The $500 million acquisition of QRadar SaaS by Palo Alto Networks is expected to close later this year, bringing big changes for partners and customers.

What’s Next For QRadar Partners, Customers

The planned $500 million acquisition of IBM’s QRadar SaaS business by cybersecurity giant Palo Alto Networks is expected to close later this year, bringing big changes for partners and customers.

With the deal, Palo Alto Networks is squarely focused on enabling customer migrations to its Cortex XSIAM (extended security intelligence and automation management) platform, while also looking to speed up its journey to becoming a top player in the crucial market for SIEM (security information and event management) tools.

[Related: IBM QRadar Deal Is Exactly What Palo Alto Networks Needs For XSIAM: Analysis]

Meanwhile, for IBM, a top focus going forward will be around working to get partners ready for the transition, according to Kate Woolley, general manager of IBM Ecosystem. The planned sale of QRadar SaaS also marks a notable shift in cybersecurity strategy at tech giant IBM.

Ultimately, the Palo Alto Networks-IBM deal means that current QRadar partners and customers have some big decisions to make. The deal is expected to close by the end of September.

What follows are the key details on what’s next for the IBM QRadar, Palo Alto Networks deal.

IBM: Getting Partners Ready

Kate Woolley (pictured), IBM’s global channel chief, sat down with CRN last week at IBM Think 2024 to discuss the company’s partner strategy behind selling its QRadar SaaS business to Palo Alto Networks and what the channel should be doing about it.

“Once the acquisition closes, our partners will have the opportunity to join Palo Alto Networks’ partner program, if they’re not already part of that, so they will be able to then sell Palo Alto’s Cortex XSIAM,” said Woolley, general manager of IBM Ecosystem. “Then also, our partners are going to play a key role where it makes sense for their clients to migrate clients to the Palo Alto Cortex XSIAM.”

Importantly, IBM is “working hand-in-hand” with Palo Alto Networks to make sure that QRadar partners can “quickly” make the transition, she said.

For now, “everything is business as usual until the transaction closes in the third quarter,” Woolley told CRN, adding that “we see partners as absolutely critical as we think about this expanded partnership and how [we] address security challenges.”

IBM: Shift In Security Strategy

For IBM, the deal with Palo Alto Networks is an exit from a shrinking business. The company reported revenue declines for threat management in 2023 as a whole and for the first quarter of the year, while overall security revenue slipped 2.8 percent and 2.5 percent, respectively.

IBM’s planned $6.4 billion acquisition of HashiCorp signals the direction things are headed in, security-wise, for the tech giant. The company is looking to expand its data security business with the HashiCorp acquisition, while at the same time, moving away from the market for security operations tools, IBM CEO Arvind Krishna told The Wall Street Journal.

Palo Alto Networks: Focus On Customer Migration

For Palo Alto Networks, the IBM QRadar deal is mainly targeted at migrating customers to the cybersecurity vendor’s rival cloud-native tool for security operations, Cortex XSIAM — as CEO Nikesh Arora acknowledged during a call with analysts last week.

As part of the QRadar deal, Palo Alto Networks is set to acquire the Software-as-a-Service assets associated with the offering, including QRadar intellectual property.

For cybersecurity giant Palo Alto Networks, however, the assets don’t seem to be the main focus. The bigger motive for the deal is to gain an entry point for migrating QRadar SaaS customers onto XSIAM.

“What’s interesting here is that Palo Alto [Networks] is taking the customers from IBM. They’re not focused on necessarily taking the technology with it and incorporating that into their stack,” said Allie Mellen, principal analyst at Forrester.

Going forward, it’s unlikely that Palo Alto Networks has major plans for the QRadar assets and intellectual property when it comes to the future development of XSIAM, Mellen said.

“A lot of reengineering work would be required to make use out of the QRadar assets,” she said. “It would just be a lot of work for Palo Alto [Networks] that they could spend building a new feature or capability within the [XSIAM] offering.”

Palo Alto Networks: Becoming A Top Player In SIEM

In just a year-and-a-half since launching its XSIAM offering, Palo Alto Networks amassed bookings of $400 million for the SIEM alternative tool, Arora (pictured) said last week. But for Arora and the rest of the leadership at the industry’s largest pure-play security vendor, things clearly weren’t moving fast enough.

The IBM QRadar deal, however, “hopefully cements our place in the SIEM/SOC category at a pace that nobody would have anticipated,” Arora said during the call with analysts last week.

Notably, while Palo Alto Networks did not appear on the influential Gartner Magic Quadrant for SIEM earlier this month, IBM QRadar found a spot in the highly sought after “leaders” quadrant on the ranking.

The size of the QRadar SaaS business is comparatively modest, generating about $100 million in revenue last year. Arora said the substantial on-premises QRadar customer base is the “larger prize” for Palo Alto Networks, however. And the vendor now has an on-ramp to migrate those customers to XSIAM, with IBM itself at the ready to help make it happen.

Without a doubt, Palo Alto Networks is “supercharging their path forward with getting all of these customers from IBM,” Mellen said.

Decision Time For Customers

IBM and Palo Alto Networks are saying they will “facilitate the migration” of QRadar SaaS customers to XSIAM platform once the acquisition closes.

For QRadar SaaS customers, “there’s a lot of decisions that they’ll have to have to think through before they can necessarily make that migration,” Mellen said. “Even that migration alone is going to be challenging for IBM customers to make. And so while it’s useful to have the opportunity to do a free migration, it’s not a given that that’s something they should take.”