NetApp To Acquire Data-Encryption Vendor Decru

In a bid to extend its storage business into the field of securing stored data, Network Appliance today said it will acquire Decru, a closely held provider of solutions that allow customers to apply strong encryption when storing, backing up and replicating data across different infrastructures and media.

NetApp will pay $272 million, of which 80 percent will be in stock and the rest in cash, for Decru--a high premium given the company is only expected to draw an estimated $30 million in the current fiscal year. Because Decru's technology is offered by rivals of NetApp, including Hitachi, EMC and Hewlett-Packard, NetApp will operate Decru as a separate subsidiary with its own sales force and OEM partner team.

Currently, 20 percent of Decru's revenue comes from NetApp implementations, so just as EMC keeps its VMware subsidiary separate, NetApp says it is in its interest to run Decru as a standalone business unit. Decru will be headed by founder and CEO Dan Avida.

Founded in 2001, Decru has emerged as a leading supplier of solutions that apply strong data encryption, authentication and access control to data as it is written to storage devices, without impacting network and read-write performance, which for years has been a barrier to the use of strong encryption technology.

"There's no lack of desire out there on the part of corporations to protect their data; it has always been the practicality of the deployment, and they've solved that problem," said NetApp CEO Dan Warmenhoven, in a Webcast announcing the deal. "We view this as a potential high-growth market, [and] Decru is certainly the market leader."

Among Decru's competitors are NeoScale, Vormetric and Kasten Chase, though Decru's technology is far more advanced than its rivals, Warmenhoven said.

"We concluded there was no one else of interest," Warmenhoven said in an interview with VARBusiness following the Webcast.

Warmenhoven believes that given recent high-profile data losses--most notably tapes containing data of 3.9 million customers that were lost in transit to a backup facility--will justify the premium paid for Decru.

"It's the solution the market has been crying out for, but no one has been able to deliver," Warmenhoven said.

According to Enterprise Strategy Group, 60 percent of companies never encrypt their backups; within the financial-services and health-care verticals, that figure is 65 percent and for government agencies it's a staggering 77 percent. In the wake of recent high-profile breaches, such as the Citigroup incident, 43 percent of customers are rethinking that strategy.

"The timing of this deal is particularly good," said ESG analyst Jon Olstik, on a conference call.

Warmenhoven said that NetApp distribution and channel partners will be able to sell Decru's wares as soon as the deal closes, which will likely be in the October time frame. He said it was not clear how that will impact IBM's agreement to resell all NetApp technology, given IBM has its own relationship with Decru.

"We will have those discussions in a few days," Warmenhoven said.

To be determined is whether other rivals, such as EMC and HP, will continue to offer Decru's products. Warmenhoven said he doesn't see a need to have separate channel partners for the Decru line since it is offered as a component of a solution, just as a SAN switch from the likes of Brocade or McData.

The deal was borne as the two companies were pursuing an OEM relationship. Just last week, both companies jointly announced a solution that allows for the storage of secure credit-card data with support for the Payment Card Industry, or PCI, standards. Those standards, currently being instituted by key payment firms including MasterCard and Visa, mandate that merchants and payment-processing providers use best practices to secure credit-card data.

Penalties for not instituting the proper controls can include fines of up to $500,000, among other things. The deadline for PCI compliance is in two weeks.

The solution launched last week is called CardVault, an appliance that includes Decru's DataFort appliances and the Decru Client Security Module (DCS) to provide a turnkey platform for secure processing and storage of credit-card data. CardVault, which can be used with NetApp's portfolio of networked-attached storage (NAS) and SAN products, uses strong AES-256 encryption.