NetApp spends $272m on data security pro

Network Appliance, a maker of storage devices and software, has agreed to acquire data security specialist Decru for about $272m in cash and stock, NetApp said on Thursday.

Decru, based in Redwood City, California, makes security appliances designed to protect both network-attached storage systems and storage area networks for the business and government sectors. The company also markets devices built for complying with data retention regulations, privacy protection and outsourcing security.

The Decru deal is the second security-related acquisition by NetApp in the last three months. Earlier this year, the storage company agreed to buy Alacritus, a privately held maker of backup disk emulation software, for an undisclosed sum.

NetApp executives said the Decru acquisition will augment the company's existing security assets, particularly in the area of data encryption, and pointed to the recent raft of well-publicised incidents of theft and breaches of consumer data as proof that demand for such technology is growing rapidly.

According to Dan Warmenhoven, chief executive of NetApp, Decru has been able to meet customer demand for ease-of-use with storage security that others have failed to deliver.

"This is a nascent market characterised by very slow adoption rates because of the complexity, and we view Decru as a market leader because they've made headway with adoption," Warmenhoven said. "Customers have the desire to add another layer of protection, and they have an obligation to do so in many cases due to compliance; the challenge was that there wasn't a viable product for rapid deployment, and that is what Decru has been able to overcome."

In particular, the executive pointed to the recent spate of consumer data losses at major companies such as Bank of America as proof that customers are in need of new tools to help protect information stored on their IT networks.

NetApp and Decru have been working together as partners for more than a year and have already marketed packages that combined the companies' devices.

NetApp indicated that Decru will continue to make products that work with technologies from NetApp's storage rivals but it remains to be seen how competitors will respond to the acquisition. Decru has existing partnerships with all of NetApp's leading rivals, including EMC, Hitachi Data Systems, HP and IBM.

In fact, Warmenhoven said NetApp will try to keep Decru's operations separate from its own, and will have the company act as an in-house supplier that also works to keep its ties with other vendors. As a result, he is also expecting no cuts in staffing at either company as a result of the merger.

The companies said the acquisition is expected to close by October and reported that Decru will form a new business unit within NetApp.

At least one industry watcher viewed the deal as a positive step for NetApp. Jon Oltsik, senior analyst at the Enterprise Strategy Group, said Decru has been more consistent at launching innovative products than its rivals, which include Kasten Chase Applied Research and NeoScale Systems. The analyst believes the acquisition could touch off additional mergers in the storage security market and said it would definitely cause other storage companies to increase their focus on security.

"It's a good fit for NetApp, and a shot across the bow for the rest of the storage industry, who have really underestimated and ignored security," Oltsik said. "This shows that a market leader is willing to make this an issue, and now everyone else has to answer."

Matt Hines writes for CNET News.com