On 5 November 2007, Symantec announced an agreement to buy data loss prevention (DLP) vendor Vontu for $350 million.

This planned purchase has been long-rumored. Symantec says that, in the short term, Vontu will operate as a "near-autonomous" but wholly owned organization to minimize the impact on Vontu’s approximately 120 customers.

The pure-play content monitoring and filtering (CMF)/DLP market is still at an early stage, populated by startup vendors typically with fewer than 100 customers. In the past 18 months, a number of large security vendors have acquired DLP vendors. However, the end-point DLP market is uncharted territory, with enterprises unclear in their requirements and few deployments of more than 1,000 seats.

While market consolidation is necessary before mainstream buyers adopt DLP, it marks a time of uncertainty for buyers. Product maturity has accelerated over the last two years, driven by competition in the pure-play market and by fast-moving, well-funded startups. Now the market has shifted to a period of integration. Most DLP deployments have been undertaken by early adopters, but as DLP functionality becomes more attractive to enterprise buyers, we expect the DLP market to be absorbed by more mature markets in end-point security, messaging security and archiving. End-point security vendors such as Symantec, McAfee and Trend Micro, with their incumbent position on the desktop, will allow DLP modules to be deployed and managed via their pre-existing antivirus management infrastructure.

Symantec and EMC will lead the vendor push toward content-awareness within archiving and storage solutions. Outbound-messaging-centric products will continue to provide less-sophisticated detection for the mail-centric buyer. Vendors eying DLP opportunities will need to decide if enterprises will ultimately find it necessary to have the same provider supplying them end-point DLP, DLP functionality at their messaging and Web gateways, and storage and archiving solutions.

Symantec’s record of successfully integrating and maintaining best-of-breed security functionality has been patchy. Symantec has not yet published its product road map, but customers should expect DLP capabilities with Symantec’s archiving and messaging solutions by the end of 2008. Symantec has just finished an overhaul of its end-point security product and associated management. We do not expect a Vontu end-point DLP module for the Symantec antivirus management console until 1Q09.

Symantec desktop antivirus customers:

• Evaluate existing controls within Symantec Endpoint Protection 11 (such as device control) and evaluate all desktop DLP offerings against your specific needs and time frames. Do not assume a Vontu DLP module will be the best choice.

Vontu network gateway customers:

• Be cautious, since Symantec does not have a secure Web gateway solution. Customers with HTTP needs should evaluate competitor solutions and press Symantec/Vontu for product support commitments.

Prospective Symantec DLP customers:

• Evaluate DLP functionality requirements carefully and in terms of your expected time frame for rolling them out.
• Evaluate what DLP capabilities exist today within products you currently deploy (that is, end-point security and messaging security) before making a separate DLP purchase.

• "Trend Micro Will Expand Capabilities With Provilla Deal" — This acquisition will enable Trend Micro to offer DLP and encryption products managed by an antivirus infrastructure. By Arabella Hallawell and Paul Proctor
• "Magic Quadrant for Content Monitoring and Filtering and Data Loss Prevention, 2Q07” — The market for CMF and DLP technologies is maturing rapidly but remains fundamentally adolescent. By Rich Mogull, Paul Proctor and Eric Ouellet

(You may need to sign in or be a Gartner client to access the documents referenced in this First Take.)