Computer Associates’ announcement last week that it plans to fork over $430 million for Netegrity is the latest sign that control of the identity management sector of the network security market is becoming concentrated in the hands of some of the industry’s biggest players.
Computer Associates’ announcement last week that it plans to fork over $430 million for Netegrity is the latest sign that control of the identity management sector of the network security market is becoming concentrated in the hands of some of the industry’s biggest players.
The buyout, expected to close within 90 days, adds secure Web access and provisioning technologies to the authentication, authorization and administration products in CA’s eTrust Identity and Access Management Group.
While observers have expected an industry shakeout, this deal came as a surprise because Netegrity posted solid financial results for the first half of the year and appeared to be trying to distance itself from other identity management specialists by making acquisitions. Earlier this year, Netegrity snapped up Business Layers to add provisioning and allocation software to a portfolio that already included authentication products.
CA says the Netegrity acquisition is part of its plan to concentrate more heavily on security products, which in accounting for 17% of new bookings this quarter represent one of the company’s hottest businesses. Identity management is one of the hottest segments in security, fueled by compliance concerns and the need to shore up internal systems.
“Identity management is simply too big and important of an issue for large, multinational enterprises to rely on a hodge-podge of products from small vendors, many of which have overlapped in functionality,” says Jamie Lewis, president at Burton Group.
Other big vendors targeting identity management include Sun, which last week responded to the CA/Netegrity deal by offering a free upgrade from Netegrity’s SiteMinder to Sun’s Java System Access Manager. Sun made an identity management company acquisition last year when it bought out WaveSet.
Also last week, IBM staged an event in Washington, D.C., to launch a batch of identity management services with partners. The new services are aimed at helping companies build and centrally manage systems for securing physical premises and virtual information repositories – from employee badges, door locks and security cameras to data, computers and networks. The technology bundle includes IBM’s Tivoli Identity Manager software, smart cards from ActivCard, fingerprint-based biometric verification technology from Bioscrypt, and public-key infrastructure software from VeriSign. GE is supplying components for facility security, and ImageWare Systems is supplying identification products for managing and issuing access-control credentials.
The IBM effort would seem to indicate that there continues to be room for vendors large and small in identity management.
“Our fate is controlled by ourselves – consolidation does not threaten our existence,” says Gordon Eubanks, CEO of Oblix, an identity management company whose name has been bandied about as a possible acquisition target of Microsoft. He says companies need smaller players to help them secure heterogeneous environments.
“Platform vendors are positioning themselves to say they do what we do, but when savvy customers take a closer look they see that the platform vendors fall short,” says John Aisien, vice president of marketing and business development for Thor, a provisioning vendor. “People are buying best of breed. They are buying the tools that they need.”
Nevertheless, CA’s Netegrity buyout is part of a plan to offer a full complement of identity management products.
“CA began increasing its focus on identity management a couple of years ago when it acquired a directory service, and they redoubled the efforts over the last year or so,” Lewis says. “They needed to acquire not just technology but market share. With Netegrity they get both.”
But CA will need to prove itself to Netegrity customers.
“Our initial concerns are only about price. CA has a reputation for raising costs on software,” says Steve Linstead, program manager for Johnson Controls, a Milwaukee supplier of automotive parts and building controls. Linstead uses Netegrity SiteMinder for access and password management, and is evaluating Netegrity’s IdentityMiner eProvision. “We don’t know enough yet about CA’s plans to make any product decisions,” he says.
Industry watchers advise CA to take a page from Sun’s playbook when it acquired WaveSet. Sun turned the decision-making over to the WaveSet team.
“CA should not buy it and gut it,” says Earl Perkins, a senior program director at Meta Group. “CA should consider merging with Netegrity rather than completely taking it over. The decision-making reins should stay with the Netegrity team.”
CA says it won’t put forth a combined product road map until the deal closes, but the pressure will be on to do so as soon as possible. IBM already has integrated and delivered products on two 2002 acquisitions, and BMC Software is set to announce improvements to its Control-SA identity management product suite by December.
Sun is attempting to exploit any uncertainty from CA.
“We think CA and Netegrity will be inwardly focused, trying to figure out their overlapping product lines and personnel, and won’t be looking forward, so we are offering a migration path,” says Sara Gates, vice president of identity management for Sun.
Senior Editor Ann Bednarz contributed to this story.
