Partners Question Future Margins As Cisco Absorbs IronPort

Cisco Systems Monday entered the e-mail security market via its completed acquisition of IronPort Systems, a move that has some IronPort partners wondering how long their healthy margins will last.

While Cisco's current strategy calls for keeping IronPort's channel separate from its own, IronPort partners said they expect their 20 percent-plus margins to become extinct once the products are inevitably opened up to the broader Cisco channel.

The $830 million deal, first unveiled January 4, brings IronPort's portfolio of e-mail security, Web security and security management appliances into the Cisco fold. The San Jose, Calif.-based networking vendor has dubbed the portfolio expansion "version 3.0" of its Self-Defending Network strategy.

The plan is to complement Cisco's existing deep packet inspection capabilities with the new content security capabilities afforded by the IronPort portfolio, moving toward what Cisco is calling "wide traffic inspection."

Over time, the companies' new joint roadmap calls for integration between IronPort's reputation technology -- part of its SenderBase service that tracks multiple metrics to determine the trustworthiness of URLs -- into Cisco's firewalls, said Scott Weiss, former CEO of San Bruno, Calif.-based IronPort, now vice president and general manager of Cisco's IronPort division. Cisco's Adaptive Security Appliance (ASA) and Integrated Service Router families should receive upgrades by year's end or early next year that add in IronPort capabilities, he said. "We'll increase the efficacy of SenderBase with data from Cisco firewalls," Weiss said. At the same time, customers will be better protected against threats such as spam because their firewalls and e-mail gateways will talk to each other, he said.

Solution providers said customers stand to gain tremendous benefits from a merging of the two companies' technologies.

"The potential to add productivity and ease of support is tremendous," said Bob Cohen, CEO of CGAtlantic, a solution provider in New York that works with both vendors.

For now, solution providers said they are heartened by Cisco's stated plans to let IronPort maintain a high level of autonomy, particularly in the way it runs its channel.

"I've been shocked at how autonomous they're keeping IronPort," said Tom MacArthur, principal of Storbase, an IronPort partner in Waltham, Mass., that is not currently a Cisco partner. "That's a standard mantra in mergers and acquisitions -- you hear it so many times -- but it seems to be the case."

IronPort's channel strategy is part of what made it so attractive, said Mick Scully, vice president of product management for Cisco's Security Technology Group.

"We're buying a business model, and a big part of that is IronPort's channel," Scully said.

NEXT: Partners Doubt Margins Will Last

Weiss said Cisco partners will be selectively admitted to the IronPort partner ranks in order to fill coverage gaps, but stressed that the product line will not be opened up to the Cisco channel at large, at least not now.

"We'll do it judiciously. Some have already been added and some have already been told 'no,' " Weiss said, estimating that about one-third of IronPort's roughly 250 partners have existing partnerships with Cisco.

Weiss also stressed that there will be no moves to force IronPort partners to add Cisco products -- security or otherwise -- to their line cards.

"Many of our partners are security specialists and carry many different security products that aren't Cisco. Are we going to be strong-arming them to pick up ASA when clearly they are a [Juniper Networks] Netscreen distributor? The answer is no," Weiss said.

IronPort partners said they're more concerned about their future profitability as the vendor gets absorbed into the Cisco universe and a broader swath of solution providers start hawking IronPort wares.

"I'd be an idiot not to be a little bit nervous longer-term," MacArthur said. "For me it's the corporate resellers: Once the [Software House International]s, CDWs and Insights get their claws in, I'm all done, or at least relegated to a consulting business."

One solution provider who asked not to be identified said IronPort partners' respite will be short-lived.

"I give it 18 months at best," the solution provider said. "[After that], everyone under the sun is going to sell it."

One move that could push Cisco to expand the distribution of its new IronPort portfolio is a potential move downstream into the SMB market.

"Cisco's brand and relationships could allow us to simplify the technology that's sold so well in the Global 2000 and push it down-market through new channel relationships," Weiss said, adding that plans are not yet definitive. "It certainly will have channel implications, but I just don't know what those will be yet."

For now, the channel implications are that solution providers stand to gain a stronger security offering once technologies from the two companies start to come together, but it remains to be seen whether IronPort partners will be able to take advantage by carrying both lines.

"There are a lot of great products there [in the Cisco portfolio], but the question is,can a boutique company like us make money? That's the challenge," MacArthur said when asked whether Storbase plans to add Cisco products to its lineup. "Everyone would love to work with best-of-breed products like Cisco's and make money on them, but it's tough."