DevSecOps acquisitions follow enterprise IT shift

IT security specialists combine

Cloud-native security company Okta's $6.5 billion acquisition of Auth0, first publicized in March and completed in May, is a good example of a vendor driven to appeal to developers.

Okta established itself among enterprise DevOps organizations concerned with distributed IT infrastructure as they moved to cloud computing. Auth0's tools also handle access to cloud resources but focus on helping developers integrate their applications with identity management providers.

Financial ratings company Moody's used Okta's Advanced Server Access, single sign-on (SSO) and multifactor authentication products over the last three years to maintain security amid a cloud migration, transition to containers and its own M&A activity. Most recently, the company used Okta's SSO tools to accommodate a shift to remote work during the COVID-19 pandemic.

George Kurian

"We've done a lot of work with different use cases and Okta," said George Kurian, senior vice president of cybersecurity services for New York-based Moody's. "Now we're working on unifying our application development, single sign-on ... and mobile experiences."

Kurian hadn't decided whether to use Auth0 as of early April, but said he was open to considering it in the future.

"Auth0 gives me a nice toolkit to [connect] into my application, so my developers don't have to figure out how to do it," he said. "We don't have a lot of public-facing apps ... [but] there are some products like Moodys.com, and some of the new environmental websites that we're setting up, that it would be useful for."

Elsewhere, the increased popularity of Kubernetes for cloud-native applications brought security vendors together from adjacent areas of container-based infrastructure. Aqua Security acquired  infrastructure-as-code security player Tfsec in July, while Sysdig folded in infrastructure-as-code security tools from Apolicy.

IT security and monitoring merge into observability

Sysdig, founded in 2013 as a container monitoring platform, was among the first such vendors to add security monitoring to its products -- a combination that's increasingly the norm.

Sumo Logic, originally a cloud-based log monitoring vendor, has followed a similar path. It acquired security analytics company JASK last year to add to its security information and event management (SIEM) software. This year, Sumo acquired security orchestration, automation and response software vendor DFLabs. Application performance monitoring vendor Datadog also expanded its security features with the acquisition of Sqreen in February.

For existing users of these monitoring products, acquisitions can be a double-edged sword, depending on how much the acquisition overlaps with tools that customer already has.

"The level of effort for us to change tools is pretty high," said Andy Domeier, senior director of technology operations at SPS Commerce, a Minneapolis-based communications network for supply chain and logistics businesses. "The value proposition is harder to explain for an existing customer you're trying to get to switch as opposed to a brand-new customer."

However, as a Sumo Logic customer, JASK has been a welcome addition, Domeier said.

"We were in the market specifically for that technology," he said. "In that scenario, we would love to use Sumo Logic. Why would I want to shovel the logs into yet another tool for SIEM?"

Sysdig's expansion also includes cloud security posture management (CSPM), a growing category, where future consolidation is also likely.

Fernando Montenegro

"Some vendors are looking to take a broader view of overall enterprise risk management," said Fernando Montenegro, an analyst at 451 Research.

Security shifts left -- and right

With DevSecOps, IT organizations integrate application security into the DevOps delivery process much earlier. In response, security automation software vendors snapped up security test automation vendors, as with Palo Alto Networks' acquisition of Bridgecrew, completed in March.

CI/CD vendors such as JFrog shifted left and built such tools into application release pipelines directly. More recently, these vendors have also begun to "shift right" to send production data to developers so they can prioritize fixes. JFrog took a step into this realm with its Vdoo buy in June.

Meanwhile, GitLab users anticipate the company's acquisition of artificial intelligence/machine learning (AI/ML) vendor UnReview in June will eventually have DevSecOps implications. UnReview identifies appropriate code reviewers during the software development process and controls code review workloads.

"Having the tool identify experts in specific coding areas will eliminate a lot of the delay in finding the appropriate resource," said Doug Rickert, senior product security manager at Here Technologies, a location services and mapping company based in the Netherlands. 

Finally, DevOps infrastructure platform vendors such as VMware and Red Hat are building in security automation capabilities. Red Hat was among the vendors that kicked off this year's M&A spree with its acquisition of Kubernetes security vendor StackRox in January. Red Hat parent company IBM recently acquired BoxBoat, which is working with the Department of Defense on container-based software supply chain security. In March, VMware revealed plans to add security policy features acquired with Mesh 7 to its Tanzu Kubernetes platform.

"When something becomes an expectation in the market, big vendors begin to tuck it into their offerings," said 451's Kennedy. "DevOps has been around for a while now, and cloud-native, container-based applications, so now security features are expected."

Beth Pariseau, senior news writer at TechTarget, is an award-winning veteran of IT journalism. She can be reached at [email protected] or on Twitter @PariseauTT.