NEW A vastly improved search engine helps you find the latest on companies, business leaders, and news more easily.<doc-sep>Cisco today announced its intention to buy Ann Arbor, MI-based security firm, Duo Security. Under the terms of the agreement, Cisco is paying $2.35 billion in cash and assumed equity awards for Duo. Duo Security was founded in 2010 by Dug Song and Jonathan Oberheide and went on to raise $121.M through several rounds of funding. The company has 700 employees with offices throughout the United States and in London, though the company has remained headquartered in Ann Arbor. Co-founder and CEO Dug Song will continue leading Duo as its General Manager and will join Cisco’s Networking and Security business led by EVP and GM David Goeckeler. Cisco in a statement said they value Michigan’s “resources, rich talent pool, and infrastructure,” and remain committed to Duo’s investment and presence in the Great Lakes State. The acquisition feels like a good fit for Cisco. Duo’s security apparatus lets employees use their own device for adaptive authentication. Instead of issuing key fobs with security codes, Duo’s solution works securely with any device. And within Cisco’s environment, the technology should feel like a natural fit for CTOs looking for secure two-factor authentication. “Our partnership is the product of the rapid evolution of the IT landscape alongside a modernizing workforce, which has completely changed how organizations must think about security,” said Dug Song, Duo Security’s co-founder and chief executive officer. “Cisco created the modern IT infrastructure, and together we will rapidly accelerate our mission of securing access for all users, with any device, connecting to any application, on any network. By joining forces with the world’s largest networking and enterprise security company, we have a unique opportunity to drive change at a massive scale, and reshape the industry.” Over the last few years, Cisco has made several key acquisitions: OpenDNS, Sourcefire, Cloudlock, and now Duo. This latest deal is expected to close in the first quarter of Cisco’s fiscal year 2019. Duo Security’s Dug Song On Company Priorities | Disrupt NY 2017<doc-sep>US-based two-factor authentication provider Duo Security announced this morning that it is in talks to be acquired by networking giant Cisco. According to Duo’s press release, Duo will become a “business unit” under Cisco’s Security Business Group, and current Duo CEO Dug Song will become the unit’s general manager. Ars is a happy Duo customer, and we use the product extensively to apply 2FA to a variety of our internal services; beyond that, several Ars staffers (myself included) use Duo’s free tier to wrap 2FA around our own personal stuff, like Linux PAM authentication and Mac/Windows logins. Duo’s flexibility and ease of use has been a huge driver of success for the company, which says it has about 12,000 customers. But the worry here is that Cisco is going to murder the golden goose—and, as a former Cisco customer, I’m struggling to feel anything but dread about all the ways in which this acquisition might kill everything that’s good about Duo. Duo boss says not to worry In an email to Duo customers this morning, Duo CEO Dug Song attempts to address fears like mine in the very second paragraph: If you read nothing else, please read this: our commitment to provide you with the service and functionality you have been accustomed to will not change. We will also be continuing to expand our library of integrations and innovative solutions to ensure your security choices remain the most loved in the industry. I know this is supposed to make us feel better, but it’s a lawyer-friendly non-statement that doesn’t actually assure anyone of anything meaningful. “Our commitment [emphasis added] to provide you with the service and functionality you have been accustomed to will not change” is shameful corporate doubletalk. Duo’s “commitment” is immaterial to this discussion. Saying “our commitment to provide you with the service and functionality you have been accustomed to will not change” is very different from actually saying “the service and functionality you have been accustomed to will not change.” I’ve reached out to Duo’s press office seeking comments about the acquisition, but Duo had not responded at publication time. I’ll update this piece with the company’s comments if it does. My peril-sensitive sunglasses just went dark Maybe I’m just overreacting. Maybe everything’s going to be fine. Consumer-facing brands like Linksys have been getting along well under Cisco for the past few years—at least after this idiocy, right? I’d love for that to be the case, but I just can’t find the hope within me. I spent a decade as a Cisco enterprise customer, elbows deep first in Cisco MDS9500-series SAN directors and then later in NX-OS powered converged