What Does Google’s Cybersecurity Buying Spree Mean?

When you make a promise to a President, it’s probably a good idea to keep to your word. So when Google promised President Biden in August, 2021, to invest $10 bn in cybersecurity over the next ten years, everybody knew the tech world was probably in for an interesting ride.

One year later, Google has made two substantial purchases that puts it almost 60% of the way towards its 10-year goal.

On January 4^th, 2022, Google announced its cloud division had spent $500 m on acquiring a cybersecurity startup by the name of Siemplify.

A Good Year For the Cyber-Attackers

Siemplify provides security orchestration, automation and response solutions, all of which are useful if you’re aiming to aggressively join the cybersecurity market, or be in a position to guarantee cloud computing with a robustness to cyber-attack.

2021 was a record year for cyber-attacks on businesses, seeing 22% more attacks reported than the previous year, so Siemplify was doing well and seeking more independent funding when Google swooped in and picked it up.

Then, on March 8^th, Google outdid itself by an order of magnitude, announcing it had acquired cybersecurity specialist Mandiant for $5.4 bn. Mandiant has been around in the cybersecurity space since 2004, and has been at the heart of investigating some of the biggest cybersecurity threats and data breaches of recent years.

Now, Mandiant will work for Google – and more specifically, for Google’s cloud customers. Mandiant will extend Google’s cloud security offerings in five key areas: “advisory services, threat detection and intelligence, automation and response tools, testing and validation and managed defense,” said Google on announcing the acquisition.

In other words, Mandiant will provide a “seamless extension of customers’ security teams.”

Rose-Tinted Google History

So – apart from helping to fulfil a pledge to a President, why has Google put so much of its money where its mouth is when it comes to cybersecurity?

If you love Google, and want to always give it the benefit of the most rose-tinted doubt, you could argue that the company saw the rise in cyber-attacks, and acted to ruggedize its user-community against the criminal threat of the age.

You could make that case, at least until you remember that Google has so legendary a reputation for investing in projects that might go somewhere, and then dropping them like hot bricks when they don’t, that there’s actually a Twitter handle dedicated to charting the projects @killedbyGoogle (although ironically, the account is currently suspended). And until you remember that earlier this year, Google essentially manhandled SMBs who had built their business model around Google Workspace from a free platform onto a paid subscription plan for no terribly good or available reason, except to recoup some losses the company suffered in 2021.

The Cloud War

If you love Google slightly less, you could more cogently and consistently argue that the aggressive moves into the cybersecurity space are the start of a late run to catch up with the likes of Amazon Web Services (AWS) and the ubiquitous Microsoft in the field of cloud ownership.

There is a silent corporate war going on right now to become the world’s biggest name in cloud computing and cloud space. To some extent, that’s only rational – gold rushes are caused by the most available players seeking to make the most out of a valuable commodity, and cloud computing space is one of the most valuable resources of the last decade, made even more valuable as the enabling technology of the remote work model that saw the world’s economy through Covid-19, and looks set to stay now the pandemic – at least in its most deadly phase – has passed.

Cyber-attackers though are the fly in everyone’s ointment. They are the modern equivalent of pirates – strategizing and executing unscrupulous raids on the data of both individuals and companies. It’s estimated they will cost the world’s economy in the region of $10 trillion per year by 2025. Or next week, if you translate it into tech industry terms.

The Latecomer

And Google is universally admitted to be late to the cloud ownership race – and even now it’s arrived, it has struggled to make the kind of mark you would expect of the $1.5 trillion company.

(Just before we get into the reasons for Google’s poor performance in the cloud space, it’s worth comparing those two figures for a second. Google’s net worth – roughly $1.5 trillion. Cyber-attackers by 2025 will be taking $10 trillion per annum out of the world economy. That’s an overall theft of six Googles and a cherry on top. Each year. If you wanted a good reason to stop them, that might well do it).

Google Cloud has not been the world-conquering behemoth the company probably expected it to be when it was launched. Right now, Google Cloud accounts for just 7% of the world market, putting it an almost insignificant third in this game of multi-billionaires, behind Microsoft Azure on 17%, and AWS on an impressive 32%. Google has struggled to make in-roads on the market share of the other two, instead growing and shrinking in line with the general rise and fall of the cloud market.

The Potential Prize

But if you could be the cloud provider who could guarantee the least likelihood of cyber-attack, the easiest mitigation, the most investigation, and the greatest likelihood of resolution and a rapid reinstatement of stolen or sensitive data, that would be an almost instant game-changer. If you could offer a safe backup space for all a company’s most vital day-to-day data, you could almost entirely reduce the need of big companies, when they get attacked, to pay the enormous ransoms cyber-hackers currently demand and are paid.

That would be worth an enormous amount to the world’s business community – and almost by default might catapult any cloud platform that could legitimately offer that safety from cyber-attackers into a position of market dominance.

That looks to be at least part of the reason behind these recent colossal acquisitions – though, this being Google, the full plan probably won’t be visible until much later in the process.

Draining The Pool

If nothing else, Google’s aggressive acquisitions will act as a starting gun for the other two big players, to either create their own bespoke response to cyber-attacks, or to buy up other cyber-specialists to match or out-do Google’s plans – because ultimately, what Google has realized is that cloud space is not the most valuable asset in the game.

Safe cloud space is.

There is a downside to all this multi-billionaire corporate warfare. The industry is already chronically short on cybersecurity expertise. In fact, that shortage plays into the rise in prevalence of cyber-attacks over the last few years.

By scooping up both Siemplify and Mandiant in such a short time, Google has siphoned off some of the best cybersecurity experts in the marketplace and bound them more or less exclusively to do the bidding of Google and its customers. Any necessary retaliatory acquisitions by Microsoft and AWS will only thin out the talent pool even further, leading to a siloing of safe cloud space – a monopoly that could effectively split the safety of the business world in three for the foreseeable future.