It’s essential for older companies to recognize changes in the marketplace or face the brutal reality of being left in the dust. F5 is an old-school company that launched back in the 90s, yet has been able to transform a number of times in its history to avoid major disruption. Over the last two years, the company has continued that process of redefining itself, this time using a trio of acquisitions — NGINX, Shape Security and Volterra — totaling $2.2 billion to push in a new direction.
While F5 has been associated with applications management for some time, it recognized that the way companies developed and managed applications was changing in a big way with the shift to Kubernetes, microservices and containerization. At the same time, applications have been increasingly moving to the edge, closer to the user. The company understood that it needed to up its game in these areas if it was going to keep up with customers.
Taken separately, it would be easy to miss that there was a game plan behind the three acquisitions, but together they show a company with a clear opinion of where they want to go next. We spoke to F5 president and CEO François Locoh-Donou to learn why he bought these companies and to figure out the method in his company’s acquisition spree madness.
Looking back, looking forward
F5, which was founded in 1996, has found itself at a number of crossroads in its long history, times where it needed to reassess its position in the market. A few years ago it found itself at one such juncture. The company had successfully navigated the shift from physical appliance to virtual, and from data center to cloud. But it also saw the shift to cloud native on the horizon and it knew it had to be there to survive and thrive long term.
“We moved from just keeping applications performing to actually keeping them performing and secure. Over the years, we have become an application delivery and security company. And that’s really how F5 grew over the last 15 years,” said Locoh-Donou.
Today the company has over 18,000 customers centered in enterprise verticals like financial services, healthcare, government, technology and telecom. He says that the focus of the company has always been on applications and how to deliver and secure them, but as they looked ahead, they wanted to be able to do that in a modern context, and that’s where the acquisitions came into play.
As F5 saw it, applications were becoming central to their customers’ success and their IT departments were expending too many resources connecting applications to the cloud and keeping them secure. So part of the goal for these three acquisitions was to bring a level of automation to this whole process of managing modern applications.
“Our view is you fast forward five or 10 years, we are going to move to a world where applications will become adaptive, which essentially means that we are going to bring automation to the security and delivery and performance of applications, so that a lot of that stuff gets done in a more native and automated way,” Locoh-Donou said.
As part of this shift, the company saw customers increasingly using microservices architecture in their applications. This means instead of delivering a large monolithic application, developers were delivering them in smaller pieces inside containers, making it easier to manage, deploy and update.
At the same time, it saw companies needing a new way to secure these applications as they shifted from data center to cloud to the edge. And finally, that shift to the edge would require a new way to manage applications.
F5 did not want to get left behind as these changes unfolded, so it did what large companies often do, it decided to buy the components it believed could help push it to this next evolutionary level.
Going cloud native
If you want to change the way you manage applications, a good first step is an applications server component. So F5 acquired NGINX for $670 million in March 2019.
The company saw this as a way to help customers move to these modern approaches where it believes the market is going and that required a container native platform as a starting point. “We bought NGINX because it was in response to this trend that we saw where all applications are going to be in container-native environments,” Locoh-Donou said.
Lawrence Hecht, founder and principal analyst at Hecht Consulting, says the acquisition also fit neatly into F5’s cloud-native vision. “NGINX gave F5 a user base with the web server stuff and growth opportunities with [cloud-native components like] service mesh and Kubernetes,” Hecht said.
Although, as TechCrunch’s Arman Tabatabai pointed out in an analysis post-sale, F5 investors weren’t thrilled with this move, they probably didn’t know that it was just step one in a three-step plan and it would make more sense as time went on.
Application-centric security
In December 2019, F5 struck again with the next step in its plan: securing applications in this cloud native context. For that piece, the company purchased Shape Security for $1 billion. It wasn’t cheap, but securing applications in a modern way was essential to this approach.
“You know, there was a lot of focus in endpoint security and network security in the last 15 years, but we think that application security is going to be the security problem of the next decade because this is where most of the value is created and transacted,” Locoh-Donou explained.
As that change happens, it means that if there is an attack that allows for fraudulent behavior in an application, it could have a huge impact on F5’s large enterprise customers. Shape is designed to sniff out fraud and abuse in online and mobile applications.
Locoh-Donou certainly recognized this in the statement he made after the purchase was announced. “With Shape, we will deliver end-to-end application protection, which means revenue generating, brand-anchoring applications are protected from the point at which they are created through to the point where consumers interact with them — from code to customer,” he said at the time.
Moving to the edge
The final piece of the puzzle was acknowledging that computing was shifting to the edge. That would involve moving applications closer to the user, whether that’s a human or a sensor. To achieve this goal, F5 acquired Volterra in February for $500 million.
Hecht believes this acquisition was one of the most important of the three. “Volterra has a practical solution to edge Kubernetes deployments — making it easier to deploy infrastructure services in edge clouds, but the thing that was more compelling to me was the story it was telling. It was saying it was providing an “application delivery network” in the same way that Akamai has always provided a [content delivery network or] CDN,” Hecht told me.
It is precisely that functionality that F5 was looking for. In fact Locoh-Donou believes that applications, which used to live in a data center or in a public cloud, are now going to be distributed across multiple environments and at the edge, and having Volterra technology in the fold is going to give his company a distinct advantage.
“What happens at the edge is that customers want to cache not just content, but they want to run the business logic of an application very close to the user, not the whole application, but a micro service of an application needs to be run very close to the user, or to a sensor, or to a driverless car, or to something to create the right experience,” he said.
When you put all three of these pieces together, you suddenly have a complete picture with a web server component to run cloud native applications, a security piece to secure them, and finally the ability to shift parts of the application to the edge for speed and agility,
When you spend over $2 billion in a short period to leverage a certain set of technologies, it’s good to know that there is a plan behind those activities that is driven by sound business sense. F5 knows where it wants to go and bought the pieces to get there. Now it will be up to the company to incorporate those components into something coherent for its customers in the coming years. The success of these investments will hinge on how well they are able to do that.