temporary disruptions or inefficiencies during the transition period;
• Vendor lock-in: Relying heavily on a single vendor for comprehensive security solutions can create dependency, making it difficult to switch providers if needed;
• Transition questions: If I am an existing Cylance client, how will the change impact my current contract?  Will Cylance continue to provide support during and after the transition, or will I have to transfer to Arctic Wolf?  Is there a cost increase?  If I am an Arctic Wolf customer, I will have similar questions, in addition to: how will the introduction of Cylance’s endpoint module impact my operation?