Skip to content

Security Market


10K filing


  • Founded in 2004, based in Santa Clara
  • Elliot Management (private equity company) bought Gigamon for 1.6 billion (2017)
  • Sells a network visibility suite

Deploying sensors

  • a physical appliance
  • a VM (in VMWare, OpenStack)
  • an AWS AMI

Gigamon's functionality

  • Create netflow logs (like Bro)
  • Decrypt SSL traffic
  • Extract application sessions
  • Expose APIs

Gigamon also sells its platform to mobile service providers for subscriber-specific monitoring and visibility


  • 81 of Fortune 100
  • 418 of Fortune 1000
  • T-Mobile accounted for over 10% of revenue

Revenue sources

  • Product revenue - perpetual software licenses (not subscription based!)
  • Service revenue - from renewable maintenance and support contracts


2017 annual report

Relevant parts

  • Symantec sees its global, proprietary threat intel as a major asset
  • Symantec does enterprise + consumer security. (I wonder if consumer security is even profitable!)
  • BlueCoat CEO, CFO, COO became CEO, CFO, COO of Symantec
  • I could leverage the acquisition of my startup to become CEO of my parent company

New Symantec products

Consumer security products

  • Norton -- AV for desktops, mobile devices, IoT
  • A WiFi router
  • Lifelock -- detects identify theft, monitors your credit, etc

Sales strategy


We sell and market our consumer products and services to individuals, households and small businesses globally. We bring these products to market through direct marketing and co-marketing programs supported by our e-commerce and telesales platforms.

In addition, we utilize Internet-based resellers, system builders, ISPs, employee benefits providers, wireless carriers, retailers, and OEMs to distribute our offerings worldwide.


We sell and market our products and related services to small, medium and large customers through field sales and inside sales forces that leverage indirect sales partners around the world that are specifically trained and certified to sell our solutions.

These partners include national solution providers, regional solution providers, national account resellers, global/federal system integrators and managed service providers.

Our products and services are also available on our e-commerce platform, as well as through authorized distributors and OEMs, which incorporate our technologies into their products, bundle our products with their offerings, or serve as authorized resellers of our products.


We sell and market our products and related services to large enterprises, including government and public sector customers, through our field sales force.

This field sales team is responsible for leveraging our global partner ecosystem primarily targeting senior executives and IT department personnel responsible for managing a company’s highest-order IT initiatives.

  • Blue Coat has 5 year maintenance contracts so people buy a lot of Blue Coat products every 5 years


  • One org develops new and existing products
  • Another one conducts research for future products
  • Another one consists of analysts that analyze Symantec's threat intel data and create new signatures
  • Virus Protection Promise - if your network gets infected, Norton experts will help you cure it

Palo Alto Networks

10K Filing


  • Firewall Appliances: Physical, Virtual, Cloud
  • Firewall Software - PANOS
  • Panorama - central management console for all of an organization’s PAN firewalls
  • Subscriptions - add-ons to platform
  • Threat Prevention: IDS/IPS
  • URL Filtering
  • Wildfire Subscription: Automated malware sandbox
  • GlobalProtect: Global secure proxies that connect to your corporate network as a service
  • Subscriptions - sold per endpoint or user
  • Traps Endpoint Protection Subscription
  • AutoFocus Subscription
  • Aperture Subscription
  • GlobalProtect Cloud Service Subscription
  • Logging Service Subscription

Key Insight

  • Develop a core product along with subscriptions customers can buy from the web interface
  • These subscriptions would start working immediately, and you could sign up for a free trial first. This would make upselling painless.


From FireEye's 10K filing


  • 66% of revenue from US, 15% from Europe/Middle East/Africa, 14% from Asia Pacific
  • 45% of Global 2000 are their customers
  • 6600 end customers
  • $750M revenue in 2017, market cap $3B = 4x revenue (not much!)


  • Network security products.
  • Email security products.
  • Endpoint security products.
  • Security management & orchestration products.
  • Forensics and investigation products.
  • Subscription and services.

"Cybersecurity Firm’s Strategy Raises Eyebrows" (WSJ, 2015)

  • FireEye has a small loss (2015) - $444 million loss, $426 million revenue per quarter
  • They bought Mandiant for $1B which gave them ties to organizations that hired Mandiant after getting hacked
  • Crowdstrike recently hired top cyber person at FBI and Tanium hired 2 FBI agents, to help them get government contracts
  • They have security clearances in 18 countries so it is possible to go global with govt contracts
  • FireEye has been traditionally sold hardware appliances, but now they are shifting to a SaaS based model to increase profits

“FireEye Buys iSight Partners for $200M” (WSJ, 2016)

Link to article

  • iSight has 250 former military, govt people from the countries they’re based in 17 countries
  • Monitor hacker forums, talk to local sources to identify potential threats

“FireEye Buys Invotas Intl” (WSJ, 2016)

Link to article

  • Invotas launched in 2014, was in stealth for 3 years, has 19 employees
  • Spun off CSG Systems Intl last year
  • FireEye didn’t disclose how much they paid