Sybari Software, a small privately held company that specializes in antivirus and antispam software for messaging and collaboration servers, will be acquired by Microsoft. Among other assets, Microsoft will get access to Sybari technology that lets multiple antivirus engines operate simultaneously—a potentially useful capability that could find its way into the next version of Windows.

Sybari had filed for an initial public offering with an estimated value of about US$61.6 million, and Microsoft disclosed no specifics about the financial terms of the acquisition or how and when it would bring Microsoft-branded versions of Sybari’s products to market.

Why Sybari?

Sybari is the second antivirus company Microsoft has acquired. In June 2003 Microsoft acquired the antivirus technologies of GeCAD, a small Romanian antivirus company. Since the acquisition of GeCAD, Microsoft’s customers have expected it to announce the release of a Microsoft-branded antivirus product, a strategy confirmed by Bill Gates, Microsoft’s chief software architect, in his keynote address at the RSA Conference on security in Feb. 2005. However, Gates did not share any details or roadmap for that product.

In the meantime, Microsoft is using GeCAD’s expertise to create virus removal tools that remove viruses, worms, and Trojans from infected computers. Microsoft updates these virus removal tools on the second Tuesday of each month, timed to coincide with the release of security bulletins and updates.

The Sybari acquisition differs from the GeCAD acquisition in several ways. First, rather than focusing on desktop or client antivirus solutions, Sybari makes antivirus tools for messaging servers, such as Exchange and IBM’s Domino, and collaboration servers, such as Microsoft's Windows SharePoint Services, SharePoint Portal Server, and Microsoft Live Communications Server. (Microsoft's IT department already is a customer and uses Sybari technology for its messaging and collaboration servers.) Second, and most important, although GeCAD's technology (like most other antivirus products) uses a single antivirus scanning engine and signature file, Sybari’s Antigen products are built around technology called the Sybari Multiple Engine Manager (MEM) that can manage and coordinate several scanning engines with their associated signature files. This provides redundancy: a virus that compromises or gets past one antivirus scanner could be detected by other scanners with different signature files.

Because of the popularity of Sybari’s products and their unique architecture, the Sybari acquisition will likely follow the model of the Giant Software antispyware acquisition, with Microsoft moving quickly to release Microsoft-branded versions of the Sybari products. But perhaps more important, Microsoft could also implement the Sybari MEM technology in future versions of Windows OSs to allow users to run multiple antivirus and antispyware solutions simultaneously—for example, a Microsoft GeCAD-based engine working with antivirus engines from competitors such as McAfee, Symantec, and Trend Micro, or antispyware engines from Microsoft and other third-party vendors, such as CA PestPatrol or Sunbelt Software's CounterSpy.

In addition to building server products for Microsoft platforms, Sybari software also offered versions of its Antigen-based products for Notes and some open-source solutions. Microsoft indicates it will continue to support Sybari’s Notes customers, but Microsoft has not provided details on how it will support Sybari products that were previously licensed under open source licenses.

Resources

Sybari and its Antigen products are described at www.sybari.com.

How Microsoft uses Sybari’s products to protect its communication and collaboration infrastructure is available at www.microsoft.com/presspass/features/2005/feb05/02-08Sybari.asp.

The virus removal tools based on GeCAD technology are described in "January Updates Include New Tool" on page 17 of the Feb. 2005 Update.

The Giant Software acquisition is described in "Software Giant Acquires Giant Software" on page 30 of the Jan. 2005 Update.