Facebook on Hunt for Big Cybersecurity Acquisition
In an effort to repair its tattered reputation around data protection, Facebook is stepping up efforts to acquire a major cybersecurity firm, according to four people familiar with the matter.
Facebook has approached several security firms about an acquisition, two of the people said, although neither would identify the companies as discussions are still underway. One of the people said a deal could happen by the end of the year.
The company’s push comes in the wake of a devastating security breach that affected 30 million users, an incident that added to a litany of security and privacy concerns swirling around the social media company in recent months. Facebook is betting that a splashy acquisition of a security company might serve the dual purpose of bolstering its talent in that field and delivering a much-needed public relations win. It formed a team of people inside its corporate development department to search for cybersecurity companies that might be willing to be acquired, said one of the people familiar with Facebook’s strategy. A Facebook spokeswoman declined to comment.
Facebook has made several cybersecurity acquisitions over the past few years, such as its 2014 purchase of PrivateCore, which makes secure server technology that helps protect servers from malware or unauthorized access. Facebook didn’t disclose the purchase price of the company, but PrivateCore had raised $2.3 million in venture capital funding prior to its acquisition.
In its current acquisition efforts, the company is most likely to look at software that it could wrap into its own systems, including things like analytics or tools to flag unauthorized access, people familiar with its thinking said. Companies in these categories include Demisto, JASK and Swimlane, each of which are privately held and would likely cost somewhere in the hundreds of millions of dollars. It could also look for technology that could help users keep their accounts more secure or add privacy features, the people said. Some companies in this category include ZeroFOX and SafeGuard Cyber, both of which help assess accounts for risk of attack or prevent attacks. ZeroFOX has raised more than $80 million to date and SafeGuard Cyber $14.9 million.
Facebook’s security practices have been called into question in recent months. The data breach it announced last month affected around 30 million users, exposing an extensive amount of personal information, including name, contact information, religion, and location data. Its investigation reportedly blamed the breach on spammers who were looking to profit from Facebook user data. Before that, the revelation that Cambridge Analytica siphoned the data of millions of users in an attempt to manipulate the 2016 presidential election sparked an avalanche of criticism of Facebook’s data protection policies.
An acquisition would also help Facebook hire technical expertise in cybersecurity. Facebook has been looking to hire a significant number of security personnel, with CEO Mark Zuckerberg committing to expanding teams dedicated to safety and security from 10,000 to 20,000 people this year. Cybersecurity talent is in heavy demand from many types of companies, which has created a shortage of skilled professionals. Facebook executives said one of the reasons for the PrivateCore deal was for its technical talent.
Buying a major cybersecurity firm would also serve as a tangible statement that Facebook is investing in cybersecurity, which otherwise is largely done behind the scenes, said a person who has previously been involved in Facebook’s cybersecurity acquisition discussions.
In beefing up its cybersecurity acquisition efforts, Facebook is competing with several other big tech companies that are trying to strengthen their technology and expertise, including Amazon, Google and Hewlett Packard Enterprises. Cisco has already done some big deals, including the $2.35 billion purchase of Duo Security in August. Overall, in the third quarter, there was $5 billion in total acquisition activity in cybersecurity across 38 deals, according to an analysis by Momentum Cyber, a cybersecurity advisory firm. That was up 204% over the previous quarter.
Several executives and investors who work in the cybersecurity industry expressed skepticism that even a major acquisition could solve Facebook's security vulnerabilities. Facebook’s business model makes it a major target. It collects and saves the personal data of its users and then allows outside companies to target advertising using that data. However anonymized, Facebook itself is a constant reminder to the world that troves of valuable personally identifiable information remain on its many servers scattered around the world.