switches, and my personal experience with Cisco was overall profoundly negative, even though I was working for a Fortune 25 company with all the extra sales and support attention that warranted. Advertisement In my opinion—which is informed by my own anecdotal experience—Cisco belongs on the same shelf as Oracle when it comes to businesses that exhibit a profit-above-all-else mindset. From my point of view as an enterprise customer, Cisco consistently came across as unswervingly committed to maximum revenue extraction at every single point in its relationship with a customer. The company’s per-feature licensing was (and remains) so expensive and so complex that the whole product portfolio seemed designed around creatively separating customers from their capital first and actual network/SAN administration a distant second. The yawning abyss of suckification When the news broke this morning, I had a brief and despairing conversation in Ars Slack with Jason Marlin, Ars’ technical director-in-chief. We’d just seen the emails and had both independently had the same initial reaction of dismay: The concerns we had—articulated above, complete with swears for emphasis—can broadly be packed together under a single scary prediction: Cisco is going to screw up Duo by turning it into a Cisco-style product. Jason’s "gross Java applet" comment was mostly in jest—dear God in heaven, please let that not come to pass, because I already have to keep a dedicated virtual machine around loaded with Java so that I can manage my Web server’s ASA box—but the Cisco-fication of Duo is legitimately scary. From a usability standpoint, we’re afraid UI/UX creep will transform the existing Duo console into a Frankenstein-monster nightmare of tabs and infinite nested menus. We're afraid of the light user-facing sign-on interface bloating into a grossly overcomplicated portal that buries simple operations under layers of extraneous crap. We’re afraid that development time will be spent on features that specifically benefit only the top-tier enterprise customers rather than improving the overall product. More importantly, we’re nervous about Duo’s free tier—because at Cisco, all things serve the stock price (I’ve had lunch with a whole heap of Cisco enterprise sales reps, and those conversations gave me a very stark, very unflattering peek into Cisco's revenue-driven culture). That alone is more than enough to make me fear for the elimination of Duo’s extremely useful free tier, coupled with Cisco mandating Duo raise the rates on Duo’s paid tiers in order to assist with the company’s mindless obsession with beating its quarterly guidance. The fact that Cisco has returned to profitability in 2018 makes that kind of price-pumping almost inevitable. The next time revenue dips, management will have to go all-hands-on-deck to make up for the shortfall, and squeezing additional revenue out of an acquisition is a time-honored tradition. Advertisement Why must everything I fall in love with die? Much of my despair here comes from the fact that I’ve extensively adopted Duo into my own personal operational security routines, and it works great. It felt like the bit in Fight Club where Jack and Tyler are talking about the perceived permanence of furniture. Whatever else happened, I had my 2FA issues handled. I didn’t have to think about it anymore. And Duo is excellent at handling those issues. My servers all use Duo for both 2FA logins and also privilege escalation, via Duo’s excellent Duo Unix integration. I use Duo 2FA for local logins for my work Macbook Air. I’ve got Duo 2FA protecting the WordPress logins of a number of sites I help administer. The service supports push requests via its app (which also will generate TOTP codes and works as a Google Authenticator replacement if desired). It works with hardware tokens like Yubikeys. It even supports U2F authentication, and it’s got a great self-service portal for users to add or remove their own devices as needed. Whatever else happened, I had my 2FA issues handled. And, as long as you don’t need more than 10 functioning accounts, the service has a free tier that does everything an individual or home user needs. The extensive functionality, coupled with Duo’s ongoing development of new ways to utilize the service, make it a joy to use. It’s one of the few services in my life that I’m almost totally 100 percent happy with. (It’s worth noting that I fell head over heels in love with StartCom’s free SSL/TLS services and its cheap wildcard certificates, too, and we all know how that turned out. Word of advice: if I start talking about how awesome a company is, stop using its services immediately, because it’s probably about to either collapse or be purchased and destroyed.) To be fair, Cisco is clearly in the process of creating its own self-contained infosec vertical and, as Ars IT editor Sean Gallagher said while discussing this story, Duo is almost the platonic ideal of a company that was created with the express purpose of being sold. It’s exactly the kind of building block a company like Cisco would be looking for to incorporate into its own plans. And as much as I’m dissing Cisco, there are worse companies to be acquired by—at least it wasn’t Huawei or McAfee (I just threw up in my mouth a little while typing that). And Cisco doesn’t have its own broadly applicable 2FA solution, so the likelihood that Cisco would buy Duo only to kill it (cough cough) seems low. The only thing that doesn’t change is change<doc-sep>
