May 20, 2010, 9:33 AM — Symantec will pay US$1.28 billion to acquire VeriSign's security business.
The two companies confirmed the rumored acquisition Wednesday, saying it would give VeriSign the opportunity to focus on its more-profitable domain name business, while allowing Symantec to broaden its growing portfolio of enterprise security products.
"There is a real need to be able to know who the user is and what they should have access to... but without the central theme of identity we weren't able to provide the total solution," Symantec CEO Enrique Salem said during a conference call to discuss the deal. "IT needs to be able to control the information, and identity matters to be able to provide that solution."
Reports surfaced Tuesday that VeriSign had been shopping around its encryption technology and service business, and naming Symantec as the buyer.
The VeriSign business unit sells SSL (Secure Sockets Layer) certificates -- used to authenticate secure Internet servers -- two-factor authentication tokens, fraud detection and public key infrastructure products for government and the enterprise. But the business has grown slowly of late, hurt by dropping SSL certificate prices, a fact that is reflected in the unit's low purchase price relative to its $371 million in annual revenue.
"If you want to succeed in that market you have to have a lot of services, the platform, large and growing distribution channels -- a lot of things that Symantec has," Mark McLaughlin, VeriSign's president and CEO, said on the conference call.
Salem said he and McLaughlin had been talking about a possible deal for more than a year, but that things heated up in the past few months when it became clear that Symantec could buy only the security arm of the company.
As the global economy has heated up in recent months, so too have security industry acquisitions. Last month, Symantec announced plans to spend $370 million buying two encryption companies: PGP and GuardianEdge.
Last year, security vendor SecureWorks bought VeriSign's managed security business for $42.9 million. VeriSign had also been shopping around its iDefense security intelligence business, but has now decided to retain it, McLaughlin said.
The deal makes sense for both companies, according to Lazard Capital Markets, a financial advisory firm. "With its broad security portfolio, Symantec should be able to extract more value from the VeriSign security business than VeriSign currently does," Lazard wrote in a research note published ahead of the official announcement Wednesday.
Symantec plans to merge VeriSign's SSL business with its own intrusion detection business, whose products are already widely used in the e-commerce space, according to Francis deSouza, senior vice president of Symantec's Enterprise Security Group. Symantec also plans to deliver a way of managing digital certificates in an upcoming release of the Symantec Protection Center, due a few quarters after that, deSouza said.
On the consumer side, Symantec will integrate the VeriSign Identity Protection (VIP) authentication service, used for two-factor authentication, with its Norton Identity Safe product line, creating a broader user-base for the VeriSign authentication services.
Symantec is also interested in the VeriSign Trusted services, used by Web site operators to certify that their sites are trustworthy. "You can expect to see additional security capabilities under the Trust seal and Trust services umbrella," deSouza said. Symantec, which acquired the VeriSign "checkmark" brand as part of the deal, plans to add things like Web site malware detection to these products, he said.
About 900 of VeriSign's 2,200 employees will move over to Symantec, and it appears there will be some layoffs too. "The intent is to have the majority of the team move over," deSouza said. "There may be some overlap as we look at the integration planning."
With the security business expected to go to Symantec by September, pending regulatory approval, VeriSign will be able to focus on moving into international domain name sales and expanding its network availability offerings such as DDoS (Distributed Denial of Service) attack mitigation services.
