Data backup and storage company Carbonite to buy Webroot, a provider of AI-powered cloud security software for networks and endpoint devices, for $618M
Brian Dowling / Xconomy :
Context & Ripple Effects
This deal is the second step in Carbonite's roll-up from consumer online backup into a broader data-protection vendor: a year earlier it bought Dell EMC's enterprise Mozy cloud backup service for $145.8M, financed with cash plus a $120M revolving credit line. Adding Webroot's AI-powered endpoint and network security for $618M moves Carbonite from storing data to defending it.
The timing matters because the strategy had a short shelf life — within months, OpenText agreed to acquire Carbonite itself for $1.42B, suggesting the combined backup-plus-security asset was built partly to be sold. The deal also lands amid reputational risk on the target side: relationships note Webroot incidents where it misclassified Windows system files as malware, bricking millions of managed PCs, and flagged Facebook as a phishing site.
First-order effects
- Carbonite immediately gains an AI-driven endpoint and network security product line alongside its backup business, letting it sell protection-and-recovery bundles to consumers and SMBs under one roof.
- Webroot exits as an independent vendor, and its channel of managed service providers now has a single owner for both their backup stack and their security stack — with the recent false-positive episodes becoming Carbonite's integration problem to fix.
Second-order effects
- Rivals in SMB data protection face a converged competitor: Acronis, which two years later raised $250M at a $2.5B+ valuation, competes directly on the same backup-plus-security bundle thesis.
- The premium multiple Carbonite paid relative to its own Mozy purchase signals to other backup vendors that security capability is the scarce asset worth overpaying for, accelerating bid activity across the category.
Third-order effects
- The pattern — Carbonite absorbing Mozy then Webroot, then being absorbed by OpenText, with Cohesity later agreeing to buy Veritas' data protection unit in a deal valuing the combined entity at $7B — points to backup and endpoint security consolidating into fewer, larger data-protection platforms.
- If convergence holds, standalone SMB backup tools and standalone antivirus become subsumed features inside platform suites, shifting competition to whoever owns the customer relationship across both functions.
The trend: Data protection is consolidating through serial M&A as backup vendors acquire security capabilities and both are ultimately folded into larger platform companies.