Blue Coat plays in sandbox with Norman Shark

Contact: Scott Denne Wendy Nather

After coming up empty in its efforts to secure funding, Norman Shark opts for an acquisition by Blue Coat. Many venture capitalists question whether sandboxing technology, which isolates suspicious code before it can execute on an endpoint, can sustain a large independent business, especially in a market where they’ll run up against FireEye’s freewheeling sales and marketing spending.

Fellow sandboxing vendor Invincea was able to pull together a $16m series C funding round this week, an effort that took up most of this year. Bromium had better luck with its $40m series C round, which we understand came with a $380m valuation.

We gather that Norman Shark anticipated revenue of $5m in 2012 while it was seeking capital for the business, though it’s not clear if it met or surpassed that goal. The purchase of the 50-person company is likely far smaller than Blue Coat’s recent acquisitions of Solera Networks (451 M&A KnowledgeBase subscribers can click here for our estimated valuation on that deal) and Crossbeam Systems (click here for estimate). We’d also note that this transaction is the second sandboxing acquisition announced this week, after Invincea said Monday that it had scooped up Sandboxie sometime earlier this year.

Broadly speaking, there’s demand among security providers to add new ‘advanced malware detection’ capabilities, which include sandboxing and behavioral analysis, as a way to compensate for what antivirus is missing. FireEye raised awareness of this new breed by going public in September, though malware analysis M&A activity had been going on for a while.

For more real-time information on tech M&A, follow us on Twitter @451TechMnA.