On the heels of acquiring enSilo, Fortinet is buying CyberSponse, a security orchestration, automation and response (SOAR) platform provider.

CyberSponse, already a Fortinet Security Fabric partner, will further extend the automation and incident response capabilities of FortiAnalyzer, FortiSIEM and FortiGate. Financial details regarding the acquisition weren’t disclosed.

Eric Parizo, senior analyst with Ovum, tells us if anything, this move increases the pressure on Cisco to make a similar acquisition. He said this acquisition is “sensible and opportunistic.”

Fortinet’s Ken Xie

“Cisco is building an organic solution, Cisco Threat Response, to facilitate integrated response actions across its product portfolio, but an acquisition would potentially help accelerate its efforts,” he said.

In a letter to partners and customers, Ken Xie, Fortinet‘s founder and CEO, said this acquisition again expands Fortinet partners’ security offering and addressable market, adding value for end customers with integrated solutions for the security operations center (SOC).

“MSSPs will be able to realize the full value of this combination, and deliver a broad and efficient set of managed security service offerings, beyond traditional security device management all the way through to ‘full stack’ managed detection, prevention and response with FortiAnalyzer, FortiSIEM and FortiInsight, as well as the recently acquired FortiEDR offering,” he said. “As we progress through the post-merger integration, we will keep you updated on additional integrations, use cases and success stories.”

Fortinet plans to continue the investment and support for CyberSponse’s product, Xie said.

“As with any acquisition there will be some degree of post-acquisition integration work, but we will work to ensure the post-merger integration is as smooth as possible,” he said.

Joseph Loomis, CyberSponse’s founder and CSO, said “this is an ideal match.”

“The combined powerhouse of Fortinet’s Security Fabric and CyberSponse’s SOAR technology will ensure customers are protected by the most sophisticated global security operations platform that includes hundreds of integrations enabling streamlined out-of-the-box playbook execution,” he said.

Parizo said CyberSponse has fewer than 100 employees, has received less than $8 million in funding and is believed to have struggled to grow while “competing with a cadre of larger, better-funded rivals, including [companies] like Swimlane and Siemplify, as well as those that have already been acquired such as Demisto (by Palo Alto Networks), Phantom Cyber (by Splunk), and the former Invotas (by FireEye).”

“The capabilities offered by SOAR products will only become more important as the concept of XDR (integrated threat detection and response across endpoints, networks, clouds and beyond) increasingly becomes the norm in the marketplace,” he said. “While this is an important and useful technological piece that will help to offer front-end integration of its portfolio, ultimately it’s not a differentiator as key rivals such as Palo Alto Networks, FireEye and Splunk have already made orchestration acquisitions.”