It should come as no surprise to anyone that Symantec’s recently fired CEO Steve Bennett’s strategy of cut costs and improve operations has failed miserably. As I wrote when Symantec’s board replaced then CEO Enrique Salem with Bennett, in the IT security industry innovation far outweighs the usual business practices of accounting, inventory control, and workforce “optimization.” At the time I warned:
“Watch out as reality sets in. I have seen this played out over and over in the security space as grown-up management is brought in. They bring discipline, focus, and, operational discipline. But because they do not understand the security space the company starts a slow decline into oblivion.”
A financial analyst made the comment: “The combination of consistent execution and operational discipline is exactly the order Symantec needed.”
To which I responded:
“Consistent execution and operational discipline is exactly what will kill Symantec. Or rather, relying on operational fixes alone will kill Symantec.”
Most security product companies (there are over 2,000 of them) are focused on one or two products that provide some differentiated value to the market. But large companies face a growth and competition wall. Symantec in particular demonstrated the model of innovation by acquisition, based on the valid concept that it is easier to identify a market-winning product than it is to invent one.
Large vendors with tens of thousands of customers globally can thrive by acquiring product vendors that their existing customers will purchase. Customers have lots of reasons to do so. In their own drive towards operational efficiency they seek to reduce the number of vendors they have to deal with: fewer contracts, fewer license agreements, and often, lower prices.
In some rare cases the vendor can even consolidate the administration of multiple products into one management console, which means lower costs for operations – and might even lead to better overall security.
Symantec cannot afford to continue to shuffle through the typical A list of contenders for chief executive of publicly traded companies. It is time for drastic measures. Here are two things the next CEO must do:
1.Divest. Symantec should reverse the merger with Veritas that cost $13.5 billion in 2004. Security is not like other market segments. The space is constantly evolving because it has a driver that only Aerospace and Defense shares: threat actors. Being one-half data center software company and one-half desktop anti-virus company makes no sense at all. Split off the data center business and let the two halves thrive.
2.Acquire. The IT security industry experienced a tremendous disruption with the publishing of Mandiant’s APT1 report in 2013. Startups and fast moving established companies have been rushing to address the need to shorten the time from successful incursion to cleanup. It is an acknowledgement that anti-virus is powerless to stop attacks and products have to be deployed that detect the breach, analyze it, and manage the remediation. Which vendors should Symantec acquire? Well, I have a list…
To choose its next leader my advice to Symantec’s board is look for an industry insider. Only someone that has lived and breathed the daily battle against rising threats can understand what is needed. There will be acquisition, integration, and sales challenges. Judging by Symantec’s falling revenue and rising profits I would say the operational efficiencies have all been put in place. The new CEO can focus on making the hard strategic decisions needed to save the company.