Cisco Systems Inc. has agreed to pay $2.35 billion for security startup Duo Security, the companies announced Thursday morning, beefing up the networking company’s software offerings. Duo is an authentication service that focuses on two-factor authorization, helping to identify a company’s employees across a range of devices or applications, a product somewhat similar to Okta Inc. OKTA, +0.97% , which went public in 2017 and currently has a market cap of more than $5 billion. The deal gives Cisco CSCO, -0.75% , one of the larger players in the security market, a cloud native to boost recurring revenue and services. “We’ve been building a world-class security architecture for some time,” Cisco Security executive David Goeckleler said in an interview with MarketWatch ahead of the announcement Tuesday morning. “What Duo allows us to do is extend that architecture to wherever users are.” Duo had raised about $118 million in venture funding, including investments from large tech players such as Workday Inc. WDAY, +0.21% and Alphabet Inc. GOOGL, +0.74% GOOG, +1.02% , according to FactSet, and had previously been valued at about half the total Cisco is paying. The deal, which will be paid out in cash with some assumed equity awards, is expected to close in the first quarter. Don’t miss:Amazon denies it will challenge Cisco with switch sales Duo co-founders Dug Song and Jon Oberheide told MarketWatch in the Thursday morning interview that they feel they have developed a “new firewall for cloud and mobile,” and that combining with Cisco will be “jet fuel for the business.” “Cisco is a company we’ve been working with quite some time,” said Song, who serves as chief executive and will continue to lead the business within Cisco. “They have a unique command of the modern market.” “This allows us to skip steps one and two to building a global scale,” Song added. Read now:Cisco turns corner in tough transition to a new era Duo, founded in 2009, was a rare unicorn of the Midwest, with its headquarters in the college town of Ann Arbor, Mich. Cisco will maintain the team there, said Goeckeler, adding, “Dug’s built a great team in Ann Arbor.” The deal is Cisco’s biggest since it acquired AppDynamics for $3.7 billion in January of 2017. AppDynamics tracks and manages data and performance from business-focused applications. Read also: The lessons from Cisco’s at-the-buzzer buy of AppDynamics Cisco has been trying to build up its software offerings for years as a way to add steady recurring revenue to its core networking business, an effort that has accelerated under Chief Executive Chuck Robbins. Authentication services for businesses fits in with many of the software offerings Cisco is known for, such as virtual private networks, or VPNs. Read also:Why a trillion-dollar Apple is nothing to celebrate See:Cybersecurity stocks get battered as high-bar earnings season begins “[Duo] fits into our architecture and allows us to extend it in a dramatic way,” Goeckeler said. Duo said in early 2017 that it had recorded $73 million in annual recurring revenue in 2016, growing that total 135% from the year before. In a similar announcement in early 2018, Duo said it had surpassed $100 million in ARR. Data-Security Concerns Threaten Trust in Tech Companies Cisco Security topped $2 billion in annual revenue for the first time in the 2017 fiscal year, reporting $2.15 billion in sales out of Cisco’s total of $48 billion. Cisco is scheduled to wrap up the 2018 fiscal year with a fiscal fourth-quarter report on Aug. 15, and analysts on average expect the company to report quarterly security revenue of $612 million, which would give an annual total of $2.34 billion. Security companies have faced pressure this earnings season, as growth rates struggle to help the companies live up to high expectations. Many believe that a wave of consolidation is likely in an industry that has produced many startups seeking to solve a single security issue, but customers may be tiring of tapping dozens of different vendors for their security needs. “As you see consolidation start to happen, we’ll see growth start to pop back up” for the companies that survive, FireEye Inc. FEYE, +1.93% Chief Executive Kevin Mandia told MarketWatch on Wednesday.