Palo Alto Networks has bought up Twistlock and PureSec, securing itself a chunk of the nascent DevSecOps or cloud native security worlds, depending on your point of view.

Both target firms’ platforms seem set to be subsumed into their new parent’s Prisma cloud security platform, also announced yesterday.

Twistlock has been in business for barely four years, and has pitched itself as a “comprehensive cloud native security platform — protecting all your workloads across any environment — hosts, containers, and serverless.”

However, it was Twistlock’s container expertise which Palo Alto Networks flagged up, when it announced it will pay $410m for the  Israeli-based firm. This represents a nice payday for Twistlock’s investors, who have put just over $63m into the firm to date.

Palo Alto’s second buy, PureSec, only emerged from stealth mode in January 2018, and has revealed just $10m of funding to date. No price was put on the deal.

PureSec has squarely focused on securing serverless applications, with its eponymous Serverless Security Platform, for AWS, Azure, Google and IBM’s serverless platforms. It claims to cover the entire CI/CD lifecycle for serverless apps, by scanning apps in development, and providing a runtime to protect against application layer attackers.

Both deals are expected to close before the end of the current financial quarter.

Palo Alto Networks said “With the additions of Twistlock and PureSec to the Prisma cloud security suite, Palo Alto Networks will be uniquely positioned to secure today’s modern applications throughout the entire life cycle, enabling organizations to deliver innovations that are secure, reliable, and scalable.”

If Prisma sounds unfamiliar, that’s because it too was only announced yesterday. The suite spans four separate lines. Prisma Access “secures access to the cloud for branch offices and mobile users anywhere in the world with a scalable, cloud-native architecture, blending enterprise-grade security with a globally scalable network.”

Prisma Cloud is pitched as providing  “continuous visibility, security, and compliance monitoring across public multi-cloud deployments.” Prisma SaaS is a multi-mode cloud access security broker, “that safely enables SaaS application adoption.”

Lastly, VM-Series “is a virtualized form factor” of Palo Alto Networks’ firewall pitched at private and public cloud environments.

The move will send ripples through the traditional and cloud native security worlds.

On the one hand, it highlights the realisation by traditional security players that they have to extend their offerings, which means either rapid building or buying.

Sysdig’s Apurva Dave wrote in a blog about the Twistlock deal, “PAN could have thrown hundreds of engineers at the container security challenge and built something if they had chosen to. But they would need to wait 18-24 months, quite possibly longer, and would have had to overcome a steep learning curve in understanding cloud-native security.”

On the other hand, cloud native startups with an eye on a future payday might also be concerned there are only so many potential acquirers out there – and simultaneously acutely conscious that some of their erstwhile friendly competitors now have the resources of much bigger, enterprise savvy traditional security firms behind them.