Chef acquires German security startup VulcanoSec, launches new compliance product
Taylor Soper / GeekWire :
Context & Ripple Effects
In late 2015 the infrastructure-automation world was bolting security onto its tooling: a week before this deal, developer-focused security startup SourceClear raised $10M on the thesis that code pipelines needed security built in, and months earlier HP acquired data-security firm Voltage explicitly to build out its cloud offerings.
Chef's acquisition of German startup VulcanoSec follows the same playbook from the configuration-management side — rather than build compliance checks itself, Chef bought the team and shipped the capability as a product, turning its installed base of managed servers into the distribution channel.
First-order effects
- VulcanoSec's team and technology now sit inside Chef, whose customers get compliance auditing as a native feature of infrastructure they already run rather than as a separate vendor purchase.
- The launch puts a compliance product directly in front of Chef's enterprise buyers at no additional sales motion — the acquisition is the go-to-market.
Second-order effects
- Standalone security-scanning startups like SourceClear face a squeeze: every infrastructure platform that embeds compliance for free shrinks the budget available for point tools.
- Other configuration-management and cloud vendors face pressure to match the bundle-or-buy move, the way HP answered with the Voltage acquisition to secure its cloud stack.
Third-order effects
- If the pattern holds, security and compliance stop being a product category and become a checkbox feature of infrastructure platforms — consolidating the field around whoever owns the runtime, with independent security vendors pushed up-market or into acquisition targets.
The trend: Infrastructure-automation vendors are absorbing security and compliance capabilities through acquisition, converting standalone security startups into embedded features of the platforms enterprises already run.