Cisco announces service it claims can detect malware in encrypted traffic, amid fierce competition in its switching biz, 6 straight quarters of falling revenue
Context & Ripple Effects
By mid-2017 Cisco had posted six straight quarters of declining revenue, with the February quarter down 2% YoY as core businesses kept shrinking under price pressure in switching. The encrypted-traffic malware service is the clearest answer yet: sell security intelligence that rides on the installed network base rather than competing on switch silicon alone.
The arc since then reads as validation of that pivot — by Q3 FY2021 Security revenue was up 13% YoY to $876M even as Infrastructure Platforms grew only 6%, and Cisco reported in August 2020 that more than half its revenue came from software and services.
First-order effects
- Security teams gain a way to hunt malware inside TLS sessions without decrypting them, attacking the blind spot that widespread encryption created for perimeter defenses.
- Cisco gets a new subscription line to offset the switching price war, directly addressing the revenue decline that has run six consecutive quarters.
Second-order effects
- Rival network-security and switching vendors are pushed to match encrypted-traffic inspection or concede that their boxes can't see the traffic they carry.
- Shifting the pitch from port density to threat visibility changes procurement conversations with enterprise buyers, letting Cisco defend margins on the installed base rather than discounting hardware.
Third-order effects
- If the pattern holds, network infrastructure consolidates around platforms where the switch or router is the sensor and security is the monetization layer — the trajectory the later results bear out, with Security compounding at double digits through FY2021 while hardware stays cyclical.
The trend: Networking incumbents are converting a stagnating hardware franchise into recurring security and software revenue by making the network itself the detection point.