Cisco’s $28bn Acquisition of Splunk
Written by: Lamiss Boughamoura
Deal Overview
Acquirer: Cisco Systems Inc
Target: Splunk Inc
Total Transaction Size: $28 billion
Announcement Date: September 21, 2023
Closing Date: March 18, 2024
On March 18, 2024, Cisco Systems completed its $28 billion acquisition of Splunk, paying $157 per share in an all-cash transaction. The deal represents a 31% premium to Splunk’s trading price prior to the announcement. Cisco funded the acquisition through a mix of existing cash and $13.5 billion in new debt issuance, marking the largest transaction in its corporate history.
The transaction addresses Cisco’s strategic objective to expand beyond its core infrastructure and networking portfolio by acquiring a fast-scaling analytics platform with deep penetration in enterprise IT operations and cybersecurity. Splunk’s $4 billion+ in annual recurring revenue and leadership in log data analysis provide Cisco with an immediate foothold in the mission-critical systems that underpin enterprise resilience.
Market reaction was initially mixed. Cisco shares fell 4% on the day of the announcement, reflecting investor concerns around integration execution and the deal’s valuation. However, sentiment improved following guidance that the transaction is expected to be free cash flow positive in the first year and accretive to non-GAAP EPS by FY2026. Cisco also expects gross margin accretion and long-term revenue acceleration.
Acquirer Overview: Cisco Systems Inc
Date Founded: 1984
CEO: Chuck Robbins (2015-Present)
Market Cap: $220 billion
LTM Revenue: $57 billion
LTM EBITDA: $17.2 billion
Figures reflect Cisco’s financial performance for the twelve months ended July 29, 2023 (FY2023), the latest fiscal year prior to transaction close.
History & Background
Cisco began as a Silicon Valley networking startup in 1984 and has grown into one of the largest digital communications and enterprise infrastructure companies in the world. Initially dominating the market with routers and switches, the company played a pivotal role in building out the backbone of the modern Internet. Cisco went public in 1990 and scaled through the dot-com era via aggressive hardware expansion and acquisition. In 2014, the firm shifted to IoT and network automation.
Under CEO Chuck Robbins since 2015, Cisco has undergone a strategic transformation from a hardware-centric business into a diversified technology platform focused on software, security, and hybrid infrastructure. Since 2018, it has invested in AI and machine learning. The pivot has been accelerated through acquisitions such as AppDynamics (2017, $3.7 billion, application performance monitoring), Duo Security (2018, $2.35 billion, zero-trust security), and ThousandEyes (2020, est. $1 billion, internet performance monitoring).
Product Lines
Cisco Networking: Core switching and routing products for enterprises, service providers, and data centers.
Cisco Security: A portfolio including firewalls, endpoint protection, secure access, threat intelligence, and XDR.
Cisco Collaboration: Unified communication platforms such as WebEx, Teams, and voice/video conferencing tools.
Cisco Observability: AppDynamics and ThousandEyes form a growing observability and AIOps platform.
Internet of Things (IoT) and Edge Solutions: Secure, connected infrastructure for industries and smart environments.
Strengths
Category Leadership: Cisco is the market leader in enterprise networking hardware and software-defined infrastructure, with 50% share in Ethernet switching and >80% in enterprise routers.
Recurring Revenue Growth: Substantial recurring revenue from subscriptions, services, and software, with software now exceeding 30% of total revenue and over 80% of software sales now subscription-based.
Operational Scale: With a global presence in over 100 countries and 84,000 employees, Cisco benefits from economies of scale in manufacturing, R&D ($7.2B FY23 spend), and go-to-market.
Balance Sheet Strength: Strong cash position ($20 billion pre-deal), $14 billion annual free cash flow, and AA- credit rating provide financial flexibility for strategic investments and shareholder returns.
Challenges
Legacy Hardware Drag: Growth in core hardware segments is slowing, with some units posting flat or declining revenues as customers shift to cloud-first and hybrid solutions.
Competitive Pressure: Cisco faces growing competition from cloud-native players (e.g., Arista Networks, Juniper, Fortinet, Ubiquiti) as well as hyperscalers like AWS, Google Cloud, and Microsoft Azure offering integrated networking and security stacks.
