Google Cloud today said it acquired security orchestration, automation, and response (SOAR) vendor Siemplify to bring the capability in-house. Analysts saw this deal as a signal of the end of the standalone SOAR and security information and event management (SIEM) markets.

Neither party revealed the financial terms of the deal. Siemplify previously raised $58 million in venture funding, and Google reportedly paid $500 million to acquire it, according to Crunchbase.

Founded in 2015, Siemplify offers a SOAR platform that it claims improves security operation center performance by enabling end-to-end management, better threat response, and visibility across workflows. The vendor rolled out a cloud-native SOAR platform in mid-2020. 

Google Cloud plans to integrate Siemplify into its security analytics platform Chronicle to “help enterprises modernize and automate their security operations,” Google Cloud Security VP and GM Sunil Potti wrote in a blog post.

Security startup Chronicle was originally part of Alphabet’s secretive X research lab and then rolled out as an independent business. It later merged with sister company Google Cloud in 2019.

Chronicle released its cloud-native SIEM platform Backstory in 2019, and it partnered with other vendors for SOAR capabilities.

“A SOAR tool has been the missing piece for Google’s Chronicle offering since practically its inception — other security analytics platforms began incorporating SOAR natively as early as 2017,” Forrester analyst Allie Mellen wrote in response to questions.

On the other hand, Siemplify was one of the few remaining standalone SOAR vendors, as many others have been acquired by SIEM vendors or built out their portfolio with other products like threat intelligence platforms, according to Mellen.

Forrester analysts predicted last year that the SOAR market could not stand on its own. And now Google Cloud’s Siemplify buy is “a heady acquisition” that “signals the end of the standalone SOAR or, frankly, SIEM,” Mellen said.

In addition, the SIEM market has been altered to a more holistic security analytics platform, incorporating SIEM, SOAR, and security user behavior analytics (SUBA), into a single offering, Mellen added.

The scope of SOAR and SIEM is limited in responding to threats, concurred Zeus Kerravala, founder and principal analyst at ZK Research. “Security is becoming more AI-driven, and that requires an end-to-end view. Silos lead to big blind spots.”

However, and perhaps unsurprisingly, independent SOAR provider Swimlane's CEO James Brear disagrees with the prediction.

“The acquisition of Siemplify is a testament to the escalating demand for security automation and SOAR,” he wrote in a statement. It “validates the need for automation that can easily integrate into any organization's existing infrastructure and security playbook requirements, not just those dictated by the security vendor.”

The acquisition also shows that security teams are looking for “a unified security analytics platform that they can use through the entire incident response lifecycle, from detection, to investigation, to the orchestration of response,” Mellen said. 

Extended detection and response (XDR) is an example of a unified platform that combines elements of SOAR, SIEM, endpoint detection and response (EDR), and network traffic analysis (NTA) in a software-as-a-service (SaaS) platform to centralize security data and incident response.

“SOAR and SIEM need to be part of a larger XDR strategy, which is where I expect Google to go,” Kerravala said. 

Recently, Google Cloud has been making moves in the XDR space. Last May, it teamed up with CrowdStrike in a deal to share telemetry and data between Google Cloud’s security products and CrowdStrike’s Falcon platform. At the time, Potti described it as “beyond XDR.”

Later in October, the cloud giant announced XDR partnerships with CrowdStrike, Palo Alto Networks, and Cybereason. Just last month, Cybereason launched an XDR platform powered by Google Chronicle.

The Siemplify deal further boosts Google Cloud’s “beyond XDR” strategy.

Google Cloud’s vision of a modern threat management stack is to empower customers to go beyond typical SIEM and XDR tooling, “enabling better detection and response at the speed and scale of modern environments,” Potti wrote. “Providing a proven SOAR capability unified with Chronicle’s innovative approach to security analytics is an important step forward in our vision.”