Cisco Plunks Down $28B for Splunk to Accelerate Its Business Model Transition

Adding Splunk will accelerate Cisco’s business model transition

While cloud solutions were originally meant to simplify IT, in many ways they have gradually become just as complex as traditional IT environments. From a performance and security point of view, the shift from delivering within customers’ own data centers to utilizing a multitude of external cloud providers has amplified the challenges of managing and securing these environments. This shift has given rise to a group of vendors that includes Splunk, which provides observability and security solutions that can address the variety of delivery methods used by most customers. The September announcement that Cisco (Nasdaq: CSCO) will acquire Splunk for $28 billion validates this new reality for customers and reflects the need for deep-pocketed traditional IT vendors to shift their own business models to incorporate more subscription revenue streams.

Cisco targets the PaaS space to become one of the largest software vendors in the world

Agreeing to acquire Splunk reflects Cisco’s recognition of the changing growth trends in the cloud space. During the acquisition announcement, Cisco CEO Chuck Robbins noted this purchase would make Cisco one of the largest software companies globally. That phrase seems a little dated, however, as all the largest software vendors are trying to shift their revenue streams to cloud-delivered subscription revenue, and even those revenue streams have slowed significantly in recent quarters.
 
The largest providers in the well-established IaaS space such as Amazon Web Services (AWS) (Nasdaq: AMZN) and Microsoft (Nasdaq: MSFT) have seen growth moderate, as have leading SaaS providers such as Salesforce (NYSE: CRM) and SAP (NYSE: SAP). The slowing growth for leading providers is due in part to market saturation, as most customers have already shifted to cloud-based solutions, but also reflects a consolidation in the vendor landscape. However, the PaaS market, in which Splunk participates, remains a broad and less mature space that continues to see expanding opportunity. TBR expects PaaS will be the fastest-growing segment of the overall cloud market over the next five years, increasing from $115 billion in 2022 to more than $300 billion in 2027, an average annual growth rate of 21.7%.

 

Within the security and observability segment of the PaaS space, Splunk stood out as one of the largest providers, which led to Cisco’s interest in the vendor. In its fiscal year ended March 31, 2023, Splunk increased cloud revenue by 54%, and projections for fiscal 2024 have the company generating just under $4 billion in revenue for the year. Profitability has also been on the rise, with Splunk reporting a mid-20% non-GAAP operating margin for fiscal 2023. Most recently, Splunk has continued its momentum, with cloud revenue growth of 29% year-to-year in fiscal 1Q24 (calendar 2Q23) and declines in operating expenses during the quarter, accelerating margin improvement.

 

Splunk was the largest independent vendor in its market segment, but the acquisition will bring Cisco into greater competition with some of its more diverse peers and competitors, including Microsoft and IBM (NYSE: IBM). Despite the increase in competitive dynamics, this move is not novel, as many of the largest legacy IT providers have risked competitive overlap to accelerate the modernization of their businesses to include more cloud assets. The purchase is not the first for Cisco in the PaaS space, as it most notably purchased AppDynamics for $3.7 billion in 2017 and has acquired a dozen software- or cloud-centric firms in the past two years.

 

Splunk’s ongoing cloud transition is not unlike Cisco’s

From a top-line perspective, Splunk should add nearly $4 billion in revenue for Cisco post-acquisition and cloud annual recurring revenue of nearly the same amount. While total revenue, cloud revenue and even profitability have been bright spots for Splunk recently, they come after a more than three-year transition for the vendor. Founded in 2003, Splunk was too early to be born in the cloud, beginning with a traditional software licensing model that persisted well into recent years.

 

Just as other legacy vendors such as Cisco evolved toward subscription and “as a Service” business models, so did Splunk, and it did so while experiencing many of the same financial and leadership challenges that other vendors encounter. In fiscal year 2020 revenue was still growing but software remained a majority of Splunk’s revenue. In fiscal year 2021 cloud revenue grew 77% year-to-year but could not offset the downturn in licensing revenue, and total revenue declined by 5%. It was not until fiscal year 2022 that the company’s growth turned a corner. With new CEO Gary Steele installed in April 2022, total revenue grew by double digits in both fiscal 2022 and 2023, with cloud revenue growing as a percentage of the mix and leading the expansion. After two years of steady progress in Splunk’s cloud transition, it should continue post-acquisition.

Cisco is making progress in its own shift to a subscription model

While ICT hardware will remain a cornerstone of digital transformation, growth opportunities are shifting to the software layer across Cisco’s customer segments. This trend is also driven by customers preferring to consume solutions on a subscription basis. Cisco’s ambition is to align with customers’ digital road maps and capture both software and hardware revenue in a subscription model.

 

In line with this goal, Cisco continues to capture more of its revenue via subscriptions. The company has an ongoing restructuring program not solely to cut costs but also to reallocate resources to continue shifting to a subscription-based business model. Cisco’s Partner Program encourages participants to drive sales of subscription-based offerings. The company is helping partners support this business model transition with innovations in customer financing (Cisco Lifecycle Pay) and offering Cisco Powered Service specializations, which enable partners to be certified as proficient in delivering Cisco “as a Service” solutions, increasing customer confidence in partners.

 

Subscription revenue as a percentage of software revenue was 85% in 2Q23, a 200-basis-point increase from 2Q22, and software subscription revenue volume grew 20% year-to-year. Subscription revenue spanning hardware, software and services accounted for 43.4% of total revenue in 2Q23, a decline of 60 basis points from 2Q22, though total subscription revenue volume increased 13% year-to-year. Cisco is aiming for subscription revenue to reach 50% of total revenue in 2025. Despite progress and significant M&A events, subscription revenue is lower than TBR anticipated, given the number of resources dedicated to growing this revenue stream.

 

Integrating Splunk will help change this, given that it is by far Cisco’s largest acquisition to date. Splunk can supercharge Cisco’s security and observability businesses, enhancing existing products and enabling cross-selling opportunities. The Splunk portfolio will also capitalize on Cisco’s industry-leading channel partner ecosystem, which should enable Splunk to accelerate revenue growth.

 

In the medium to long term, Cisco will explore the use of Splunk’s generative AI capabilities in its observability and security portfolios, as well as in its networking portfolio more broadly. Generative AI will have applications in network management that will simplify the process of deploying and operating enterprise networks for CIO organizations, driving opex reduction.

Splunk will extend and advance but not dramatically alter Cisco’s transformation

The proposed acquisition of Splunk is not only the largest purchase in Cisco’s history but also one of the largest ever in the technology industry. Despite the size, we do not see this purchase as forging a new direction for Cisco, which has been steadily looking to expand into adjacent markets and grow software and subscription revenue streams.
 
Acquisitions have been a staple of Cisco’s strategy over the last decade, and many have focused on business model transformation efforts. Most notably, Cisco purchased AppDynamics in 2017 and added multiple smaller purchases since then to extend and complement the AppDynamics portion of its portfolio. Observability and security capabilities not only represent a growing stream of revenue for Cisco but also are not too far afield from Cisco’s core networking solutions. Although Splunk will continue its own transformation even after the pending purchase is completed, it will bring a sizable financial contribution and should integrate cleanly with the portfolio direction underlying Cisco’s own ongoing transformation.