Perimeter eSecurity Adds Services

Doug Howard is the acquisition guy, so he was able to explain not only what services the company has added, but also why and how.

by Alex Goldman ISP-Planet Managing Editor [June 12, 2008]

About nine months ago, I wrote (see Editorial: State of the ISP Industry) that the biggest companies in the industry are making acquisitions, but those acquisitions are not about market share. Companies are acquiring skill sets rather than customers.

Milford, Conn.-based Perimeter eSecurity is a case in point, and I'm lucky to be speaking to the acquisitions guy, Doug Howard, chief strategy offer of Perimeter eSecurity and also president of its usa.net subsidiary, which specializes in e-mail hosting.

"We bought usa.net in Q4, 2007," says Howard. "It's a market leader, and represents about 25 percent of our overall revenue."

Howard's the person who decides whether to buy or build. "Anything we build, design, or integrate falls under me. The CIO and the CTO report to me, and I also make decisions about mergers and acquisitions. We make about one acquisition per quarter and have a strong preference for acquiring versus building or partnering."

"When we look at a market, we look first to see who the players are in the marketplace. If they are of reasonable size, we then look at the pricing options."

The company also checks to see which companies follow three basic principles: 1) offer secure services 2) offer redundant services, and 3) offer services to which Perimeter adds value with its compliance offerings.

Howard says that Foundstone (which is owned by McAfee) and Qualys are, in compliance services, "the giants we compete with."

Threat management
Thus a recent acquisition: Phoenix, Ariz.-based Edgeos. The company already had a good business in a competitive market.

"The bigger guys are fairly affordable per scan but scanning devices cost between $1,500 and $3,000 each per year," says Howard. "That's just the hardware, not the per scan fees. Edgeos offers a SaaS service—download a client to any server or PC and run within the customer's environment. Most scans are after hours when assets are idle. Since there's no device, costs are reduced by at least $1,500 year."

Larger customers, it turns out, benefit too. "A byproduct that we did not realize we would enjoy is that many large customers have so much segmentation in their networks that they may require as many as 50 scanners. Even with volume pricing, that's about $1,000 per device. Multiply it by 50, and we're saving large clients a considerable amount of money too."

Edgeos was in one data center. Perimiter has added one instance in Raleigh, North Carolina, and will add another in Connecticut later this year, giving it redundancy and an expanded footprint.

Edgeos complements Perimeter's compliance business nicely by focusing on the smallest customers, tier 4 merchants doing PCI compliance.

Edgeos has an additional specialty: HIPAA compliance. "They worked with large health care entities and built customized health care scanning, not just at the device layer, but also at the application layer."

Building it wasn't trivial. "Once you go beyond common interfaces, at the web and OS level, you have to custom build scans."

Backup
Earlier this year, Perimeter announced the release of remote backup and recovery (RBR), a product the company built in house. Perimeter had searched for an acquisition target, but found none.

Howard says that prices are falling dramatically in the business. Many companies are realizing revenues of between $8 per GB and $15 per GB, but prices are headed toward $1 per GB to $6 per GB. If Perimeter purchased a company, it would expect to see per customer revenues drop fast. The acquisition would lose value fast.

"We felt forced to build it ourselves, from a financial perspective, and we did so."

Howard's proud of what the company built. "We buy so many companies that our engineers had a chip on their shoulder and decided to build the best and most cost effective solution they chould."

It certainly has all the features. It encrypts data before transmission (something everyone should do but not everyone does). It allows user only access or user plus admin only access. It has search and compression features. It works with a wide variety of files. And, Howard says, it competes well on price too.

Retaining skills
Buying or building, a company has to retain the skills it uses. In acquired companies, Howard says, Perimeter retains 94 percent of the people, and the remaining 6 percent who leave include leaders who cash out.

When building a new product, the setup, Howard says, "is two or three smart guysand a pod. They become their own small company. They have to show me there's a demand. But you can only get so many smart guys organically. When you buy a company, you pay more than you would for a pod of people, but they're already doing it. They've proven the business model. You pay more but you reduce risk and you gain momentum."

Selling through the channel
And now the story comes back to you, the ISP. "In the past," Howard says, "we sold about 25 percent of our services through the channel. The goal is 40 percent. We consider ISPs a primary sales distribution channel. They know they need to add incremental value and stickiness to what they offer."

Perimeter can allow the ISP to own brand the offer, but sometimes, Howard says, the ISP would like to co-brand the product, adding Perimeter's specialist credibility.

— End