Cisco to buy cybersecurity company Splunk for $28bn

If the deluge of data in the modern world is increasingly overwhelming, Splunk claims to have been ready for it for 20 years.

The company’s name reflects the act of burrowing deep down into the Earth to explore caves – the adventure of data spelunking.

Splunk was started by three friends in 2003, with co-founder and former chief executive Michael Baum drawing on his past building search engines at Yahoo.

The conundrum was to figure out how to make sense of the mass collection of real-time data. Splunk aimed to search it in an instant, improving on cumbersome old ways of filing through logs. The idea was to have machines label and index data themselves.

On Thursday, more than 1,100 patents later, Splunk’s early fascination with the unknown depths of data paid off. Cisco Systems agreed to acquire the company for $28 billion, after an earlier courtship was rekindled. Bloomberg Intelligence senior analyst Woo Jin Ho described it as “the Moby Dick” of deals.

It marks a victory for Splunk chief executive Gary Steele, who joined last year from cybersecurity company Proofpoint, which he founded and served as chief executive.

The union could combine the power of data and AI to “transform the industry", he said in a statement. Splunk’s share price soared on the news, increasing 21 per cent just after noon in New York. He will report to Cisco chief executive Chuck Robbins going forward.

Splunk excels in two areas that Cisco believes will fit with products it already offers. Cisco's existing security products detect and respond, monitoring how devices connected to a network are behaving, deciding whether something fishy is going on and then alerting a company’s IT department.

Splunk does incident and event management, meaning that it logs and tracks every action on a network. It looks at where requests originated and what service or software initiated them, compiling vast amounts of data in the process.

That means customers will be able to go from detecting and responding to what is occurring inside a computer network, to predicting and preventing issues, said Cisco chief financial officer Scott Herren.

Splunk also offers so-called observability, meaning it uses technology to help customers see and understand whether their applications are secure and performing as they should be.

For instance, someone searching a retail site will be connected to a web server that provides them with the product page. Another computer in the background might check on internal inventory and another might calculate the shipping time.

Once the consumer commits to a purchase, it is quite probable that a third-party payment service will get involved.

Any of these steps might be a problem. Splunk adds to Cisco's existing application diagnostic offerings by being able to look deeper into computer networks and checking each step in the complex chain to make sure everything is working in concert.

Splunk went public in 2012, doubling its market valuation to more than $3 billion on its first day of trading amid a newfound frenzy for big data investing.

It now has about 8,000 employees and 230,000 users around the world, and more than 90 of the Fortune 100 companies use Splunk, according to its website.

Its products are important to security operations centres, the heartbeat for experts who try to detect and protect organisations in real time.

It seems to be working. In August, Splunk reported 824 customers with $1 million in annual revenue in its second-quarter report, up from 723 at the same time last year. Annual recurring revenue stood at $3.86 billion.

The acquisition reflects Cisco’s confidence that data in the era of artificial intelligence and the cloud is getting both more confusing and capable – and more urgent.

The idea is that Splunk, which can analyse the health of an underlying network in data centres and is moving to cloud-based products, will help Cisco’s customers predict and halt potential threats.

Splunk also fills a hole for Cisco, which was struggling to find a bankable way to expand its business, said Quinton Gabrielli, assistant vice president of equity research at Piper Sandler.

The deal will deliver subscription-based software revenue that Cisco can take to the bank year after year.