Sizing Up Akamai's Purchase of ProlexicThe Evolution of the DDoS Defense Marketplace
Distributed-denial-of-service attacks against financial institutions and others continue to evolve, and so does the DDoS defense marketplace.
In the latest market development, Cambridge, Mass.-based online security firm Akamai has announced plans to acquire Hollywood, Fla.-based Prolexic Technologies. Akamai expects to complete the $370 million deal early next year.
Akamai currently provides security solutions to protect websites and web applications from today's large and evolving attacks. Prolexic is a provider of cloud-based solutions aimed at protecting data centers and enterprise IP applications. With this move, Akamai envisions becoming a single source for protecting an organization's web and IP infrastructure against application layer, network layer and data center attacks.
Mergers and acquisitions involving companies that specialize in DDoS defenses will become more common as DDoS attacks continue to multiply and grow in sophistication, experts say (see DDoS: Addressing the Ongoing Threat).
Akamai and Prolexic joining forces to bundle their DDoS services is likely a positive move - one that will enhance, not hinder, innovation, says Gartner analyst Avivah Litan, a financial fraud expert.
"This is a good move for Akamai," she says. "Their customers expect first-rate DDoS mitigation services, which they really didn't have in the past. By acquiring Prolexic, they significantly strengthen their DDoS mitigation capabilities. Technically, it's a good fit as well."
But Tom Wills, a financial fraud expert and director of Ontrack Advisory, a company focused on payments innovation, questions whether the acquisition will have a noticeable impact on the industry's defense against DDoS attacks.
"I think this is purely a business play on the part of Akamai, where Prolexic becomes part of their suite of product offerings and helps them boost revenues," Wills says. "I don't see the deal, in and of itself, having any material effect on DDoS attack levels."
Chris Risley, CEO of Defense.Net, which specializes in DDoS mitigation from the cloud, notes: "We are only going to see more innovation in the DDoS space. The market has grown because the attacks have grown."
The security services sector has seen a number of acquisitions in the last year, as larger technology companies have scooped up smaller, more specialized niche providers. And while smaller tech companies tend to be more nimble and innovative, the industry often benefits from the acquisition of these smaller players, Risley says.
"The big players, like Akamai, have accumulated quite a bit of cash," Risley says. "I see this helping innovation. You have a company like Prolexic that now has ... a larger sales force so they can do more than they could before."
A Maturing Industry
Akamai notes in its announcement of the acquisition that it acquired Prolexic to ensure it is providing customers with a comprehensive portfolio of Web and IP infrastructure security solutions.
Barret Lyon, who founded Prolexic but left to become founder of Defense.Net, says marrying Akamai's global scale with Prolexic's cloud-based DDoS services reflects an industry that's maturing. "When I started in the industry, there was no market for DDoS [mitigation]," Lyon says.
But the increased sophistication of DDoS attacks in the last 18 to 24 months has revealed the need for more specialized DDoS mitigation services, Lyon adds.
Akamai's pending acquisition of Prolexic, Lyon says, demonstrates that Akamai "sees a lot of benefit to security as a service, and it's also an opportunity for them to differentiate themselves and grow in their DDoS offerings."
But Risley cautions that the integration of Akamai and Prolexic may not go smoothly, and banking institutions that rely on both companies may need to rethink their secondary defense options.
"Over the next year, we'll see Prolexic integrated into some of Akamai's service offering bundles, so when you buy some of Akamai's services you can get some of Prolexic's services," Risley says. "But they will continue to be like independent companies until then."
And despite the benefits banking institutions and other corporate customers of Akamai and Prolexic will reap from the companies merging, they also increase their so-called concentration risks, i.e., relying on one vendor for all of their DDoS-mitigation defenses, Lyon says. As a result, banking institutions that work solely with Akamai and Prolexic will now have to decide whether they need a separate secondary DDoS-mitigation provider, he adds.