80% Of The Acquisitions Fail, Is Cisco's Acquisition Of Splunk A Leap Forward Or A Misstep?

Cisco Systems Inc’s CSCO acquisition strategy has historically been characterized by a series of calculated, measured investments. However, its recent acquisition of Splunk Inc SPLK sends a clear message: Cisco is ready to play big. At $28 billion, this acquisition is set to be the largest in Cisco's history. It marks a significant push for the company to diversify from its primary hardware networking business towards more software and subscription-based services, including observability and security.

Several analysts have weighed in on the acquisition, with opinions ranging from cautious optimism to calling it a bold move for Cisco. This article offers a more nuanced viewpoint, focusing more on the product and go-to-market (GTM) aspects, and the potential opportunity cost for Cisco.

Who Is Splunk?

Splunk provides software and solutions that enable organizations to search, monitor, analyze, and visualize data from various sources in real-time. It has a strong foothold in two key markets:

• Security Information and Event Management (SIEM): It centralizes the storage and interpretation of logs and events, facilitating effective threat detection, security event correlation, and prompt incident response.
• Observability: Tools that monitor and analyze metrics, logs, and traces from software applications, infrastructure, and networks. They provide insights into their performance, health, and potential issues

In the age of digital transformation, as businesses shift to digital platforms, both SIEM and observability have taken on crucial roles. While SIEM fortifies against the increasing tide of cybersecurity threats, observability guarantees smooth digital experiences for both customers and employees.

Acquisition Analysis

To understand the strategic fit of the acquisition, we need to look at it from multiple lenses:

Valuation

The acquisition, priced at roughly 31% premium over Splunk's last closing price, aligns with the standard control premium in M&As. To put it in perspective, this values Splunk at a 7x enterprise value to the forecasted 2024 sales ratio. A bargain, given the software sector's average hovers at 11 times EV/Sales. If Cisco's projections are accurate, the acquisition will be cash flow positive by 2024, suggesting a fair deal.

Product Fit

For a deeper understanding of how the product portfolio of the two companies fit together, please refer to the product map below.

Splunk augments Cisco’s security portfolio with its top-tier SIEM capabilities. Customers are increasingly gravitating towards end-to-end security suites to reduce complexity. Given this backdrop, the acquisition presents significant synergies

But it's not all rosy. The product overlap in the Observability segment, which accounts for roughly 40% of Splunk’s business, poses a challenge. Historically, Splunk has excelled in infrastructure monitoring, while Cisco has been strong in App Monitoring (through its AppDynamics acquisition) and Network Monitoring (through its Thousand Eyes acquisition). However, both companies have been expanding into adjacent areas to become full-stack observability players, resulting in overlapping capabilities across the spectrum. The most significant overlap is in App Monitoring. Splunk entered this space through its $1 billion SignalFx acquisition in 2019.

Cisco has also recently introduced its FSO solution on the Otel platform. This integrates infrastructure monitoring and AIOps features from its acquisitions of Opsani and Replex. These overlaps lead to considerable product redundancy, which could potentially reduce the synergistic value of the acquisition.

Go-To-market (GTM)

Splunk stands to benefit from accelerated GTM momentum, capitalizing on Cisco's extensive global reach and robust sales channels, especially on the security side. However, the acquisition will complicate the messaging for Observability due to the product overlap.

Observability is a fiercely competitive market with key players like Dynatrace and Datadog. They are all poised to capitalize on the uncertainty that the Cisco acquisition might introduce to the industry. As Cisco and Splunk work to streamline their overlapping product portfolios, it's almost certain they'll face distractions. This may lead IT buyers to question the sustainability of their individual observability solutions, potentially jeopardizing sales in the short term.

Integration Complexities

Integrating a company of the size of Splunk is always tricky. But in this case, the product overlap makes it ten times more challenging. Cisco will have to either rationalize or merge their overlapping products, which will take many years due to existing customer commitments. The most significant challenge is in App Monitoring where both companies have a strong solution. It is never easy to merge two products built on completely different stacks.

Beyond the obvious complexities of product integration, challenges also arise in GTM integration. Sales teams from both organizations may find themselves in uncertain territory for the foreseeable future. This ambiguity can lead to confusion regarding their sales pitch, target customer segments, and even commission structures. Such uncertainties, if not addressed promptly, can diminish their motivation and enthusiasm.

Final Thoughts

On a positive note, this acquisition signifies a bold pivot, potentially transforming Cisco's reputation from being primarily hardware-centric to increasingly software-driven. Also, from a valuation perspective, the acquisition appears sound.

But Cisco may have compromised in some aspects. Splunk's business remains largely on-prem (60% of its revenue). Furthermore, the sheer scale of the acquisition suggests that Cisco might forgo other potential purchases, especially those that are adjacent to its core competencies.

As the migration toward cloud computing continues, Cisco may have missed the boat on the modern networking opportunity, a narrative prominently driven by Cloudflare. Indeed, Cloudflare could have been a perfect fit for Cisco, aiding their shift to modern networking and cutting-edge network security solutions. What's more, its valuation is approximately the same $22B as Splunk's.

Cisco must have had its reasons for choosing Splunk. Perhaps the wisest decision would be to retain Splunk as a separate entity, making it Cisco’s primary software division. Merging a hardware-centric company with one that is software-focused could pose significant cultural challenges. Conversely, Cisco has faced challenges in its transition to a software-centric model, and Splunk brings expertise in this area. In fact, Cisco should consider moving its existing software businesses in security and observability under the Splunk umbrella, thereby driving focus, competence, and independence for its software arm.