Third buy's a charm for Microsoft security?

Microsoft's idea to purchase Sybari Software came from a place where many of its ideas are born--its labs.

Late last year, the software giant wanted to build on an important technology--the RAV antivirus software that it acquired from Romania-based GeCad--to take it beyond a desktop virus scanner to a security product for businesses. Rather than develop the extra software needed, the company looked to partners. Sybari's Antigen scanner for Microsoft Exchange e-mail and SharePoint collaboration servers seemed an obvious fit, because Microsoft's customers were already using it.

But as the development progressed in the labs, it became even more obvious that Sybari's product would make just as good an addition to the whole of Microsoft's security lineup, said Mike Nash, head of the company's security business and technology unit.

"Microsoft has come, as a company, to really believe in using what we sell and selling what we use," Nash said. "One company that we have used a lot is Sybari."

Signed and sealed

Microsoft has bought up key companies with an eye to offering security add-ons for Windows systems and company networks.

Sybari Software

Company: Based East Northport, N.Y. Privately held

Products: Software to filter viruses and spam on networks. Antivirus engine not included

Deal: Acquisition, pending regulatory approval

Date: February 2005

Plans: Antivirus and antispam tool for e-mail and collaboration servers

Giant Company Software

Company: Based in New York. Privately owned

Products: Software to combat spyware, pop-ups and spam

Deal: Acquisition, now a subsidiary

Date: December 2004

Plans: An anti-spyware product (in beta) for desktop Windows

GeCad

Company: Based Bucharest, Romania. Privately held, with 100 staff

Products: RAV antivirus engine

Deal: Sale of technology and intellectual property

Date: June 2003

Plans: Paid antivirus add-on for Windows; to integrate with Sybari software

On Tuesday, that seed culminated in the announcement that Microsoft will buy Sybari. It's the company's third security-focused deal in 18 months, and a sign that the company is getting serious about security. First, Microsoft silenced some gibes about the safety of its own products with its Trustworthy Computing push. Now, with the acquisitions, it has moved into position to become a player in the corporate security market.

Sybari slots in the final piece needed for Microsoft to create a software and services package to combat e-mail threats such as viruses, spam and spyware, said John Pescatore, an Internet security analyst at market research firm Gartner.

"They have all the pieces together now, but it is going to take a couple of years before companies will consider the offerings," Pescatore said.

With the purchase of GeCad in 2003, Microsoft picked up the technology and staff to develop an antivirus "engine," or core software that recognizes malicious code. When it picked up Giant Company Software in December 2004, it gained a network for gathering threat reports and anti-spyware programs for the desktop.

Sybari's Antigen software allows Microsoft's GeCad-based antivirus engine, and similar competing software, to be used to scan incoming e-mail and instant messages before they enter a company's network.

"Microsoft has already said that they plan to offer a service in the antivirus space," Pescatore said. "This gives them the ability to offer the product to enterprises."

The earlier deals gave Microsoft technology that it could fold into its core Windows operating system and Office products. But the Sybari

acquisition will give rise to stand-alone products, Pescatore said. The technologies will help Microsoft build components that can detect threats and distribute protection, both for consumer desktops and for corporate networks.

Incumbents in the security industry said that the Microsoft acquisitions do not change the landscape all that much.

Symantec, for example, believes that Microsoft's products are unlikely to support non-Windows systems, said Enrique Salem, a senior vice president in the security giant's network and gateway group. With its client companies clamoring for less-complex management products, the ability of Symantec products to manage all operating systems will be a key advantage, Salem said.

"Microsoft needs to protect their platform, which is what you see them doing," he said. "But enterprise security is much broader than the Microsoft platform."

Kaspersky Lab, which developed a version of its antivirus engine to work with Sybari's products, believes that Microsoft will continue to be more of a partner than a competitor, said Steve Orenberg, president of Kaspersky Lab's U.S. operations.

"We would hope that Microsoft would continue to offer Kaspersky as an option," he said. "Sybari users have a choice of antivirus engines, and they choose us for a number of reasons. We have hourly updates and rapid response."

Microsoft's move into the enterprise market is more threatening to Symantec and McAfee, argued Orenberg, because those companies compete directly with Sybari.

And Symantec, McAfee and other antivirus and security players have rested on their laurels too long, said Gartner's Pescatore. He said he believes that Microsoft's security strategy could disrupt the flow of antivirus subscriptions that were a cash cow for those companies last year.

"If the antivirus guys had been innovating over the last 10 years, there is no way that Microsoft could have done this," he said. "Instead, they have been living off their antivirus subscriptions. It's one of the (few) industries where the product does the same thing, but they have raised the prices."

Microsoft's entry into the antivirus subscription market could drive down prices--and profits--by 20 percent, Pescatore predicted.

Other analysts argued that the danger to Symantec and other bellwether security companies is not so great.

"The fact that they are Microsoft and they have an 'in,' doesn't mean they are going to be successful," said Gene Munster, a senior research analyst with investment firm Piper Jaffrey. "The situation sounds bad, and it may cause people that are buying products to wait. But at the end of the day, Microsoft is not going to compete as much as people think."

While the planned acquisition of Sybari has made Microsoft's plans for the corporate market clearer, the company's consumer plans still lack definition, Munster said.

"The big unanswered question is what they are going to be doing in the consumer space--and for that, we have to wait," he said.