Channel Complexity: Large enterprise customers increasingly demand integrated, flexible solutions over bundled hardware, creating pressure on Cisco’s traditional channel-led model and pricing strategies.
Market Positioning
Cisco occupies a strategic position at the intersection of enterprise networking, cloud security, and observability. While traditionally hardware-dominant, its shift toward software-defined solutions has reoriented the company toward future-proof architecture.
From a pricing and scale perspective, Cisco sits above niche competitors and below hyperscalers in terms of solution breadth. Its deep presence in network telemetry, security, and data center infrastructure allows Cisco to sell into IT, SecOps, and DevOps simultaneously.
Summary
Cisco evolved from a legacy network hardware supplier into a $220 billion enterprise technology platform through strategic repositioning and continued reinvestment. Since CEO Chuck Robbins' appointment in 2015, the firm has prioritized high-growth categories like security and observability, complementing its infrastructure base with analytics capabilities and SaaS delivery models. With $57 billion in revenue and $17.2 billion in EBITDA, Cisco remains a well-capitalized, strategically adaptive category leader, though growth challenges and execution risk in software remain relevant considerations.
Target Overview: Splunk Inc
Date Founded: 2003
CEO: Gary Steele (2022-2025)
LTM Revenue: $3.84 billion
LTM EBITDA: $107 million
History & Background
Founded in 2003 by Eric Swan, Michael Baum, and Rob Das, Splunk began as a tool for IT administrators to search and analyze logs. The company evolved rapidly into a global leader in machine data analytics, pioneering the use of operational intelligence to help organizations monitor and secure their systems in real time. After listing on NASDAQ in 2012, Splunk expanded aggressively through product innovation and strategic acquisitions such as SignalFx (2019, $1.05 billion), VictorOps (2018, $120 million), and TruSTAR (2021, undisclosed).
Under CEO Gary Steele, appointed in 2022, Splunk accelerated its shift to cloud delivery and subscription-based pricing. By 2023, the company had transitioned nearly all new bookings to cloud and term-based licenses, retiring perpetual licenses entirely. Splunk now generates over $4 billion in Annual Recurring Revenue (ARR) and supports more than 15,000 enterprise customers, including 90 of the Fortune 100. Its analytics platform underpins mission-critical cybersecurity and observability use cases across government, financial services, healthcare, and technology sectors.
Product Lines
Splunk Platform: The core analytics engine used for indexing, searching, and visualizing machine-generated data across on-prem and cloud environments. Available as Splunk Cloud Platform and Splunk Enterprise.
Splunk Enterprise Security (ES): A leading Security Information and Event Management (SIEM) solution used for threat detection, incident response, and compliance.
Splunk Observability Cloud: A suite for full-stack monitoring, application performance (APM), infrastructure monitoring, and real-user experience analytics.
Splunk SOAR: A security orchestration, automation, and response platform enabling SecOps teams to automate repetitive tasks.
Splunk IT Service Intelligence (ITSI): AI-powered IT monitoring and event correlation to support service availability and performance.
Strengths
Market Leadership and Adoption: Splunk is a category leader in SIEM and log analytics, trusted by over 15,000 organizations globally, including Coca-Cola, Intel, and Porsche.
High-Value Use Cases: Splunk’s platform supports mission-critical security, compliance, and IT operations use cases where customers are willing to pay a premium.
Recurring Revenue Base: More than 80% of Splunk’s software revenue is now subscription-based, providing strong visibility and retention.
Partner Ecosystem: Strategic integrations with AWS, Microsoft Azure, Google Cloud, Palo Alto Networks, and Salesforce enable cross-platform analytics and automation.
Challenges
Cost and Complexity: Customers frequently cite high total cost of ownership (TCO) and resource-intensive implementation as barriers to broader adoption.
Cloud Transition Margin Drag: While successful, the transition to cloud delivery has compressed short-term margins and increased R&D investment requirements.
Competition: Faces intensifying competition from cloud-native platforms like Datadog, Dynatrace, Elastic, and Microsoft Sentinel.
