Cisco today announced the completion of its largest acquisition – a $28 billion Splunk deal. CEO Chuck Robbins claims the acquisition will bolster Cisco's ability to help organizations harness the power of artificial intelligence (AI) while strengthening security and observability capabilities.

The tech giant acquired Splunk for $157 per share in cash, representing approximately $28 billion in equity value. The acquisition is expected to be cash-flow positive and gross-margin accretive in fiscal year 2025, and non-GAAP earnings per share accretive in fiscal year 2026.

“As one of the world’s largest software companies, we will revolutionize the way our customers leverage data to connect and protect every aspect of their organization as we help power and protect the AI revolution,” Robbins said in a statement.

The acquisition comes at a pivotal time as the adoption and impact of AI are rapidly accelerating across industries. Robbins added that Cisco intends to provide the infrastructure necessary for powering AI, the data for its development, a security platform for its protection, and an observability platform for its real-time management and monitoring.

To build a more comprehensive security portfolio for threat prevention, detection, investigation, and response, Robbins announced in a blog post several integration plans post-deal:

1. Cisco will incorporate its Talos threat intelligence into Splunk over the next few months. The Talos team is one of the largest commercial threat intelligence teams in the world, formed by combining SourceFire’s Vulnerability Research Team, the Cisco Threat Research and Communications group and the Cisco Secure Applications Group. The security researchers, analysts and engineers in the team help Cisco customers defend against known and emerging threats, discover new vulnerabilities and interdict threats.
2. The networking and security giant intends to unify the AI assistants for security from both companies, “so security professionals have one common experience when using AI to analyze issues and perform tasks across the combined portfolio,” Robbins said. Last June, Cisco unveiled its AI Assistant for Security and in February, the vendor introduced its AI assistant in Secure Access, which is its security service edge (SSE) platform.
3. Cisco also plans to enable Splunk’s security information and event management (SIEM) and security orchestration, automation and response (security, orchestration, automation, response (SOAR)) platform to use cloud, network and endpoint analytics available from Cisco’s security portfolio. “Being able to eliminate a lot of the point products that they have throughout their infrastructure, particularly around security, and actually integrate that into a platform play, I think is something that our customers have been telling me they need to do,” Robbins said.

Cisco enhances its full-stack observability with Splunk

With the integration with Splunk, Cisco aims to enhance its full-stack observability solution for multicloud hybrid environments.

“We will also begin to deliver a common experience and workflow optimizations across the Cisco and Splunk Observability portfolios. In time, IT and engineering teams can expect AI-driven root cause analysis enhancements and assistants, inclusive of Splunk IT Service Intelligence (ITSI),” Robbins said.

Gartner VP Analyst Gregg Siegfried told SDxCentral in an earlier interview that he expects Cisco to leverage Splunk’s observability advancements to improve its AppDynamics and Full-Stack Observability platform.

“Cisco struggled with AppDynamics over the years, maximizing that acquisition, and they’ve been in the process of building the new Full-Stack Observability platform that has more overlap with some of the Splunk product line,” Siegfried said. “But that’s something where they may very well be able to take that set of Splunk and Cisco assets and build them into something that’s better than what they had today.”

Cisco acquired AppDynamics in 2017 for $3.7 billion, while ThousandEyes came into the portfolio three years later in 2020 via a $1 billion acquisition. In 2021, the vendor integrated its AppDynamics acquisition into its application security portfolio to help developers and security teams detect vulnerabilities in production and automatically block attacks. In June, the vendor launched its Full-Stack Observability Platform, combining ThousandEyes, AppDynamics, and other existing visibility and security capabilities.

Splunk has been building out its Observability Cloud platform for a few years, mostly based on its recent acquisitions, while integrating it with its SIEM tools, Siegfried noted.