• Massachusetts, US-based vendor tapping into themes of cloud infrastructure, cost efficiency, and churn reduction.
  • Lightening of product portfolio, through disaggregation, enabling expansion into new use-cases around security, CX, bid data, and enterprise IoT.
  • Cost-conscious Vodafone an early mover on shift away from integrated hardware/software.

Interview: NETSCOUT’s journey across telco border

Interview: NETSCOUT’s journey across telco border

Source: Mohdammed Ali / Unsplash

Vodafonewatch interviewed Bruce Kelley in the spring of 2020, discussing NETSCOUT and its current perspective and outlook on tier-one service providers, including Vodafone Group and peers, accompanied by Stefano Rebosio, the vendor’s Regional Director for Europe, Service Providers.

For any technology executive in the telecoms industry, the last few years have brought more hot trends to keep up with than a bumper issue of Vogue. But for Bruce Kelley, Chief Technology Officer (CTO) and Senior Vice-President of the Service Provider segment at service assurance leader NETSCOUT, the period has been doubly complicated in terms of keeping track of new themes and ensuring his technology set-up is on point.

As well as dealing with pressure on telecoms vendors to respond to the industry downturn, and keep up with perpetual shifts in how operators buy, deploy, and run network infrastructure, the US vendor has been conducting a complete overhaul of its product portfolio, fuelled by a string of acquisitions geared towards updating and diversifying its service assurance core.

With the M&A spree has come a major bulking-up of the business, more than doubling revenue from 2015’s $450m (£346m/€396m) to $910m in 2019. Its headcount stands at 2,600, up from 1,000.

Kelley, working with NETSCOUT’s senior management team, has been melding together these M&A components into a machine that not only runs smoothly — but also has enough torque to keep up with an industry that continues to change rapidly. Within a couple of minutes of the conversation with Vodafonewatch starting, he has name-checked automation, digital transformation and digitisation, cloud-native software, 5G, enterprise InternetofThings (IoT), and edge cloud as key themes on his watch-list. “What we realise is to grow we have to go at bigger addressable markets”, he asserts.

Speculate to accumulate: NETSCOUT’s decade of M&A action
Business acquiredYearDeal valueFocus / capability
 Source: NETSCOUT.

Efflux Systems



Threat detection and analysis




Video measurement and monetisation

Communications Business of Danaher Corporation (including Arbor Networks, parts of Fluke Networks, Tektronix Communications, and VSS Monitoring)



Numerous, including network management, monitoring, and security

Accanto Systems



Voice service assurance

ONPATH Technologies



Packet flow switching

Fox Replay



Session reconstruction and replay




Voice and video network monitoring



$10.1m (initial)

Network monitoring

Economics on the edge: Kelley on the challenges that operators are facing in unlocking the 5G/edge opportunity

How edge computing and IoT are driving telcos towards multi-cloud environments…

“I would say the carriers have been slow to [move to NFV (network function virtualisation) and cloud]. Mobile edge computing (MEC) is dependent on disaggregated, virtualised data centres. One of the big promises of 5G is its ability to deliver the high bandwidth and low latency required by new MEC services, such as virtual gaming, the smart energy grid, autonomous vehicles, remote healthcare services, robotic manufacturing, smart homes, IoT devices, etc. One trend that is emerging to address the complexity of this acceleration to the 5G edge is the opportunity for cloud providers (such as AWS (Amazon Web Services), [Microsoft] Azure and GCP (Google Cloud Platform) to partner with CSPs (communication service providers). Cloud providers are beginning to package and monetise proven public cloud architecture; moving it closer to the edge on-prem[ises] within CSP real estate. This in turn facilitates services that require lower latency and massive throughput. The CSP and cloud providers will offer APIs for developers to leverage the edge for new innovative enterprise and consumer services.


Data at heart

Watchers of NETSCOUT will be familiar with the Visibility Without Borders concept that underpins the vendor’s refreshed product line-up.

Chiming with the struggles that many enterprises, including telcos, have had with collating, controlling, and converting their data into meaningful business insight, the strategy promises a full, real-time view into the “expanded universe”of physical and virtual network infrastructure that operators are now managing.

It assigns the notion of “borders” to both physical assets, such as operators’ existing 2G, 3G, and 4G network components (which Kelley describes as “north-south”-delineated, to build on the metaphor), and cloud infrastructure, which creates another (“east-west”) frontier that telcos need to see beyond. This access-all-areas reach is “not roadmap — we have it now”, says the CTO.