Market Positioning
Splunk is positioned as a premium enterprise analytics platform, particularly within cybersecurity and observability. The company commands higher price points than many competitors due to its rich feature set, scalability, and platform extensibility. Its positioning is strongest among large enterprises with complex IT environments that value flexibility, security integrations, and compliance support.
From a competitive standpoint, Splunk sits between traditional SIEM vendors (e.g., IBM QRadar, ArcSight) and modern observability players (e.g., Datadog, New Relic). It differentiates through its broad ingestion capabilities, advanced correlation logic, and deep ecosystem of content and integrations.
Summary
Splunk is a global leader in operational intelligence and cybersecurity analytics with $3.84 billion in revenue and $107 million in EBITDA in FY2023. The company supports over 15,000 enterprise customers and generates more than $4 billion in Annual Recurring Revenue. With a broad product portfolio spanning SIEM, SOAR, observability, and IT operations, Splunk is deeply embedded in high-security, compliance-intensive industries. While it faces challenges from emerging competitors and cloud-native pricing models, its strategic integrations and mission-critical use cases have made it a top-tier platform for hybrid enterprises. Splunk’s transition to a cloud-first subscription business model, completed under CEO Gary Steele, further strengthens its position as a foundational layer in the modern security and observability stack.
Motivation
For Cisco, the acquisition of Splunk is a transformational step in accelerating its transition from a legacy networking company to a comprehensive platform focused on security, observability, and AI-driven operations. The deal strengthens Cisco’s position in two of the most resilient and fast-growing technology markets: cybersecurity and data analytics.
Strategic Growth & Market Positioning - By combining two scaled enterprise software franchises, the acquisition enhances Cisco’s strategic positioning as a full-stack digital infrastructure platform. While Cisco traditionally focused on secure connectivity and network telemetry, Splunk has built a powerful analytics engine embedded across security operations centers and DevOps environments. The combination allows Cisco to deliver end-to-end visibility, real-time threat detection, and predictive AI capabilities across hybrid IT environments. Cisco estimates that the integrated portfolio expands its total addressable market (TAM) in observability and security by $60+ billion.
Platform Expansion & AI Enablement - Splunk brings a developer-friendly, cloud-agnostic platform with strong adoption in regulated industries and complex enterprise environments. The integration of Cisco’s telemetry data with Splunk’s analytics and automation layers provides a foundation for real-time, AI-enabled detection, response, and optimization. Cisco aims to use this merger to accelerate its roadmap in predictive threat intelligence, autonomous incident resolution, and full-stack observability powered by machine learning.
Financial & Operational Synergies - Cisco expects the transaction to be cash-flow positive in Year 1 and accretive to non-GAAP EPS by FY2026. The deal unlocks immediate cross-sell potential across Cisco Secure, AppDynamics, ThousandEyes, and Splunk’s SIEM and observability solutions. Management estimates $50–100 million in run-rate cost synergies over 24 months, largely from go-to-market integration, procurement efficiency, and cloud hosting optimization. Beyond cost synergies, the transaction boosts Cisco’s recurring software revenue base and improves long-term margin trajectory. Splunk’s cloud-native architecture and platform extensibility offer Cisco a more agile foundation for innovation and product unification. The deal is also expected to increase Cisco’s gross margins and software mix.
Competitive Dynamics & Strategic Imperative - For Cisco, the deal is also a strike against intensifying competition from cloud-native observability vendors like Datadog and Dynatrace, as well as cybersecurity platform players like Palo Alto Networks, Microsoft, and Google Chronicle. Splunk’s high customer loyalty and enterprise footprint including 15,000+ customers and 90 of the Fortune 100 provide Cisco with the scale and access required to compete at the platform level.From Splunk’s perspective, the decision reflects a recognition of market consolidation trends and the rising cost of innovation and customer acquisition. Joining Cisco gives Splunk access to global distribution, embedded security channels, and infrastructure-level visibility, enabling faster growth in international and mid-market segments where it has historically under-penetrated.
