Palo Alto Networks will buy IBM QRadar cloud security software assets

Palo Alto Networks is buying cloud security software assets from IBM as part of a broader partnership that will give the cybersecurity company access to more consultants and a bigger customer base.

In a joint press release, the companies said Palo Alto is acquiring IBM’s QRadar cloud software for an undisclosed sum and migrating existing customers to its security platform, Cortex Xsiam. The move normally takes one to three months, Nikesh Arora, Palo Alto’s CEO, told CNBC. Also, IBM will train more than 1,000 of its consulting employees on Palo Alto’s products.

Consolidation has been ramping up in the security software industry as companies gear up for a swarm of attacks spawned by artificial intelligence. In March, Cisco closed its $28 billion acquisition of Splunk, the networking company’s largest deal ever, snapping up the leading provider of security information and event management (SIEM) software.

Earlier on Wednesday, two other companies in the SIEM market, Exabeam and Thoma Bravo’s LogRhythm, announced plans to merge.

Arora said his company needs to be better prepared to go up against Splunk.

“Clearly, it’s just a hotbed of activity in the consolidation in cybersecurity,” Arora said.

Palo Alto and IBM have been working more closely together for months, and Arora said he’d been talking with IBM CEO Arvind Krishna about how to advance their partnership. But they both sold SIEM software.

“We used to get stuck there,” Arora said.

Krishna said the Splunk deal didn’t push IBM to make its arrangements with Palo Alto.

“We don’t really compete, I think, with most things in Cisco’s portfolio,” Krishna said.

In December, IBM said its consulting group would offer Palo Alto’s competing Cortex Xsiam software to customers. IBM will now adopt Cortex Xsiam, as well as Palo Alto’s Prisma Sase 3.0 product bundle. Palo Alto will incorporate IBM’s Watsonx large language models into Cortex Xsiam, in addition to its use of models from Google.

The SIEM category has been around for over 20 years, but Palo Alto just introduced Cortex Xsiam two years ago. It’s rapidly gained adoption, with over $90 million in bookings in the latest quarter, and Arora said the company has been taking market share from “everyone.”

For IBM, a more robust lineup of contemporary security tools for consulting might help the company deliver on its stated goal of revenue growth in the mid-single digits for 2024. In the first quarter, revenue increased 3%, with a 2% bump in the consulting segment.

Palo Alto is growing much faster than IBM. In the January quarter, revenue jumped 19%. The company will report results for the latest quarter on Monday.

Palo Alto more than doubled in value last year and its stock is up 6% year to date, lifting the company’s market cap past $100 billion. The stock rose more than 1% in extended trading. IBM is up close to 5% this year and is now valued at $154 billion.

The companies said the transaction should close by the end of September, subject to regulatory approval and other conditions.

“I expect that we are going to grow significant consulting business on Palo Alto’s products, much like I have with Azure and AWS,” Krishna said in an interview. IBM helps organizations run their software on the Amazon and Microsoft public clouds. He said he hopes to quickly be generating hundreds of millions of dollars in new consulting revenue.

IBM will continue to sell its QRadar software for use in on-premises data centers, Krishna said.

“It’s here for years,” he said.

At the same time, IBM will suggest that clients using it consider switching to Palo Alto’s Cortex Xsiam, Krishna said.