Cisco Takes Security Beyond the Enterprise Network With $2.35B Duo Buy

Cisco plans to buy Duo Security for $2.35 billion, to help enterprises provide secure access by users wherever they are -- even scary users with personal devices on public networks.

Duo's technology provides unified access security through multi-factor authentication, to verify the identity of users and the health of their devices before granting access to applications, Cisco Systems Inc. (Nasdaq: CSCO) said in a statement announcing the deal Thursday morning. The technology applies to traditional enterprise networks as well as users accessing applications from public networks. (See Cisco to Buy Duo Security for $2.35B.)

Cisco expects the acquisition to close during its fiscal 2019 first quarter, which ends in October. Duo will continue to be led by Dug Song, co-founder and CEO, and the company will join Cisco's Networking and Security business led by EVP and GM David Goeckeler, Cisco says.

Cisco's security business grew 11% in its most recent quarter, ending in April, almost triple the company's overall growth. But security comprised only 4.7% of total sales. The bulk of Cisco's business is still equipment sales, such as switches and routers. (See Cisco: Revenue Slump? What Revenue Slump?)

Figure 1:

Now entering its fifth year, the 2020 Vision Executive Summit is an exclusive meeting of global CSP executives focused on navigating the disruptive forces at work in telecom today. Join us in Lisbon on December 4-6 to meet with fellow experts as we define the future of next-gen communications and how to make it profitable.

Duo's security, offered as a service from the cloud, provides user authentication, device authentication and applies policies based on those factors and the apps that a user is trying to access.

Users log in using two-factor authentication, with Duo supporting tokens, SMS, call-back touch ID and face ID. Duo identifies whether the user is coming in on a device that's owned and managed by the enterprise, or on some kind of third-party or BYO device. Duo knows whether the user is coming in on the enterprise network or an outside network. And Duo knows whether the user is trying to access harmless information or high-security applications.

Duo then combines all that information to apply security measures as appropriate, Song says. For example, the network can apply light security to a user accessing the company cafe menu, but strict security to users accessing ERP or financial information, Song says.

Duo can even extend network access controls to users who are not employees of the enterprise, such as customers, partners and suppliers, Song says.

Duo focuses on simplifying security for both end users and enterprises. The company's service is designed to make security easy and therefore encourage users to do the right thing and abide by good security practices and policies. By making security easy, users are less likely to engage in practices such as using public file-sharing services that actively undermine and circumvent policies, Song says.

For example, if a user is coming in on the company network, from a company-owned and managed device, IT can set policy to reduce the frequency with which the user needs to use two-factor authentication to validate identity. "These kinds of affordances make the right thing to do the easiest thing to do in terms of user experience," Song says. "We're thinking very deeply about the individual experience that people have to live every single day, and making it as rich as possible."

About 30% of Duo's sales are currently through the channel, and the company expects channel sales to grow following the Cisco acquisition, Song says.

Duo is privately held, has about 700 employees, and is based in Ann Arbor, Mich., with plans to stay there after the acquisition. Founded in 2010, the company raised about $119 million in venture capital, with investors including Meritech Capital Partners, Lead Edge, Benchmark Capital, Google Ventures and True Ventures.

Under the terms of the deal, Cisco will pay $2.35 billion in cash and assumed equity awards for Duo's outstanding shares, warrant and equity incentives on a fully diluted basis, Cisco says.

Related posts:

— Mitch Wagner Executive Editor, Light Reading