Layered on top of Visibility Without Borders is NETSCOUT’s emphasis on what it calls SmartData — “high-value metadata” that is converted from raw network traffic data and can be used, via application programming interfaces (APIs) to NETSCOUT’s dataset, not just for service assurance but also for broader business intelligence, security, and customer experience (CX) applications.

Kelley describes SmartData as a “high fidelity data set”, and “fuel” for a broad range of use-cases — “not just troubleshooting and break/fix, but monetising data”. With more insight into network usage, for example, comes deeper intelligence for “deciding when to scale out apps or 5G components”, he says (something Vodafone has been quietly pushing under an analytics-led SmartCapex stream led by Vodafone Germany — Vodafonewatch, #165 and passim).

Economics on the edge: Kelley on the challenges that operators are facing in unlocking the 5G/edge opportunity

How security challenges are complicating edge computing service rollout…

“As the push toward edge computing continues, CSPs will likely embrace container technologies such as Kubernetes because they offer many features of a virtual machine (VM), but without all the baggage. Designing fast, secure containers is ideal given the power and space limitations that will exist at the edge. Today, containers are like breaking into a castle. Once you break through the front door, you can go east–west and pollute everything. Let’s say I had four good developers and one poor developer, and they all wrote containers, and I break into that one poor developer. I can [then] go east–west and get into all the other areas, and it’s because there’s a shared kernel in Linux (and then it just takes one bad apple and you’ve got root access, you’ve got control). So what the industry is trying to do is wrap the container in a micro VM (a very small VM) to address this security concern. Can you wrap containers with a lightweight VM, because virtual machines are heavy and need a lot of compute? That’s one question. And two, [edge] is disaggregated, so the attack surface is huge. It’s everywhere and a lot of the attacks are very sophisticated; they’re at the application layer, not just the network layer, so you need smart detection. There are still lots of challenges in this, so I think this is going to take time.


M&A-based transition

Many of the pieces in NETSCOUT’s product jigsaw puzzle were provided by the vendor’s $2.3bn acquisition of Danaher Corporation’s communications assets in 2015. This multi-component transaction has long been billed by NETSCOUT as “transformative” for its business. In one fell swoop, it changed the company’s “size, complexity, organisational structure, and business model”. NETSCOUT provided a software platform that allowed it to “accelerate our strategic progress”, leveraging all the newly acquired assets.

While numerous business lines were bundled in with the buyout, NETSCOUT’s financial reports indicate that the two most valuable elements were Danaher’s Tektronix Communications and Arbor Networks units. They enabled it to build out the Visibility Without Borders concept, via Tektronix’ telcocapabilities and Arbor’s expertise in distributed denial-of-service (DDoS) protection. Further elements of the Danaher line-up, and other companies bought out by NETSCOUT in the interim, have given it added capabilities in both security and monitoring, for services such as IP-voice and over-the-top video.

Following the acquisition, NETSCOUT’s service portfolio has filled-out considerably. It is now largely centred around two categories:

  • The traditional core focus of service assurance, including its flagship nGeniusONE management platform and accompanying “visibility” products like probes, packet-flow systems, and test access points.
  • The newer area of cybersecurity solutions, including detection solutions for DDoS and “advanced threats”.

The security aspect is seen as a major opportunity for the vendor, especially with the architectural disruption and new threat prospects accompanying operators’ roll out of 5G and edge computing-based services (see further on). “90% of our revenue is probably break/fix, and that’s changing”, says Kelley.

Beyond this, the business is also now seeking involvement in projects beyond the immediate realm of network operations, such as in enterprise services, marketing, big data, and CX. For example, Kelley says “a large number of carriers” are now using nGenius Business Analytics (nBA), which contains a set of standardised APIs to export Smart Data or use Explorer to “‘Google Search’ SmartData, if you will” for network insights on an ad hoc basis.

“Our goal with nBA was to make things simple, meaning opening up access to Smart Data and making it affordable. This meant using industry-standard APIs and leveraging self-describing data sets (such as Kafka, Pulsar, JSON, and Avro) to allow for easy integration.


