In the biggest acquisition in its nearly 39-year history, networking giant Cisco Systems Inc. today announced a deal to buy the cybersecurity and data observation and analysis company Splunk Inc. for $28 billion.

The move catapults Cisco, best known for its networking gear as well as other data center equipment, even higher in the ranks of leading cybersecurity companies. In recent years, the famously acquisitive company has been buying a series of companies in the market.

Cisco faces a huge array of cybersecurity companies, including a few large and similarly voracious rivals such as Palo Alto Networks Inc., CrowdStrike Holdings Inc., Check Point Software Technologies Ltd., Fortinet Inc. and Zscaler Inc. in addition to some of the largest software and cloud computing companies such as Microsoft Corp., Amazon Web Services Inc. and Google LLC.

San Jose-based Cisco will pay $157 a share for Splunk, a 31% premium to the San Francisco-based company’s closing price Wednesday. The deal is expected to close in the third quarter of next year.

Investors weren’t entirely thrilled with the deal, as Cisco’s shares fell 4% in early trading, while Splunk’s stock jumped more than 21%.

For years now, the cybersecurity industry has seen both a lot of startup activity as well as many mergers and acquisitions as cyberattacks have grown in number and scale and customers seek to improve their defenses with streamlined cybersecurity tools. Also today, Palo Alto Networks was reported to be negotiating the acquisition of Talon Cyber Security for $400 million. Earlier this week, CrowdStrike acquired Bionic.ai.

Cisco Chief Executive Chuck Robbins (pictured) emphasized in a blog post and conference call this morning the value of the combination of Cisco’s and Splunk’s data, especially in helping businesses “move from threat detection and response to threat prediction and prevention, making organizations of all sizes more secure and resilient.”

“Together, we will become one of the largest software companies globally,” Robbins said on the call. “With hyperconnectivity, AI and increasing cyberthreats, the value of data only increases, and that’s why this deal makes sense.”

More specifically, Robbins said he sees a neat fit between Cisco’s extended detection and response or XDR, offering, which became generally available Aug. 1, with Splunk’s security information and event management, or SIEM, offering, to help customers predict and prevent threats before they happen. He also sees a fit between Splunk’s data and platform and Cisco’s AppDynamics and ThousandEyes capabilities it acquired years ago.

Forrester Principal Analyst Allie Mellen said the acquisition is a “massive win for Cisco’s security business” but added that success will depend on what Cisco does with it. “Cisco has long been a case study for acquisitions that don’t live up to their initial promise and suffer from underinvestment and a lack of focus,” she said, though she noted that Cisco has maintained its Duo Security Inc. acquisition from 2018.

In the short term, the uncertainty the deal brings to Splunk and Cisco customers could benefit rivals. “This is a boon for Microsoft’s SIEM business with Sentinel,” Mellen said. “Users will flock to or expand their Sentinel deployments as they hedge their bets between where Cisco takes Splunk and where Microsoft takes Sentinel. Other smaller players will emerge to feed off this uncertainty for security teams.”

Indeed, rivals are already circling. “What we’re starting to witness is a fundamental shift in the market — older log analytics, monitoring and APM [application performance monitoring] companies are giving way to observability,” Jeremy Burton, CEO of Observe Inc., which calls itself the observability cloud. “These legacy companies are shackled by outdated architectures, and are ill-equipped to address the challenges posed by modern distributed applications.”

Burton said recent acquisitions of industry giants such as Sumo Logic Inc. and New Relic Inc. indicate that pivots to observability haven’t worked well. “In such cases, private equity firms or strategic partners step in to extract value from their existing customer base, while innovation is dormant,” he said.

Robbins emphasized the way the deal could help boost use of generative artificial intelligence, a field that has exploded with the advent of highly capable chatbots such as OpenAI LP’s ChatGPT, in cybersecurity and observability. “On top of the data and security challenges, Generative AI is rapidly transforming industries and creating new opportunities,” Robbins said in a blog post. “Together, Cisco and Splunk see a broad range of data across applications, security and the network. With the scale we bring and a deep foundation of trust, we believe we’re very well-positioned to provide customers visibility to their data and enable them to take advantage of the many opportunities with AI.”

Although Cisco sought to pitch the acquisition as a play to participate more in generative artificial AI, neither company is seen as a leader in the field and it’s not yet clear how the combination specifically will advance those ambitions. “Splunk and Cisco are behind on their use of AI and the current architectures of the products do not lend themselves to immediate competitive advantage, in particular with some of the independent and hyperscale security competitors,” said Rob Strechay, an analyst with SiliconANGLE and its video unit theCUBE.

That said, generative AI is seen as both a potent new tool for cyberattackers and, eventually, an equally potent tool for defenders. And the more data that can be applied, the more effective generative AI large language models can be.

Moreover, every company today sees the need to incorporate generative and other AI technologies into their products, and they’re hungry for additional data to feed AI models to improve their performance. The additional data that Splunk — the leader in observability, the practice of measuring computer systems’ state using data such as logs — would add massive amounts of new data.

“The last year has seen AI explode and Cisco wants to be one of the premier AI companies,” said Zeus Kerravala, a principal analyst at ZK Research. “To do this, it needs data. It has lots of network data but very little ‘up the stack.’ Splunk gives them a massive amount of data to use to improve its full-stack observability story but also security, which is the biggest needle-moving opportunity for Cisco.”

Robbins mentioned last quarter that Cisco has taken a half-billion dollars’ worth of orders from hyperscaler companies for networking infrastructure for AI.

Strechay noted that there’s not much overlap between the two companies, so the integration shouldn’t take long once the deal is closed. He noted that Splunk could mesh well with ThousandEyes and AppDynamics.

One analyst noted in the conference call that Splunk has been seen as lagging in moving to the cloud, still getting much of its business from its on-premises data center products, and questioned why Cisco didn’t opt for smaller acquisitions of companies with more modern architectures. Robbins said corporate security operations centers still depend heavily on Splunk products and in fact have said they want Splunk to maintain a significant on-premises capability.

Cisco said it expects the acquisition to be “cash flow positive and gross margin accretive” in its first fiscal year after closing, and accretive in adjusted earnings per share in the second year, as well as accelerate revenue growth and gross margin expansion. Cisco also said it expects the merger to add about $4 billion in annualized recurring revenue, providing a boost for its efforts to grow its subscription revenue.

Photo: Robert Hof/SiliconANGLE