Palo Alto Networks announced an agreement to acquire the QRadar software-as-a-service (SaaS) assets from IBM. Forrester analysts pointed out the core of this deal is about QRadar’s customer base.

The acquisition includes QRadar intellectual property rights and is expected to close by the end of September. Financial terms were not disclosed.

“We do not anticipate that any IBM QRadar SaaS employees will join Palo Alto Networks following the acquisition close,” an IBM spokesperson told SDxCentral in response to questions.

The IBM Security QRadar Suite is a threat detection and response solution that offers security information and event management (SIEM), extended detection and response (XDR), security orchestration, automation, response (SOAR) and log management.

The company has been selling the QRadar products and iterating on its SIEM technology since 2011 when it acquired Q1 Labs. In April 2023, IBM announced an updated QRadar security suite combining XDR, SOAR and artificial intelligence (AI) with SIEM. Last November, the vendor introduced a major new version of its QRadar SIEM platform, rebuilt with a cloud-native architecture designed for the hybrid cloud era.

Once the acquisition closes, the two companies will migrate IBM QRadar SaaS customers to Palo Alto Networks’s Cortex XSIAM platform. “The two companies intend to work together after closing to help ensure the smooth transfer of QRadar SaaS clients to Palo Alto Networks Cortex XSIAM, including by planning to extend no-cost migration services,” said the IBM spokesperson.

Palo Alto Networks in 2022 rolled out the AI-based Cortex XSIAM platform to automate threat detection and remediation that its CTO and founder Nir Zuk claims replaces legacy SIEM tools. In April, the vendor introduced Cortex XSIAM for Cloud, which extends its threat detection and response capabilities to the cloud environments to help security operations centers (SOC) teams identify and remediate cloud threats.

At this year’s RSA conference, the security giant introduced a generative AI (genAI) assistant for the platform, powered by its proprietary AI system — Precision AI — that combines genAI, machine learning (ML) and deep learning capabilities. Palo Alto Networks intends to incorporate IBM’s Watsonx large language models (LLMs) in Cortex XSIAM to deliver additional Precision AI solutions.

Impact on IBM QRadar customers

In the wake of the acquisition, IBM QRadar customers may face a transition period.

For on-premises QRadar clients who wish to remain, IBM will continue to offer existing features and support including security, usability and critical bug fixes, along with updates to existing connectors and the ability to expand consumption.

For both QRadar SaaS and on-premises clients who choose to migrate to Cortex XSIAM, IBM and Palo Alto Networks will offer no-cost migration services to qualified customers. IBM will receive incremental payments from Palo Alto Networks for QRadar on-premises clients who choose to migrate to the Cortex XSIAM platform.

“At its core, this acquisition is about the QRadar customer base,” Forrester analysts wrote in a blog post. “You don’t need expertise in the occult to figure this one out: as soon as contractual obligations run out, existing QRadar SaaS customers need to embrace XSIAM or migrate to a different vendor. They should also find out quickly if they are qualified for the no-cost migration to Cortex XSIAM.”

They suggest current QRadar SaaS customers rethink their security operations (SecOps) approach to determine if Cortex XSIAM is the right solution for them or make a transition plan to another vendor.

In addition, analysts noted IBM Security considers its endpoint detection and response (EDR) offering (from its ReaQta acquisition), threat intelligence (IBM Security X-Force Threat Intelligence), QRadar SOAR and Randori Recon to be part of the QRadar SaaS assets, so customers of these products should expect the same outcome.

“To any organizations considering a QRadar purchase: choose a different vendor or evaluate Cortex XSIAM and cut out the middleman,” they wrote.

Palo Alto Networks and IBM broaden their partnership

Palo Alto Networks and IBM also outlined a roadmap for collaboration beyond the QRadar acquisition. This includes IBM Consulting to become a preferred manage security services provider (MSSP) for current and future Palo Alto Networks customers. The two companies will create a joint Security Operations Center for managed SOC.

“IBM will train more than 1,000 of its security consultants on migration, adoption and deployment of Palo Alto Networks products,” the firms stated.