Page 3 of 3
HP also has been overhauling ArcSight's security information event management (SIEM) system, ripping out the underlying Oracle database and replacing it with HP's proprietary system it calls the Correlation Optimized Retention and Retrieval (CORR) engine. The changes may be too little too late say some observers.
The Oracle database management system required extensive tuning and ArcSight implementations have been compared to massive ERP system deployments. It has been steadily losing ground to competitor SIEM products that, according to industry analysts, are easier to deploy and maintain.
Reworking ArcSight's underlying foundation may have set HP behind IBM and RSA, which have each recently announced the integration of their SIEM systems with the Hadoop framework for big security data analytics, said Mike Rothman, analyst and president of research consultancy Securosis. Historically, large companies have had a difficult time integrating acquisitions and keeping them innovative.
"They're giving the product a brain transplant and there has been a number of management changes, so it's not clear who is driving the ship over there," Rothman said. "ArcSight was the thought leader and driving the agenda for security management, but that is not the case anymore."
Jon Oltsik, a senior principal analyst at Enterprise Strategy Group, a market research firm based in Milford, Mass., said HP is likely evaluating all its security assets for sale or spin-off. "With the state of HP anything and everything is in play," said Oltsik. "There's no doubt they're looking at all their assets and all their business units and making tough decisions and security is probably no exception."
There is no reason why HP cannot re-establish itself in the security market with ArcSight, said Oltsik, but the company needs to move quickly or it could lose further momentum to other established players such as IBM, McAfee and RSA, he said.
Business news site Quartz reported earlier this month that the HP board of directors is exploring a breakup of the company, citing unnamed "people familiar with the matter."
HP, for its part, publicly raised the specter of a possible sale or spin-off of underperforming assets or business units in a 10-K filing late last year.
In the "Risk Factors" section of that 10-K filing, HP said that it will "continue to evaluate the potential disposition of assets and businesses that may no longer help us meet our objectives." Furthermore, HP cautioned in the 10-K that it may "dispose of a business at a price or on terms that are less desirable than we had anticipated."
"When we decide to sell assets or a business, we may encounter difficulty in finding buyers or alternative exit strategies on acceptable terms in a timely manner, which could delay the achievement of our strategic objectives," HP said in the 10-K. "We may also dispose of a business at a price or on terms that are less desirable than we had anticipated."
PUBLISHED FEB. 20, 2013