Sources: AT&T is working with Barclays to solicit bids for its cybersecurity business, called AlienVault when AT&T acquired the company for ~$600M in 2018
Context & Ripple Effects
AT&T bought threat-intelligence firm AlienVault in 2018 for roughly $600M, after the startup had raised about $120M since 2007, part of a wave of carrier diversification deals that also included the AppNexus ad exchange purchase.
By early 2023 the strategy was unwinding: sources say AT&T had Barclays shopping the cybersecurity unit to bidders, following earlier signals like the DirecTV sale talks with PE firms. The process ultimately resolved in AT&T completing the divestiture and spinning the group into LevelBlue, a standalone managed-security provider with 1,000+ staff across 10 countries.
First-order effects
- Barclays' bid solicitation puts AT&T's managed-security operations formally on the block, forcing potential acquirers to price the unit against the ~$600M AT&T paid for AlienVault in 2018.
- The unit's existing enterprise customers face ownership uncertainty while the sale runs — service continuity under a new parent becomes their near-term question.
Second-order effects
- A spun-out, standalone security vendor changes the competitive math for rival MSSPs, who gain a peer unshackled from carrier priorities but lose AT&T's balance-sheet backing.
- The unwind mirrors the DirecTV pattern: capital tied up in non-core assets gets returned to the telecom core, where AT&T simultaneously committed roughly $14B over five years to the Ericsson open-network modernization.
Third-order effects
- If the pattern holds, the 2015–2018 era of carrier conglomerate-building — media, advertising tech, security services — gives way structurally to focused connectivity operators, with private equity as the recurring buyer of spun-off units.
- Managed-security businesses carved out of telcos may increasingly compete as independent specialists rather than bundled add-ons, reshaping how enterprises buy security services from former carriers.
The trend: US carriers are systematically unwinding their diversification-era acquisitions to refocus capital on core network infrastructure, selling non-core units to buyers willing to run them standalone.