« Incident Management Life Cycle
Data Quality Discipline »

Why Hasn’t the Buyout Begun?

So I got a question for everyone. Why hasn’t the SIM or log analysis market consolidated?

The SIM market is about 5 years old now. There are many players in this field, both pure SIM players and players expanding into the SIM space.

Some of the pure players include

Other non-pure players that are either getting into or already in the SIM space include

I was expecting the wave of buyouts to begin when Symantec acquired the 3 companies, but nothing has happened.

I can think of a couple reasons

  1. SIM vendors haven’t proved their value. There’s a lot of good technologies out there, but most of them are very high priced. I think the SIM vendors have a tough time justifying the ROI.
  2. Most SIM vendors have gotten several rounds of funding now, probably anywhere from $15 to $60 million. Most companies don’t want to spend a whole lot of money buying these vendors. Symantec bought Mountain Wave for $20 million, Riptech for $145 million and Recourse for $135. Both Riptech and Recourse brought more than just log analysis products.

What do you think? I would love to hear your thoughts on this issue.

Last Modified: Wednesday, November 10th, 2004 @ 23:10

This entry was posted on Saturday, October 30th, 2004 at 8:08 am and is filed under Companies, Market. You can follow any responses to this entry through the RSS 2.0 feed. Responses are currently closed, but you can trackback from your own site.

2 Responses to “Why Hasn’t the Buyout Begun?”

  1. SwS Said on December 13th, 2004 at 11:53 am quote

    The issue with this market is that a lot of customers are willing to accept “good enough” solutions, including many home-grown scripts and systems. So while the various technologies provide clear value, there is a tendency to either 1. demand of individual security vendors to provide a full log analysis system 2. write a lot of perl scripts by hand to get the job done. Between #1 and #2, it is difficult to develop a vibrant market with clear winners.

  2. jlz Said on December 13th, 2004 at 3:10 pm quote

    This is very true. Most of the customers we encountered had home grown solutions. The problem is that a lot of times the cost of maintaining the software as well as adding features (once you have something, people’s gonna want more) becomes very expensive.

    Wrt to #1, can you elaborate on “full log analysis system” mean?