Arctic Wolf is buying BlackBerry’s Cylance endpoint security business for $160 million, a move that will boost the security operations company’s Aurora platform for both end users and MSSPs and take a struggling business unit off of BlackBerry’s books.
The acquisition, which was announced this week and is expected to close by the end of February 2025, marks another deal in a rapidly consolidating cybersecurity market that is putting a high value on endpoint security, both as a product and as a managed service.
Arctic Wolf will fold Cylance into its AI-powered Aurora extended detection and response (XDR) platform, which includes such services as managed detection and response (MDR), managed risk, and managed security awareness and provides a range of capabilities, from broad visibility of the threat landscape – it processes more than seven trillion events a week – to threat intelligence to cloud analytics.
The vendor has integrated Cylance with the Aurora platform for seven years.
Platforms Over Standalone Products
In a blog post, Dan Schiappa, Arctic Wolf’s chief product and services officer, wrote that the deal for Cylance will bolster the platform’s endpoint security capabilities, a key factor in addressing advanced cyberthreats. Schiappa noted that 95% of investigations run by the vendor’s security operations center (SOC) include telemetry from endpoints.
It also will advance Arctic Wolf’s argument that tightly integrated platforms are more effective than collections of standalone tools. There tends to be a lack of operationalization of endpoint security tools “due to alert fatigue, product misconfigurations, and the inability for endpoint tools to interact with other security tools in a truly useful way,” he wrote. “This is why security platforms are playing such an increasingly crucial role in stopping modern threats -- because organizations are looking for a single source of truth that can sort through the noise generated by the dozens of different tools.”
More Consolidation on the Way
Jack Gold, principal analyst with J. Gold Associates, told MSSP Alert that the push for security platforms is driving the larger consolidation trend in the market. That was highlighted last month when Trustwave and Cybereason announced a merger to become a larger player in the MDR space.
“There are just too many players in the marketplace and companies are looking for simplification,” Gold said. “The major players are assuming more of the overall security market, especially since endpoint is being combined with network and cloud security postures.”
He added that he expects to see major players like Microsoft, Cisco, and Palo Alto Networks expand their capabilities across all security domains, adding that “most companies have way too many individual security components, so simplification and consolidation are inevitable as they look for ways to reduce costs and streamline operations.”
A More Complete Offerings for MSSPs
The platform approach is also a key driver in Arctic Wolf’s strategy with MSSPs and MSPs, with the vendor noting that 81% of MSPs offer or plan to offer MDR services and 94% doing the same with vulnerability management. According to the company, they need to ensure their services are both effective and efficient.
“MSPs need to shift from a tool-focused mindset to an operations mindset,” the company wrote earlier this year. “The answer lies in a perspective shift and move toward consolidation. A consolidated approach can help MSPs better serve clients by utilizing a smaller number of security operations-focused tools that will reduce complexity and risk while increasing efficiency. … They need in-depth security expertise, the capacity to hunt down threats, and the ability to mitigate and contain any impact from incidents. That’s where a third-party solution like Arctic Wolf can transform an MSP’s cybersecurity offerings.”
Out of the EDR Business
For BlackBerry, the deal likely is a welcome relief. In 2018, the one-time mobile device giant bought Cylance for $1.4 billion as it looked to become a player in the endpoint security space. It didn’t work out that way for BlackBerry, as illustrated by the relatively small amount of money it took to sell Cylance to Arctic Wolf.
It’s shifted its efforts in recent years away from security and toward software for Internet of Things (IoT) systems, including autonomous vehicles.
“BlackBerry bought Cylance several years ago with the hope of using BlackBerry's reputation to become a major end-point security player,” Gold said. “But they were never really able to take advantage of that, and Cylance never really took off. BlackBerry has changed direction and wanted to divest the security piece – Cylance – to focus on IoT. Hence the acquisition by Arctic Wolf.”
Along with $160 million – $80 million in cash when the deal closes and the rest a year later – BlackBerry also will receive about 5.5 million common shares of Arctic Wolf.
