Why Forcepoint Acquired Bitglass

You might have missed it if you are in the United States and took a long weekend, but long-time security player Forcepoint acquired one of the few remaining independent cloud access security broker (CASB) vendors, Bitglass, on Monday.

Terms were not disclosed, but Bitglass had raised $150 million in four rounds of investment since it was founded in 2013, most recently a $70 million Series D round in 2019. It should come as no surprise to anyone who watches the secure access service edge (SASE) and CASB markets that Bitglass would be snapped up, but Forcepoint as the acquirer might be a surprise.

Forcepoint’s Backstory

Security firm Forcepoint has led an interesting corporate life but is not as well known as some of its peers. Originally formed in the mid-1990s as a network security reseller, by 2000 the company had started to develop its own products and was successful enough to execute an IPO during the height of the dotcom bubble. The company was then known as Websense, and for the next decade it would build out a suite of Web, email, and data loss prevention (DLP) security appliances, acquiring additional technology as needed along the way.

But by the 2010s, growth had stalled. FY2012 revenue was down year over year, driven by a drop in appliance sales. The company remained relatively profitable, however, and Websense was acquired by private equity firm Vista Equity Partners in May 2013. The purchase price was approximately $1 billion, which was less than three times Websense’s revenue.

Less than two years later, defense contractor Raytheon (NYSE: RTX) acquired an 80% share in Websense from Vista Equity Partners for $1.9 billion. (In 2020, Raytheon acquired the remaining 20% equity in the company for another $588 million.)

In January 2016 Raytheon rebranded Websense as Forcepoint and acquired the security appliance company Stonesoft from Intel Security (Nasdaq: INTC). The newly formed Forcepoint also included Raytheon’s existing security business. The goal was for Raytheon to generate the same success in commercial accounts as it had enjoyed as a leading defense contractor selling into public accounts.

In April 2020, however, Raytheon completed its merger with United Technologies. Raytheon began divesting non-core assets from various business units after that merger. In October 2020, Forcepoint was acquired by private equity firm Francisco Partners. Terms were not disclosed, but Washington Technology has reported that the pricetag was $1.5 billion. That would, of course, be a significant discount on what Raytheon paid.

Forcepoint Looks Ahead

So what is the plan for Forcepoint? The company reported revenue of $658 million (FY2019) before going private last year, and it currently has roughly 2,600 employees. Francisco seems confident that Forcepoint can remain competitive.

Since being acquired by Francisco, Forcepoint had already made several acquisitions before the Bitglass announcement this week. These include remote browser isolation vendor Cyberinc in May 2021 and anti-malware vendor Deep Secure in June 2021. Since January, it has also brought in a new CEO (Manny Rivelo) and new sales leadership in the USA (Peter Brant) and EMEA (Myles Bray). And in August 2021 it lured Rees Johnson over from Symantec (now NortonLifeLock, Nasdaq: NLOK) to be Forcepoint’s chief product officer. That seems a critical role for the company going forward.

As the Bitglass acquisition highlights, Forcepoint is betting on SASE to drive future growth. But how will it be bundled, extended, differentiated, and acquired parts integrated? These decisions will fall chiefly on Johnson. As described on Forcepoint’s web page:

“Johnson oversees the company’s entire portfolio including leadership of all product development, management and innovation as well as the strategic integration of the overall product and customer experience to empower Forcepoint’s global customers for success.”

Johnson is a good fit. He had most recently been SVP product management at Symantec but also had long stints at Intel/McAfee and Blue Coat.

One early indication of how Forcepoint plans to differentiate itself in the market is its positioning as a “Data-First SASE” provider. Forcepoint feels strongly that the long, and admittedly impressive, history of its DLP technology can be successfully leveraged throughout its SASE portfolio. This will no doubt extend to its new Bitglass products, although given overlap in portfolios, we would expect some Bitglass products (e.g., secure Web Gateways, or SWG) to be retired.