Deal Navigation
Regulatory Considerations
Given the minimal product overlap and the highly competitive nature of the cybersecurity and observability markets, the Cisco–Splunk deal was widely expected to pass regulatory scrutiny without complication. Cisco CFO Scott Herren described the evaluation process as “relatively straightforward,” citing the limited direct competition between the two companies and the absence of a major presence in China, where no regulatory review was triggered.
The transaction was subject to standard antitrust review in the United States and Europe, including the Hart-Scott-Rodino process. No remedies or divestitures were required. Regulatory focus centered on the potential for data aggregation or market consolidation in cybersecurity tooling, but no significant obstacles were raised.
The merger agreement included customary representations, covenants, and employee retention clauses. A transition services framework was established to preserve operational continuity post-close, and the transaction was completed in March 2024 following timely clearance from all required jurisdictions.
Financing Structure
Cisco financed the acquisition entirely in cash, with a net purchase price of approximately $28 billion. The company deployed roughly $14.5 billion of its existing cash reserves and raised $13.5 billion through a debt issuance across the investment-grade bond market.
The funding structure allows Cisco to preserve balance sheet flexibility while maintaining its investment-grade credit rating (AA-). Pro forma leverage remains conservative, with net debt expected to stay under 1.5x EBITDA post-closing, a manageable level given Cisco’s $14+ billion in annual free cash flow. The transaction does not impact Cisco’s existing dividend or share repurchase programs. Splunk shareholders received $157 per share in cash, with no stock consideration or earn-out provisions.
Integration
Key Integration Metrics
Combined annual revenue of approximately $60 billion
$50–100 million in projected run-rate cost synergies achievable within 18–24 months
Splunk to operate as a standalone business unit within Cisco with retained brand identity
Splunk CEO Gary Steele and key leadership to remain through transition period
To ensure a successful integration, Cisco’s strategy centers on preserving Splunk’s technical culture and customer trust while embedding its analytics and security offerings into Cisco’s broader full-stack observability and security architecture. Splunk’s core value lies in its deep adoption across security operations centers, regulated industries, and cloud-native DevOps teams. Cisco aims to protect this institutional credibility while harmonizing go-to-market, support infrastructure, and R&D processes.
Operationally, the integration roadmap includes unifying product telemetry across Cisco Secure, AppDynamics, ThousandEyes, and Splunk; rationalizing overlapping SG&A functions; and consolidating cloud hosting and engineering workflows. These efforts are expected to generate $50–100 million in cost synergies within the first 18 to 24 months.
Cisco has committed to maintaining Splunk’s open data architecture and cloud-agnostic capabilities, ensuring continued compatibility with AWS, Microsoft Azure, and Google Cloud. This strategic neutrality is critical to retaining Splunk’s existing enterprise customer base and channel relationships.
The integration also positions Cisco to deepen its presence in DevSecOps by embedding Splunk’s analytics into Cisco’s endpoint, identity, and network security products. Cross-leveraging customer data across platforms will unlock enhanced threat detection, automated response, and real-time observability.
From a talent perspective, retaining Splunk’s engineering and sales leadership is a top priority. Cisco has implemented a phased integration structure to preserve team autonomy in product and GTM functions for at least 12 months post-close. Splunk’s San Francisco headquarters and engineering sites will remain intact during the transition.
Valuation
Discounted Cash Flow (DCF) Analysis
Our base case DCF model yields an enterprise value of approximately $27.4 billion for Splunk, based on a WACC of 10.3% and a terminal growth rate (TGR) of 2.5%. The implied equity value stands at $26.0 billion, translating to a per-share valuation of approximately $155.43 nearly in line with the $157 per share Cisco ultimately paid in the all-cash transaction. This result implies a negligible discount of ~1.0%, suggesting that Cisco paid close to intrinsic fair value for the asset.
The model incorporates forward unlevered free cash flow estimates from 2025 to 2029, reflecting Splunk’s transition to a high-margin subscription model and continued growth in observability and security spend. Terminal value was derived using a Gordon Growth approach, and sensitivity analysis across WACC (9.9%–11.9%) and TGR (1.5%–3.5%) reveals a valuation band of $115–$184 per share.
