Virtustream acquires ViewTrust to build out its risk management capabilities Analyst: Agatha Poon 12 Feb, 2014 Enterprise cloud provider Virtustream has acquired security and compliance specialist ViewTrust Technology as it continues to bolster the credentials of its Virtustream Cloud IaaS offering and xstream cloud management software. ViewTrust is meant to enhance Virtustream Cloud and xstream, with advanced security and compliance in mind. The result will be a broader software portfolio that includes ViewTrust's product line. Virtustream claims more than 700 organizations using xstream and says it is gaining traction in the high-end enterprise and government segments. The purchase of a security vendor speaks to Virtustream's broader strategy to shore up its credibility among performance- and security-wary enterprises. Acquirer: Virtustream Target: ViewTrust Technology Subsector: Cloud Deal value: Not disclosed Date announced: February 11, 2014 Closing date: February 4, 2014 Advisers: None Deal details This is primarily a technology buy for Virtustream and is likely a tiny one, though the company is not divulging any specifics of the transaction. ViewTrust has been around since 2003 and has steadily accumulated large customers almost 100, according to the target. Its product engineering and development team will now be folded into Virtustream's xstream software development arm, with ViewTrust CEO Kaus Phaltankar leading the commercial operation initiative for the security and compliance line of products targeting commercial enterprises and government agencies. Virtustream will maintain the ViewTrust brand, however. The deal closed earlier this month, and neither side used a financial adviser. This is Virtustream's Copyright 2014 - The 451 Group 1
sixth acquisition, according to The 451 M&A KnowledgeBase, and its first since it purchased cloud startup Enomaly in December 2011. Rationale With more enterprises willing to move production workloads to the cloud, security and compliance concerns are intensifying. The situation is exacerbated in industry verticals that are subject to stringent regulatory requirements. Although enterprise demand for a cloud partner is clear, the market for cybersecurity and governance, risk and compliance (GRC) may have been outside of Virtustream's core capabilities. With that in mind, the company has made a concerted effort to strengthen the security aspect of its cloud offerings, working with a number of security providers such as SafeNet and ViewTrust. Under an OEM license, Virtustream has already integrated ViewTrust's GRC and risk management products into xstream to enable fully automated pre- and post-auditing and continuous compliance monitoring. The ViewTrust purchase demonstrates Virtustream's commitment to advancing enterprise security management with xstream, regardless of deployment model. The acquirer notes its particular interest in ViewTrust's comprehensive enterprise security and information assurance programs, which not only enable customers to meet the requirements of a compliance audit, but also support post-compliance analytics, monitoring and reporting. There are tools and services used to provide a full set of enterprise risk management capabilities, which fits well with Virtustream's overall focus on security and compliance to round out its enterprise cloud story. Given that the company had already integrated some of ViewTrust's offerings prior to the deal, product integration is less of an issue. Moving forward, Virtustream says it will provide full integration all the way to the UI to boost user experience. Eventually, customers will be able to manage and support the requirements of advanced security and compliance audits as well as post-compliance continuous monitoring and reporting out of a single dashboard. By sharing a similar corporate vision, ViewTrust will make a good fit. As the enterprise outsourcing trend proliferates, ViewTrust says its enterprise customers will now be able to onboard to Virtustream Cloud, the hosted IaaS offering that comes with ViewTrust's embedded technology. Cloud is delivered out of Virtustream's datacenters in the US and UK as well as its partners' facilities in the Middle East (Mobily) and Latin America (UOL). Copyright 2014 - The 451 Group 2
Target profile Security and compliance specialist ViewTrust Technology was founded in 2003 by CEO Kaus Phaltankar. Based in Falls Church, Virginia, the company has been self-funded since its inception. ViewTrust, which currently has less than 50 employees, primarily focuses on product engineering and R&D. Using a mix of direct and indirect sales, the company says it has garnered nearly 100 major accounts in the large enterprise segment, including government customers such as the US Department of State and the US Department of the Treasury. ViewTrust has been active in the security market from day one. It initially focused on delivering security operation center services and then evolved its product portfolio to concentrate on building audit and compliance software targeting commercial enterprises in various verticals as well as government agencies. The company's capabilities include automated certification and accreditation, real-time monitoring and reporting, real-time log connection, and asset management. ViewTrust also offers professional services in areas such as network security architecture and engineering, BC/DR planning, gap analysis, vulnerability assessment and more. Acquirer profile Founded in 2008 by Kevin Reid and Rodney Rogers (both now serve on the board of directors), Bethesda, Maryland-based Virtustream operates across the Americas, EMEA and Asia-Pacific with offices in the US, London and Dubai. It is now working to open a branch in Asia. Since its service inception, the company has focused on taking virtualization to the next level with its proprietary cloud technology. Virtustream's cloud portfolio includes xstream software, the Virtustream Cloud platform and cloud advisory services. The company believes it is uniquely positioned to accelerate enterprise transformation using what it describes as VM technology the ability to optimize systems through the dynamic pooling of compute, memory, storage and network resources. In December 2011, Virtustream bought Toronto-based cloud provisioning enabler Enomaly, giving it a larger footprint outside of North America as the latter had gained market traction in Asia-Pacific. Perhaps more importantly, it obtained Enomaly's SpotCloud market a platform on which customers can buy and sell capacity. With SpotCloud, Virtustream is one step closer to its vision of a cloud market where customers can federate cloud services across multiple datacenters and sell excess capacity out of a private cloud exchange. In September 2013, the company closed a $40m series D funding round led by SAP, bringing its total VC raised to $125m. Copyright 2014 - The 451 Group 3
Competitive landscape Many cloud service providers (CSPs) have invested a good deal in hardening their clouds. Companies such as AT&T, BT, Verizon, Orange Business Services, IBM and HP have built out their security-related competencies via a combination of strategic partnerships and M&A. IBM bought security software vendor Trusteer in August 2013 to extend its data security capabilities to the cloud. Likewise, Orange Business Services picked up cyber-defense specialist Atheos in January to broaden its IT identity and security management capabilities. Under the Federal Risk and Authorization Management Program (FedRAMP), several CSPs have been making investments to meet industry-specific security and compliance requirements. Vendors such as Amazon Web Services, HP, IBM, AT&T and Microsoft have been authorized as FedRAMP-compliant CSPs, and more are in the pipeline. Niche players pursuing verticals for compliant cloud hosting opportunities include Layered Tech, Connectria, Logicworks, Peak 10, SunGard and more. Outlook Virtustream notes that cloud performance and security go hand in hand to complete a true enterprise cloud story. As the company continues to round out its enterprise-focused cloud capabilities, adding ViewTrust to its arsenal will go a long way toward bolstering its credentials as a contender in the space. Virtustream cofounder and CEO Rogers reports that the combined ViewTrust and Virtustream product team will focus its resources on three major initiatives in the coming quarters. First, the company intends to take the concept of what it does at the infrastructure layer around orchestration and apply it to the application level. Consequently, customers will be able to manage application upgrades, maintenance, etc. out of a portal. Second, it is looking to provide customers with enhanced self-service and self-registration capabilities. Last but not least, Virtustream will offer OpenStack as an underlying alternative for lightweight workloads. The goal is to take the xstream cloud platform's rich feature set and put it on top of OpenStack, and then leverage Enomaly's Elastic Computing Platform as the interface to connect OpenStack Nova/Neutron with xstream. Copyright 2014 - The 451 Group 4
Reproduced by permission of The 451 Group; 2014. This report was originally published within 451 Research's Market Insight Service. For additional information on 451 Research or to apply for trial access, go to: www.451research.com Copyright 2014 - The 451 Group 5