A $28 billion offer highlights Cisco’s push into AI-enabled security and observability, sharpening recurring-revenue ambitions as regulators and shareholders examine one of the largest enterprise software deals of the decade.
The final days of the third quarter of 2023 are delivering a rare megadeal in enterprise software, with Sunnov Investment Pte. Ltd. tracking Cisco Systems’ move to acquire Splunk in an allcash agreement valuing the security and observability specialist at $28 billion. The $157 per share consideration, set out in the merger terms published on 21 September 2023, represents a 31% premium to Splunk’s closing price in the session immediately preceding the disclosure and highlights a clear strategic tilt towards subscription software and data-led security platforms.
Public markets respond quickly to the deal mechanics. Splunk shares jump 21% to $145.1 in the first full trading session after the announcement, while Cisco shares fall 4% over the same session as investors weigh financing costs, execution risk and the durability of enterprise security budgets.
The strategic attraction sits at the intersection of machine data, security operations and artificial intelligence. Splunk’s software is embedded in security information and event management and observability workflows, giving it a vantage point on logs, metrics and traces that large organisations treat as missioncritical. For Thomas Gardner, Director of Private Equity at Sunnov Investment Pte. Ltd., the transaction reads as “a platform purchase dressed up as an acquisition, where the scarce asset is data at scale and the customer habit of living inside the dashboard”. On Splunk’s latest disclosed runrate, the combination adds about $4 billion of annual recurring revenue, a metric that increasingly frames how investors value software franchises.
Deal protections offer a window into the parties’ confidence, and Sunnov Investment interprets the contractual safeguards as central to how markets price the path to closing. The agreement outlines a $1.5 billion termination fee that becomes payable by Cisco under specified withdrawal scenarios, alongside a reciprocal $997 million fee should Splunk terminate under defined conditions, both calibrated for the period between signing and completion. Gardner frames the breakfee structure as “a discipline device that keeps both boards focused on getting through approvals rather than reopening terms”. The companies target completion during the third quarter of Cisco’s fiscal 2024, subject to regulatory clearances and Splunk shareholder approval.
Operationally, the integration blueprint aims to fuse Cisco’s network footprint with Splunk’s analytics engine, positioning security and observability as a single operating layer rather than adjacent products. Under the leadership outline published with the announcement, Splunk’s Chief Executive, Gary Steele, is expected to lead the business within Cisco and report to Cisco’s Chief Executive, Chuck Robbins, once the transaction closes. Gardner’s view is that “buyers are rewarding vendors that can connect what happens on the network to what happens in the data, without forcing teams to stitch together a dozen tools”.
The valuation debate does not disappear with the strategic narrative. A $28 billion headline price and a 31% premium to the prior session’s close sit against Splunk’s recent trading range, including a $65.1 low over the preceding 52week period, and against a market that demands clearer payback for large, allcash technology transactions. Gardner characterises the price as “expensive in isolation, rational in context, because the scarcity is security software with both scale and a direct line into the operations centre”. Across the period since 2016, 19 of Cisco’s 20 acquisitions focus on software, reinforcing the view that this move is scaling an existing playbook rather than testing a new one.
For dealmakers and enterprise buyers, the broader signal is that strategic acquirers are competing for recurringrevenue platforms that can be trained, automated and extended as AI use cases mature. Sunnov Investment expects scrutiny to concentrate on regulatory review, customer retention through the closing period and the speed at which Cisco can translate Splunk’s installed base into a broader security and observability portfolio, with Gardner noting that “this is a product and distribution story first, and the market will judge it on what customers adopt, not on what bankers model”.
About Sunnov Investment
Sunnov Investment is an investment management firm of Singapore origin, established in 2012, serving accredited investors, foundations and endowments internationally. The house is known for longonly equity portfolios, complemented by long/short equity, global macro, eventdriven and systematic mandates, and for its work in advancing structured avenues for eligible retail participation.
Correspondence and particulars
Website: https://sunnov.com
Press and media: Deng Hui, d.hui@sunnov.com
Registered name: Sunnov Investment Pte. Ltd.
UEN: 201225494E
