In March 2024, Cisco Systems, a California-based software and networking equipment company, acquired US-based big data analytics firm Splunk for US$28 billion. The acquisition marks a significant step in Cisco’s growth strategy to expand its presence in the tech industry and gain a strong foothold in the data analytics, observability, AI, and cybersecurity market. As enterprises move towards using a hybrid approach for complex IT solutions, the old ways of using separate tools are slowly becoming redundant. Cisco’s acquisition of Splunk brings a convergence of networking, security, and observability to running and protecting enterprise IT systems.

Enterprises are shifting to software-centric and subscription-based services

Cisco, known for its hardware networking products, has begun to move into high-growth areas of software and subscription-based services. Cisco wants to reduce its dependence on one-time hardware sales as growth and margins in this segment have declined compared to software services in recent years.

Pivoting to a software and subscription model marks a shift to a different way of operating and engaging with customers. The subscription model offers great advantages in terms of recurring revenue, customer retention, and scalability. Cisco’s acquisition of Splunk is a move to accelerate this transition by combining the strengths of both entities. Further, with this model, Cisco strengthens its position in the data management technology space, which demands scalable, flexible, and advanced cloud-based solutions.

The acquisition consolidates Cisco’s position in the software observability market

Many organizations face challenges in their digital transformation journey and are turning to cloud-enabled enterprise data platforms. Though these platforms offer scalability and flexibility in various cloud environments, the lack of end-to-end visibility may lead to new issues and higher costs. Enterprises increasingly use observability solutions that monitor and analyze the state of the whole IT system, providing better visibility and performance.

Cisco’s acquisition of Splunk will strengthen its position in the observability market. Cisco will likely combine its existing tools with Splunk’s advanced analytics to enhance its offerings. This will create a robust integrated observability platform and potentially consolidate Cisco’s market presence against competitors. This merger makes Cisco one of the top players in the observability market and sets the stage for further innovation and competitive dynamics in the industry.

Acquisition impact on the observability market

The acquisition may push competitors to develop full-stack observability solutions

With Splunk’s acquisition, Cisco provides an end-to-end observability solution and integrated security enabling advanced threat detection and response features within the same tool. As observability and security markets start to converge, Cisco has a strong position to capitalize on the growing security-driven observability trend. This might encourage other vendors to integrate both observability and security features into their platforms to remain competitive in the evolving complex IT market.

As Cisco deeply roots itself in the enterprise networking and cloud space, the post-acquisition entity is likely to facilitate the development of comprehensive observability solutions for complex distributed and hybrid IT infrastructure. As a result, vendors in the observability market are likely to feel the pressure to develop and adopt more advanced tools that can work on-premises and in multiple cloud environments.

Competitors might benefit from the acquisition challenges and potential delays

The acquisition of such a large scale may lead to short-term disruption as both entities adjust to the new joint entity and determine its implications. The observability market where Splunk operates is highly competitive. Companies such as Dynatrace, Datadog, and New Relic will see opportunities to pounce on any delays or conflicts during the integration.

Vendors, including Dynatrace and Elastic, also offer single unified solutions for observability, security, and business data, positioning them as direct competitors to Cisco-Splunk. These companies claim to have better value-to-cost, fast, and simple observability solutions suitable for cloud-native and hybrid environments. Dynatrace will likely benefit the most from any uncertainty in this deal as they are in a strong position to deliver enterprise-class observability solutions that Splunk-Cisco customers need.

Acquisition impact on the cybersecurity market

The acquisition might accelerate market shift to increase AI adoption in cybersecurity

The rapid advancement of AI technology has given rise to new security threats, and regulatory bodies recognize the need for AI implementation guidelines in cybersecurity. The acquisition adds Splunk’s security information and event management (SIEM) to Cisco’s extended detection and response (XDR) capabilities. This will allow Cisco to offer end-to-end security solutions that use AI to predict and prevent threats, not just detect and respond to them. This will accelerate the shift in the broader market towards more AI and machine learning integration in the cybersecurity space.

Cisco’s acquisition of Splunk can potentially drive consolidation and M&A activity among other cybersecurity vendors. Many strategic collaborations are likely to occur in various areas of cybersecurity, cloud security, and network monitoring as corporations seek to establish their end-to-end security suites.

Smaller cybersecurity companies that bring innovative solutions integrating AI are most likely to become acquisition targets. After the acquisition, these companies may play a crucial role for the more prominent players who look to expand their capabilities and compete with the new Cisco-Splunk venture.

As a combined entity offering an end-to-end innovative security solution, big enterprises may find the stack compelling and evaluate their current security strategies. This could lead to a possible switch to the Cisco-Splunk comprehensive security package, potentially impacting vendor relationships and long-standing security deployments.

The acquisition might offer opportunities for small and big vendors through their value proposition

The acquisition creates opportunities for XDR vendors such as CrowdStrike and Palo Alto Networks. These vendors have SIEM replacement strategies and can attract customers away from traditional SIEM deployments by riding the waves of change in the market caused by the Cisco-Splunk deal. Smaller SIEM vendors can also form relationships with customers who do not want to partner with Cisco because of the higher costs and vendor lock-in.

While the Cisco-Splunk deal will strengthen Cisco in cybersecurity, it also presents opportunities for big rival platforms, including Microsoft Sentinel and IBM Security QRadar. By focusing on agility, innovation, and customer centricity, these competitors can attract customers uncertain about the future of Splunk under Cisco’s ownership. This is especially true due to the slower innovation cycles often resulting from significant acquisitions.

EOS Perspective

There is a pool of opportunities for enterprises to build AI infrastructure in the big public clouds, and companies are aggressively pursuing that. The next big wave will be driven by the observability and security market. Companies that can build AI capabilities inside enterprises will be at the forefront and emerge as dominant players. Since enterprises need to protect the data, they do not necessarily want to ship up to the public cloud, which is a huge opportunity for Cisco and other competitors.

Acquiring Splunk put Cisco in a position to dominate the observability and cybersecurity space. The acquisition will also help Cisco expand its offering to big enterprises and tap into small and mid-sized businesses. Over the coming years, we could witness increased merger and acquisition activities of all scales. For instance, networking and security companies will likely enter into partnerships with GPU makers such as NVIDIA, Intel, and AMD to enhance their AI capabilities.

Cisco gets a powerful observability platform in Splunk, however, it may also face challenges in integrating Splunk into its large-scale business. Effective messaging to customers and integration will be key to making Cisco offer a cohesive and compelling observability and security stack. In the short term, Splunk’s acquisition may lead to the introduction of new innovative solutions in the observability market by the competitors. The long-term implications depend on Cisco’s ability to integrate Splunk’s products and innovate continuously.