By Cassimir Medford

Cassimir MedfordCisco Systems’ agreement Thursday to acquire IronPort Systems reflects a trend of marquee technology companies snapping up security specialists, leaving a pool of startups increasingly losing customers and gaining heavyweight rivals.

The Cisco deal will force hundreds of security startups to seek more innovative or specialized niches to compete as companies such as Cisco, IBM, EMC, and British Telecom, among others, continue to grab the hot prospects. Startups that once sought business from these big companies now instead face brutal competition.

“They may have to redefine their value proposition by getting out of the water where the big fish are swimming,” said Charles King, principal analyst with Pund-IT Research.

In the last seven months there have been at least six high-profile purchases of security startups. In August 2006, IBM acquired Internet Security Systems for $1.3 billion, along with two smaller security-related companies Vallent in November and Consul in December. EMC acquired RSA Security for $2.1 billion in July. BT acquired Counterpane in October for a reported $40 million. And now Cisco has gotten into the act with its $830 million acquisition of IronPort.

It’s a sellers’ market that reflects the growing toll on corporate customers from spam, viruses, identity theft, and other security breach issues. But amid the buying spree lurks a market consolidation that's putting pressure on startups.

“That is driving customers to demand security systems from vendors like Cisco,” said Allan Krans, an analyst with Technology Business Research. “Many customers are looking for security solutions from trusted suppliers like EMC, IBM, and Cisco, rather than small startups.”

Top-tier companies are seeking startups with market-tested technology and long customer lists, not just firms with clever or interesting innovations, Mr. King said. It’s an acquisitive market that illustrates forces at play not seen in an earlier era.

“The dot-com boom days are gone—large vendors are looking for startups with good technology, and profitable businesses that can operate as standalone firms,” said Mr. King. “You spend the kind of money being spent by Cisco, IBM, and EMC and you know they are looking for startups that can pay for themselves pretty quickly.”

However, many of the acquired companies are not immediately integrated into the purchasing company. For instance RSA Security continues to operate as an autonomous unit with a close relationship to EMC, the acquiring company.

“RSA became EMC Security and the plan is that it will continue doing business the way it did before,” said Mr. King. “You will see RSA’s technology show up as features and options in EMC’s products, but RSA will continue to operate as its own business.”

Still, there are options left for startups that haven’t been acquired in the current buying spree.

Many will revamp their products to fit into new, post-acquisition niches. For instance a startup that has sold products through Cisco may choose to re-engineer its Cisco product portfolio to account for the new IronPort products.

“They were competing with IronPort for Cisco’s attention, but now they must adapt to IronPort as a partner rather than a competitor,” said Mr. Krans.

There is a short, built-in post-acquisition grace period for startups during which most existing relationships will continue despite a game-changing acquisition such as IronPort, said Mr. King.

“But ultimately, startups must grasp the new reality and assess what changes, if any, they must make,” said Mr. King.

Shares of Cisco rose $.0.34, or 1 percent, to $28.07 in morning trading.