Check Point Pays $205m for Zone Labs to Address Endpoints.

By Kevin Murphy

Check Point Software Technologies Ltd is to buy Zone Labs Inc for $205m in cash and shares as a means to beef up its offerings in endpoint security and SSL VPNs, areas where its rivals have been making strides recently.

The company will pay $113m cash and $92m worth of shares and adopt Zone's employee stock options to consummate the deal, which is subject to customary closing conditions and is expected to close in the first quarter.

Check Point CEO Gil Schwed said in a conference call that Zone will be operated as a separate division and will keep its brand. President Jerry Ungerman told ComputerWire Zone's products are an essential part of Check Point's 2004 product roadmap.

Zone is perhaps best known for its free and paid-for versions of ZoneAlarm, personal firewall software, which it offers to consumers and businesses. But recently it has been touting heavily its Integrity enterprise endpoint security system.

Integrity allows companies to enforce security policies such as patch level and anti-virus signature status on desktops across their network. Through integration with network devices, desktops can be blocked or quarantined if they are not policy compliant.

Schwed said this complements SecureClient, Check Point's virtual private network software, which often includes a network firewall component. The firewall component is the only major area of overlap, he said.

"There's very little overlap," he said. "We believe most customers buy Zone Labs' Integrity because they want a different level of security at the desktop, and most people buy SecureClient because they want remote access."

"We will maybe build a superset product," Ungerman said. "We think there is a longer term need for all of these functions in a single product."

The deal will aid Check Point in its strategy of expanding beyond its historical strength in perimeter security, where it dominated the stateful inspection firewall market but has recently seen its growth stall as rivals grow.

Endpoint security is seen as a growth area. Cisco Systems Inc, one of Check Point's chief competitors, bought Okena earlier this year to enter the market, and a few weeks ago announced the mid-2004 release of software that will compete with Zone's Integrity.

Bill Scull, senior VP of marketing at Zone rival Sygate Inc said he was "a little surprised" at the relatively low price paid for Zone - about seven times annual revenue, compared to recent acquisitions of private security firms at greater multiples.

Scull said this may point to nerves about the loosening of Zone's partnership with Cisco, and concerns about Microsoft's imminent entry into the personal firewall market, when it turns on those features in Windows XP.

"This deal puts Zone squarely in a camp," Scull said. "It leaves us as the leading independent endpoint security vendor. It gives us a lot of partnership opportunities [in the VPN market]".

Zone CEO Gregor Freund yesterday said the company is "absolutely committed to our existing partnerships and existing integration points". Ungerman said Check Point intends to continue working with Zone's partners, rivals or not.

Zone has also been partnering heavily with providers of SSL VPNs, including some companies that Check Point competes with, including NetScreen Technologies Inc (due to its acquisition of Neoteris Inc) and Aventail Corp.

SSL VPNs allow remote users to access corporate resources using SSL as the secure transport protocol, negating the need for IPSec client software. Integration with endpoint security software gives companies more confidence the access point is also secure.

Ungerman said: "One of the issues with standalone SSL VPN technology today is that the client is not secured - data is encrypted, but the client is not secure."

An Aventail spokesperson said: "We do not feel this acquisition will have any significant impact on Aventail." A NetScreen spokesperson said it's too early to tell what, if any, impact the Zone acquisition will have.

Schwed said in the conference call that obtaining access to Zone's 1,100 customers, many of which do not run Check Point firewalls or VPNs, creates a "great" opportunity to sell to those non-Check Point customers.

In terms of the deal's financial impact, Schwed said that it will be dilutive to earnings by one or two cents for the first three quarters of next year, but should be accretive to earnings by about the same amount in the fourth quarter.

Check Point hopes its new Zone division will experience 50% revenue growth in 2004, to $42m from the $28m it is expected to record in 2003. In the current quarter, about half of Zone's revenue will come from enterprise customers, Schwed said.

The deal will also mean that Check Point will have a sizeable consumer business for the first time. Check Point intends to keep offering the free ZoneAlarm product, as it creates brand awareness and acts as a good testing ground for new technologies.