EAC Blog: Your vendor is bought, now what?

The folks at TechTarget were kind enough to let me republish my posts at the Expert Answer Center here. This post first appeared on July 13. Link here and then you'll need to scroll down a bit because they didn't add an anchor for this specific post.

There has been a lot of M&A activity in the security space of late. With EMC buying RSA and Secure Computing acquiring CipherTrust, I'm sure there is a lot of angst in the end user community about the impact of these mergers on the only thing that's important -- you and the security of your environment.

M&A in the security space (actually all of technology for that matter) is a fact of life. So grinding your teeth about it will only make your dentist happy. But there are a set of activities that end users can undertake, once a key vendor is acquired, that will help.

The reason I even bring this up is an article I found in Information Security Mag from May of 2006 that seems like it must have been lost for four or five years (or possibly misdated). It's been a long time since I've seen Axent and Platinum Technology used as an example in anything. This article talks about the potential impact of mergers on customers and the conclusions are pretty close to reality.

From my perspective, very few deals actually are in the customer's best interest. Deals are driven by economics, and, inevitably, the integration causes the acquired company to lose momentum both on the distribution/sales side as well as in improving the product. When I was on the vendor side, we would joke that your second happiest day is when your biggest competitor gets acquired. That gives you at least six months of runway to do damage and take share as they look internally and focus on integration.

Of course, the happiest day is when you get acquired. But at that point, you are more likely thinking about your new big house or fancy sports car than about your customers.

So, a key vendor of yours gets acquired, what do you do? I mapped out my thoughts in this post from April, but let me summarize quickly.

1. Do nothing at first -- Just because a deal is announced doesn't mean it's going to close (remember Check Point/Sourcefire?). So until the deal actually closes, it's business as usual.
2. Call a meeting -- Within a week or two of the deal closing, call a meeting with the surviving entity. Hopefully you'll know who your account rep is at that point. You'll want to ask three questions.
   
   • How does my product (the one that was bought) fit into your strategy?
   • Is my account team changing?
   • What is the 18 month product roadmap?

Listen very carefully to the answers, because you should have a gut feel at the end of the meeting whether the integration is going to be a train wreck. Based on what you learn, then you'll have two more decisions to make.

1. Look at how to do more business -- so if you are happy with the products, account team and roadmap -- you should be seeing if there are other opportunities to do business with the vendor. This would be a good thing.
2. Look for Plan B -- if the answers are no good, then start talking to competitors immediately. Most will be very willing to defer costs until your existing contract/maintenance expire, in order to displace a competitor.

In either case, DO NOT be the victim here. You are driving your security strategy, and if you don't like what you hear from the vendor, throw them under the bus. It's not like you've got any vested interest or political capital tied up with the new guy. Blame the merger and move on. There is another 750 other security companies ready, willing and able to sell you stuff.