Blackberry sells Cylance to Arctic Wolf for $160M

Blackberry Ltd. is selling Cylance to Arctic Wolf, seven years after it bought the endpoint detection and response vendor for $1.4 billion.

Arctic Wolf announced on Monday that it agreed to acquire AI-powered endpoint detection and response (EDR) vendor Cylance for $160 million in cash and approximately 5.5 million common shares of Arctic Wolf. Blackberry purchased Cylance in 2018 for $1.4 billion to expand its enterprise security presence.

In a press release, Arctic Wolf said the acquisition will bolster its EDR offerings as organizations face increasingly disruptive threats. For example, several vendors, including SentinelOne, warned that ransomware groups are adapting to EDR tools as attackers learn to bypass security products. 

Blackberry will receive $80 million in cash when the deal closes, and $40 million in cash one year after it closes. It is expected to close in Blackberry's fourth fiscal quarter, according to the press release.

Blackberry sent the following statement to Informa TechTarget Editorial:

We're incredibly pleased with this outcome for our Cylance business. As discussed at our Investor Day, this will help drive BlackBerry's profitability and allow us to focus on the growth engines in our portfolio. Arctic Wolf will strengthen its position as a market-leading security operations provider, delivering outcomes that matter in one, frictionless platform, allowing our customers and partners to continue to benefit from world-class, AI-driven prevention and detection delivered at scale.  We look forward to partnering with Arctic Wolf as a shareholder and as a reseller of the portfolio to our large government customers around the world.

Dan Schiappa, chief product and services officer at Arctic Wolf, said the acquisition reflects the company's commitment to redefining how organizations combat cyber risk. He told Informa TechTarget Editorial that Cylance will help bolster the company's Aurora platform, which provides EDR tools.

"Arctic Wolf will now have a native solution built into the Aurora Platform to not just detect and respond to threats on the endpoint -- where 95% of the investigations conducted by our security operations center include telemetry from -- but to prevent them as well, while remaining true to our open-platform, vendor agnostic approach that supports more than 15 different endpoint security vendors today," Schiappa said.

John Grady, principal analyst at Informa TechTarget's Enterprise Strategy Group, said it's not surprising that Blackberry chose to move on from Cylance. Cylance did not meet the expectations Blackberry had when it acquired the EDR vendor seven years ago, he said.

"Cylance has continued to lose money, and as much as Blackberry has tried to double down on cybersecurity and prop up the Cylance brand, there just hasn't been much traction," Grady said. "The fact that 5-plus years later the assets are being sold for only $160M really points to how bad a deal the original acquisition was."

Grady added that the purchase is low risk with some upside for Arctic Wolf.

"Arctic Wolf has been a proponent of the open XDR model, so this will give customers an option for a native endpoint presence through Arctic Wolf if that's what they prefer," he said.

Cylance was founded in 2012 and quickly became one of the more well-known and coveted startups in the cybersecurity industry, thanks to the company's AI technology. But Cylance struggled in an increasingly crowded threat detection market. For example, in 2019, researchers with Australia-based Skylight Cyber r discovered a way to bypass Cylance's threat detection .

Blackberry began as a mobile device manufacturer but made many purchases, including Cylance, over the past six years to expand as a cybersecurity company. In 2020, shortly after it purchased Cylance, infosec experts noted potential branding problems with Blackberry's transition from phones to software.

Arielle Waldman is a news writer for TechTarget Editorial covering enterprise security.