Intel + McAfee: Game Changer or Disaster Waiting to Happen?

While an acquisition of McAfee was hardly a shock (it has been on the cards for some time) the acquirer did come as something of a surprise. I am sure we can all think of at least one - if not more - suitors who would have been a better fit for McAfee. Mind you, what does McAfee care? Payday is payday...

Intel obviously wants to improve the security posture of its products and can gain some good R&D from McAfee to help with this. However there appears to be very little synergy between the two companies. They have different customers, different routes to market, different cultures. Intel development cycles are measured in years, whilst McAfee needs to be able to react quickly. There are no channel benefits, no new market opportunities, and not a whole lot of revenue enhancement. And to cap it all, Intel has never really demonstrated that it actually understands the software business. Or the security business for that matter - look what happened to LANDesk and Shiva.

The biggest area of speculation is over whether it is feasible for Intel to build in EPP-type protection into its silicon, since this would provide the most exciting outcome from this merger (though one in which the anti-trust folks would doubtless take a long hard look). How feasible it is to embed security at such a low level – given that silicon is relatively fixed and security products need to be able to change on almost a daily basis – remains to be seen. Low-level capabilities with APIs and firmware hooks are probably the way to go here, though other security vendors will presumably be able to exploit those as well (if not, the lawyers will have a field day).

Clearly given the recent acquisition of Wind River Intel also has its eye on the embedded/mobile market - which is going to be huge(r) - and the McAfee acquisition could dovetail quite nicely with this, as well as giving a boost to Intel's vPro platform. But if this is all Intel wanted, it could have paid a lot less for a smaller company with better technology and less baggage - but that company would not have had the McAfee brand name, of course, which will be important as Intel chases a diverse range of customers for its new security technology!

And there is always the little niggle that in the mobile world, vendors such as Apple, RIM and Microsoft have control of the platform - and therefore the security - not the chip makers. Additional layers of security can't harm, but it is unclear whether they are as necessary as in the PC world. To date, users have been unable and/or unwilling to pay for additional security software on smartphones (Apple, for example, will not permit the use of key system calls required by antimalware vendors under the terms of its SDK).

While there is undoubtedly some intellectual property and R&D at McAfee that will be able to help Intel in its goal of offering more security features in its chipsets and related software utilities, it is unclear why it felt it needed to own McAfee to deliver this. It was already benefitting from an established partnership, and given that Intel clearly paid full value then it is obvious that it REALLY wanted this to happen – perhaps it is a defensive move to prevent others getting their hands on a key partner? Either way, almost $8 billion is a lot to pay for McAfee.

The first fruits of this union are slated to be delivered some time in 2011, apparently based around exposing limited security capabilities built into existing Intel chips. Integrating EPP-type security into silicon, if feasible, will take much longer.

One area which worries me is that I do not see where the network infrastructure security product line fits into Intel’s plans. I am hoping that IntruShield, one of the market-leading NIPS products, is not left to languish in the bowels of Intel and die a slow and painful death (McAfee assures me it won't since, it (McAfee) will continue to operate as a separate business unit). Intel could tinker with IntruShield, of course, by swapping out the network processing hardware for their own (if it is not already in there!) and replacing custom silicon (ASICs/FPGAs) with generic Intel processors. This could revitalize the IntruShield product line or it could finish it off altogether. If they have no clear strategy (and if they have, then why put McAfee in the Software & Services division?) it would be better if they spun it off into a separate company or sold the technology to an interested third party.

Bottom line: while in the long term this acquisition may benefit Intel in its fight with ARM for the embedded processor market and even AMD in the PC market, it is fraught with potential pitfalls for McAfee’s existing customers if the company gets distracted in a very competitive market.

New McAfee enterprise clients and existing ones coming to the end of a refresh cycle will be looking long and hard at how focused they think McAfee will be on their business in the next 12 months. The fact that this comes hot on the heels of the recent flawed security update which crippled thousands of corporate PCs will not help matters. Symantec, Sophos and Trend Micro (amongst others) must be rubbing their collective hands in glee right about now.

But perhaps the bigger questions are: will other chip manufacturers feel they have to follow suit to keep up with Intel? Or is Intel about to go on a security shopping spree? And which security vendor will be the next to be snapped up?