VMware Carbon Black kicked off its Connect 2020 virtual event with a bang as SVP and GM Patrick Morley announced a strategic security acquisition (Octarine) and a coalition that includes all of the leading security information and event management (SIEM) and security orchestration, automation, and response (SOAR) players. The vendor also detailed deeper integrations between its Carbon Black Cloud security platform, acquired when it bought that company for $2.1 billion last year, and its device management products. And it plans to add new integrations with other VMware products this year.

The now $1 billion security unit has set its sights on becoming a multi-billion-dollar security business. In an interview with SDxCentral, Morley laid out a roadmap for the next year to set VMware on the path to achieving this goal.

Priority No. 1, Morley said, is to continue consolidating endpoint protection and cloud workload protection capabilities onto its platform, thus creating a unified, cloud-native approach to security. He wants to reach a point “where organizations can say, ‘you’ve got the right feature set for me to be able to do away with a whole bunch of these other products’ — and we’re doing that today. We have customers that will remove five or six different products and consolidate on our platform. But we’ve got to continue and consolidate more and more functionality for our cloud-native security platform.”

No. 2: “we’ve got to build security in intrinsically into the VMware stack,” Morley said. “And a year from now you’re going to have seen us made tremendous progress there.”

Specifically, VMware will this year build telemetry and security controls into its Workspace One device management product, its Horizon virtual desktop, its vSphere computing platform, its NSX network virtualization platform, and its Tanzu Kuberenetes portfolio. All of these products will integrate with the VMware Carbon Black platform by the end of 2020, Morley said. Its VeloCloud SD-WAN and cloud security posture management products will follow next year.

“So building it in so that it all pumps back to our data lake and you just turn it on, if you want it,” he said. “That’s a second big priority.”

“And the third priority is to continue to act in an aggressive manner in the space, I mean both organically and inorganically, to make sure we establish ourselves as a major presence,” Morley said. In other words: expect more security acquisitions.

Coming from Carbon Black (Morley was CEO of that company before VMware bought it), to VMware, an almost $11 billion company with much deeper pockets, Morley said he appreciates the larger company’s willingness to invest in making VMware a security powerhouse.

“We were very excited to be empowered to be able to go and do the acquisition we just announced today,” he said, referring to acquiring Kubernetes security startup Octarine. “That’s pretty amazing. We’ve been here [at VMware] seven months, I wanted to go do something in containers and couldn’t quite do it as a standalone, we come to VMware and now it’s go do what you need to do in order to build a [security] provider that can really help our customers.”

Octarine sits in the center of three big, strategic areas for VMware: security, cloud-native and Kubernetes, and network virtualization. That makes it an important acquisition in relation to the company’s internal strategy.

It also fills an important customer need, Morley said. “Every CISO that I talk to, every chief security officer I talk to, says that they need help in this area — in containers.”

Compared to building legacy workloads — requesting hardware from IT, buying new software, and waiting for all the pieces to arrive and come together — it’s really easy for developers to use a company credit card, spin up a public cloud instance, and start building container-based applications.

“And so what happens is one day the CIO wakes up and says, ‘holy smokes, we have 4,000, 5,000 containers and no one had any idea. I have no idea if they’re configured correctly,” Morley said. “So they go to the CISO and say ‘go solve this.’”

When it comes to building out its security capabilities, and deciding which ones to buy, Morley said VMware takes a three-fold strategy. The company’s first choice is to develop technology in-house. Partnering with other security vendors comes in second, and buying companies is No. 3.

Considering VMware Carbon Black this week announced a new coalition with leading SIEM and SOAR providers Splunk, IBM Security, Google Cloud’s Chronicle, Exabeam, and Sumo Logic, it seems safe to assume that VMware has decided that it won’t target any SIEM and SOAR vendors for acquisition. Morley confirmed this: “Where we stand today, that’s right on.”

And while he won’t name any specific companies or sectors, “I would say that we’re very active. We’ve laid out internally, inside of VMware, a strategy on how we think we can continue to build a very large security provider. And there’s a couple spots where we think we have an opportunity to go out and add more functionality faster than is we built it ourselves.”