Competitors are publicly happy about Computer Associate’s
$430 million acquisition
of Netegrity , but
there might be a hint of trepidation over the combination of the two
security software players.
Less than a day after officials at the Islandia, N.Y., company announced the
acquisition — which pairs CA’s eTrust Identity and Access Management suite
with Netegrity’s Web access software — it seemed everyone with a stake in
the network identity management industry had something to say.
“They can talk like they’re happy about it, but I think a lot of that noise
is nervousness on their part,” said Earl Perkins, a senior analyst with META
Group, a research firm of which Netegrity is a customer. “And it’s mainly because it’s
confirmation that the market continues to consolidate, and over time it’s
going to squeeze.”
Sun Microsystems immediately announced a migration tool
targeting SiteMinder customers — Netegrity’s flagship Web access,
single sign-on (SSO) product — to its Sun Java System Access Manager, which
is free to SiteMinder customers.
The migration tool has been around for some time, said Sara Gates, Sun vice president of identity management, and it
was used earlier this year to bring Blue Cross/Blue Shield over from SiteMinder to
Access Manager.
Gates said the company is willing
to forgo the $5 to $7 per user they could charge for an Access Manager license
to give it the chance to up-sell these new customers to their Identity
Manager and Directory Server software applications.
“People are making broader identity management architectural decisions,” she
said. “That’s how we make money; we get them with their access management
environment migrated and then we offer them the chance to upgrade to
market-leading products in the other two categories in this market.
Officials at Oblix, one of the best-of-breed companies in the space that
provides identity and Web services management software with Netegrity and which is
closely partnered with Microsoft , said Netegrity had
reached the end of its rope and needed the CA buyout to save itself.
“Netegrity was great in the single sign-on business, but once the market got
redefined to be a broader set of capabilities that define the identity
management business, Netegrity went off focusing on portals and all the
other stuff and really kind of missed the boat,” said Prakash Ramamurthy,
Oblix vice president of products and technology. “Once they milked all the
install base they had to go and win new customers, we were beating them
head-to-head in all these identity deals, even with existing SiteMinder
accounts.”
Over the past
10 months, Netegrity has been downgraded by 21 investment firms, including
J.P. Morgan Chase, Goldman Sachs, AG Edwards and UBS Warburg.
But according to META Group’s Perkins, Netegrity’s business plan was sound and its
executives had a good growth strategy in place before the buyout, garnering
more than 700 customers to its SiteMinder product alone.
“In the Web access management market, of which Netegrity was the leader —
and in most markets like that which are relatively mature — you’ll always
see signs of decay or pressure around the edges of the leaders,” he said. “When you’re
king of the hill, there will always be someone on the lookout for whether
there are rockslides or whether someone’s getting tired at the top.
Certainly, on a quarter-by-quarter basis, you’ll notice there’s
going to be slippage, but overall Netegrity’s performance in terms of its
customer base, its growth, its technological capabilities — they looked
pretty sound.”
Sun’s Identity Manager, along with IBM’s Tivoli Identity
Manager, Novell’s Nsure and, even to an extent,
HP’s Select Identity represent the “stack,”
companies with a suite of security software management applications, of
which identity access and management is just a part. CA’s acquisition of
Netegrity, Perkins said, puts it in the same company as the
other stack providers.
HP officials quickly pointed out the technology merger problems the company
faces with Netegrity’s addition to the CA eTrust portfolio, mainly the
combined company’s need to resolve two entirely separate identity
provisioning applications.
“Customers with either solution should be worried about the supportability
of their installations, because there is no obvious functional integration
between the two,” company officials said in a statement. “Regardless of
what the converged roadmap looks like, let alone when it will be executed,
their customers will undergo extensive disruption to their business
continuity and expensive migration and convergence costs.”
Perkins concedes the point, saying stack vendors are now coming out with
second-generation identity management tools, and CA is going to need to
integrate quickly or miss out with customers. He said IBM-Tivoli is coming
out with a revamped product that incorporates its acquisition of Access 360
a couple years ago, while BMC Software is getting ready to
launch a top-to-bottom revamp of its Control-SA identity management software
suite.
He also said developers for the two companies will have problems combining
CA’s eTrust Admin with Netegrity’s IdentityMinder eProvision.
“CA’s facing the challenge of saying, ‘one of you has got to go right now,’
or figuring out a marketing way of selling both of them right now,” he said.
“As far as the overlap with the other suites, there’s not that much of an overlap.
I think they can easily fit those into the eTrust suite and it wouldn’t be
that significant.”
Toby Weiss, CA’s senior vice president of product management and marketing
for eTrust solutions, doesn’t think the existence of eTrust Admin and
eProvisioning will create the problems Perkins fears, saying there’s room
for both.
“I think that makes certain assumptions there,” he said. “You know, if you
look at the mainframe where we have ACF2 and Top Secret, we have two
[similar] products on the mainframe.”
In regards to HP’s sour integration pronouncement, Weiss is equally
unconcerned, pointing out there were many CA customers using Netegrity
products and vice versa in the past with no integration problems, primarily
because most vendors have integration tests that they conduct beforehand.
“What it reads to me is a couple things,” he said. “One, they recognize
that Netegrity is the leader in that space and clearly going after the
leader. And two, from what it sounds like, they don’t have any integration
with Netegrity. My experience from customers is customers always prefer
integration.”
