ArcSight

**The problem it existed to solve is worth stating in plain terms.** A large network produces millions of log lines a day from firewalls, servers, applications and intrusion sensors, each in its own format, none of which means anything alone. A failed login is noise. Four hundred failed logins from one address, followed by one success, followed by an outbound transfer, is an incident. Somebody has to notice the difference at three in the morning.

ArcSight's answer was ESM, and the architecture is the interesting part. It **normalised** every event into a common schema first, so a Cisco denial and a Windows audit failure became comparable objects, and then ran **correlation rules** over that stream. The rules encode what you already know matters. That is a real commitment: you decide in advance what an incident looks like, and the system watches for it continuously.

**Set that against Splunk, which is also on this timeline, and you have two opposite bets.** Splunk indexed the raw data and let you search it afterwards, deciding what mattered once you had a reason to ask. ArcSight decided first and watched. Rules catch what you anticipated, at the moment it happens; search finds what you did not anticipate, after you know to look. Neither is wrong, and most mature security teams eventually run something of each - but the two designs pulled the market in different directions for a decade.

The company's backing is a detail worth noticing: alongside Kleiner Perkins, its early investors included **In-Q-Tel**, the venture arm of the CIA. It went public in 2008, and by its 2010 fiscal year was reporting $181.4M of revenue from over a thousand customers with 512 employees, having grown at roughly forty per cent a year.

**HP acquired it in 2010** at $43.50 a share, all cash, about $1.5B, completing on 22 October. Then the ownership chain that this timeline keeps producing: the 2015 HP split sent it to Hewlett Packard Enterprise; HPE merged its software business into **Micro Focus**, finalised 1 September 2017; and **OpenText acquired Micro Focus in 2023**. Four owners in thirteen years, none of whom wrote it.

**And that is the contrast that makes the pair worth reading together.** Splunk stayed independent for two decades and was bought by Cisco in 2024 for around $28B as a strategic centrepiece. ArcSight was bought early, then carried along through three further transactions as one line item in somebody else's portfolio. Same market, same era, comparable technical achievement - and the difference in outcome had far more to do with when each sold than with which architecture was better.

Njemanze went on to run engineering and research for HP's enterprise security group, and later became chief executive of ThreatStream, which became Anomali.