Scenario analysis indicates:
● Best case: $157.28 per share (0.2% premium)
● Base case: $155.43 per share (1.0% discount)
● Worst case: $153.98 per share (2.2% discount)
Across these outcomes, implied valuations range narrowly around Cisco’s offer, reinforcing the view that the $28 billion transaction was competitively priced and aligned with Splunk’s intrinsic value.
Trading Comparables
A peer group consisting of Datadog, Dynatrace, Elastic, and New Relic was used to benchmark Splunk’s market valuation. Median peer metrics indicate an EV/EBIT multiple of 100.0x and a P/E multiple of 140.0x. Against these, Splunk traded at 114.8x EV/EBIT and 100.1x P/E prior to acquisition, positioning it slightly above EBIT-based valuation norms but below earnings-based benchmarks.
Using peer medians, the implied enterprise value for Splunk is $23.35 billion, which translates to an equity value of $22.87 billion and an implied share price of $134.54. This is approximately 14.3% below Cisco’s final offer price, indicating a meaningful control premium paid for strategic rationale and synergy potential.
Valuation Summary
The combination of DCF, trading comps, and strategic rationale indicates Cisco’s $28 billion offer represents a fair valuation with limited upside surprise or discount capture. Splunk’s consistent revenue growth and improving cash flow generation make it an asset capable of justifying its premium pricing, particularly when integrated into Cisco’s broader infrastructure and security portfolio.
Across best, base, and downside DCF scenarios, implied share prices range from $153.98 to $157.28, reflecting a valuation corridor within ±2.2% of Cisco’s actual offer price. The tight spread suggests the transaction was well-calibrated, reflecting both public market expectations and Cisco’s disciplined acquisition strategy.
Comparable company analysis supports this conclusion, showing Splunk’s pre-deal valuation was modestly elevated relative to peers on an EBIT basis, but below on P/E. The acquisition premium is justified by Splunk’s scale, $4B+ ARR, and cross-sell potential within Cisco’s product suite.
Risks
Talent Retention - Splunk’s competitive advantage is closely tied to its engineering leadership, enterprise salesforce, and deep-rooted developer community. Post-acquisition attrition or misalignment with Cisco’s operating structure could erode technical innovation and customer satisfaction. Preserving Splunk’s cultural identity and product velocity will be essential.
Competitive Dynamics - The observability and cybersecurity sectors remain fiercely competitive. Rivals such as Datadog, Palo Alto Networks, and Microsoft continue to invest aggressively. Failure to integrate Splunk’s analytics into Cisco’s portfolio in a differentiated and timely manner could limit cross-sell success or weaken Cisco’s positioning.
Integration Complexity - While synergies are expected, integrating large-scale cloud-native platforms into Cisco’s hybrid legacy stack poses operational and architectural complexity. Delays in aligning go-to-market teams, consolidating backend systems, or harmonising platform telemetry could defer expected returns.
Regulatory and Geopolitical Exposure - Although the transaction faced minimal antitrust hurdles, Cisco and Splunk serve federal, defense, and critical infrastructure clients. Regulatory expectations around data governance, privacy, and supply chain transparency may increase post-deal, particularly given heightened scrutiny of large U.S. technology vendors.
Margin Pressure - Splunk is margin-dilutive to Cisco in the near term. Execution risks around cost control, cloud migration economics, and long-term renewal rates may reduce expected earnings accretion if not carefully managed.
House View
Cisco’s $28 billion acquisition of Splunk creates a category-defining platform at the intersection of cybersecurity, observability, and AI-enabled infrastructure. The deal brings together Cisco’s global networking footprint and security scale with Splunk’s $4 billion+ ARR and leadership in log analytics, forming a unified architecture for secure, data-driven operations.
Despite paying close to intrinsic fair value, Cisco stands to benefit from long-term synergy realisation, expanded TAM coverage, and stronger positioning versus cloud-native challengers. Key to success will be preserving Splunk’s product independence, culture of innovation, and cloud neutrality, while driving integration in shared telemetry, go-to-market leverage, and platform unification. The transaction also accelerates Cisco’s shift toward recurring revenue and software-centric margins, reinforcing its long-term strategic transformation.