Cisco acquires WheelGroup

Cisco Systems (CSCO) yesterday continued its push into the Internet security market, announcing that it will acquire WheelGroup for $124 million in stock.

WheelGroup is a leading player in the "intrusion detection" market, providing software that detects unauthorized efforts to break into corporate networks. Its software can detect both hackers trying to break in from the Internet and internal users snooping around in areas for which they don't have the proper authorization.

WheelGroup's software also can notify network managers that an attack is underway, and can be set up to block the attack.

As part of the $124 million stock deal, Cisco bought out BTG's 17.28 percent stake in WheelGroup for $21.4 million in stock. BTG bought its stake in the company for about $800,000, making a nearly 26-fold return on its investment. The stake will be exchanged for 328,325 shares of Cisco stock, which, at Wednesday's closing price of $65.50 per share, are valued at $21.5 million.

Networking giant Cisco's acquisition marks a step toward the convergence of the networking and Internet security markets, which Cisco signaled a year ago in unveiling its Cisco Enterprise Security Alliance.

McAfee's merger late last year with Network General to form Network Associates (NETA) was driven by the same convergence impetus, as was last year's move into the bandwidth-management space by top firewall vendor Check Point (CHKPF).

Intrusion detection has become increasingly popular in recent months, along with a related technology called "security scanning" that probes networks for security weaknesses, as unauthorized access becomes ever more commonplace. (See related story)

"[WheelGroup has] the best-in-class technology of all the vendors in the space," said Michael Safly, the Cisco business development manager who scouted the WheelGroup acquisition. For the short term, WheelGroup's NetRanger intrusion detection software and its Net Sonar security probing software will remain distinct products, but will be marketed via Cisco's distribution channels.

Longer term, Cisco intends to build intrusion detection into its core networking products, including routers and switches, Safly said. Cisco also sells network security access servers, called Cisco Secure, that allows system administrators to determine whether users seeking access to corporate networks or databases are authorized to sign on.

The acquisition immediately bolsters Cisco's security offerings, which currently include its homegrown PIX hardware-based firewall and the Centri firewall software for Windows NT, which Cisco acquired for $40 million last June, when it announced that it would incorporate virtual private network (VPN) technology from start-up RedCreek Communications into PIX.

"We can make networks that don't need firewalls by making a network that fundamentally defends itself," Safly said.

Cisco's acquisition could hurt the leading player in the intrusion detection software space, Internet Security Systems, which last month filed for an IPO. It also could pressure other security vendors with standalone security products as Cisco encroaches on their markets.

The deal also could force the hands of crossover players in security and networking, like Check Point and Network Associates. It even could register on the radar screen of Microsoft, which often partners with Cisco.

Under terms of the deal, Cisco will exchange 1.8 million to 2 million shares of stock to acquire WheelGroup, based in San Antonio, Texas. WheelGroup's revenues are estimated at between $5 million and $10 million.

Cisco will take a third-quarter one-time charge against after-tax earnings of 8 cents to 13 cents per share.