Devo, Inc.

Devo operates in a market where the incumbent has a 15-year head start, $4 billion in annual revenue, and entrenched position inside every Fortune 500 SOC — and that incumbent is now owned by Cisco with $57 billion in annual revenue to subsidize a price war. Splunk spent two decades teaching security teams that SIEM complexity is the price of visibility; Devo is betting that cloud-native architecture and consumption pricing can overcome two decades of institutional muscle memory and vendor lock-in. The company has displaced Splunk in mid-market accounts where DevOps teams control purchasing and cost-per-GB matters more than brand recognition, but enterprise SOCs still default to Splunk for the same reason they default to Palo Alto firewalls — because getting fired for choosing the category leader is harder than justifying the premium. Devo raised $250 million in 2021 at a reported $1.5 billion valuation, which implies it was doing roughly $150-200 million in ARR at 8-10x multiple — respectable for infrastructure software but requiring 40%+ annual growth to justify the next round, and growth rates in SIEM correlate directly to breach headlines, which are unpredictable. The threat is not that Devo built a bad product — it is that Cisco can now bundle Splunk with every Duo and Umbrella contract and make the incremental cost of switching from zero to negative.

VERDICT: ARMED — Devo convinced mid-market security teams to replace Splunk with cloud-native architecture and consumption pricing, then Cisco bought Splunk for $28 billion and turned SIEM into a bundling weapon that Devo cannot match without becoming an acquisition target itself