Having bulked up, NETSCOUT today has approximately 50% market-share in service assurance and its technology is installed within “around 80% of the ‘tier-ones’, globally”, according to Kelley. With the Arbor addition, the vendor is said to have inherited a similar market-share level in DDoS protection. Collectively, the company’s platforms “see one-third of the world’s internet traffic”.

“Because we’re providing visibility when we’re monitoring and troubleshooting the network, we see every subscriber, every service, end-to-end. And so that data is valuable in more than just a break/fix environment.


Another take on the new breadth of NETSCOUT’s portfolio is that it has the flexibility to let each of its telco clients“go at their own pace” in evolution of services and operations. Operators’ roadmaps for 5G, edge computing, and TelcoCloud rollout all look very different, and NETSCOUT’s Visibility Without Borders approach supports a hybrid network that enables clients to plan things accordingly.

Some NETSCOUT customers have been pushing quicker than others into data-driven use-cases, centred around SmartData. A European CSP, for example, uses NETSCOUT technology to gather “high quality” data on usage patterns and offer it as a service to planning authorities for insight into where best to site urban infrastructure. Others are much further back on the curve. Generally, Kelley says the vendor is still raising awareness of its expanded capabilities in the security space, and is “in the beginning phases” of “education around how we can help bigdata projects”.

Acquisitions only go so far

Since the Danaher buyout, NETSCOUT has been engaged in a major recalibration of its portfolio, not just inserting new products and their functionalities into its wider offering, but also — as per industry trend — seeing a shift away from integrated hardware and software towards virtualised and cloud-based deployments.

The departure from a proprietary hardware appliance model and to an open Smart Data software model has enabled the vendor to pitch its solutions as more cost-effective — and therefore build a case for broader and deeper ‘partnerships’ with telcos.

With hardware-based appliances, operators could only afford to “put you [as a vendor] in some places”, and buy “ten probes this quarter, ten next quarter”, says Kelley. “Now, what we’re finding with the affordable software model is that customers are covering the entire network and negotiating multi-year deals. The conversation has changed to, ‘what problems can we solve?’”.

Similarly, as software licences can be more easily digested, a smaller telco with less budget can “monitor their network security, the same as the first-placed provider”.

“We’re problem solvers now, and that’s been an interesting kind of dynamic to us.


The knock-on effects of disaggregation

Internally, the transition has not been straightforward for NETSCOUT and has taken “three years” so far, according to Kelley. It “disrupted us”, he concedes. However, he now describes NETSCOUT as a “pure software company”, centred around a “single architecture —the InfiniStreamNG SmartData platform”.

“The goal was simplification. The goal was cloud-native software. The goal was to reduce the total cost of ownership, so we divorced the hardware, we became very disruptive and turned ourselves into a pure software company. The majority of deals in the last year and a half have been all-software, whether this software is running on-premise or in the cloud.


In terms of go-to-market, seeding software-based, SmartData products also required timing and care. Initially, NETSCOUT pitched its new multi-year deal proposition to operators outside of its home market, “because we have a big base in NorthAmerica and we didn’t want to disrupt that”, says Kelley. “We went and worked with the operators in Australia and NewZealand and eastern European countries, to figure out the software model. It wasn’t easy”, he adds.

Now, he says software sales are ramping up in North America and the majority of its telco customers have been “transitioned to a software model”. However, the supplier still has some work to do to change perceptions of its proposition within every client. “People would normally look at us as ‘old, expensive hardware’, and all those things have gone away. And so that’s our challenge — to educate the market”.

Naturally, the way NETSCOUT targets operators has changed, too.

“We realised also that it has to be a win in finance, not just in the technical department. We used to just talk to management of engineering or operations, and now we’re meeting with finance, and getting wins with the multi-year deals and partnering. And so there’s a really disruptive, dramatic change in the way that people are buying, or want to buy, or can afford to buy.


Openness brings new friends

As well as revamping its approach to operator relationships, the refresh of its underlying technology to a software model and open APIs has enabled NETSCOUT to take a more open approach to industry partnerships. “The barriers have been removed and high fidelity Smart Data is now available and affordable everywhere”, in Kelley’s words.

The vendor is also eager to stress its “agnostic” nature when it comes to interworking with telco network and IT infrastructure. According to Kelley, NETSCOUT’s operator clients can “pick any cloud” when it comes to deploying its systems, and gain visibility across any infrastructure supplier as well as the existing physical 2G, 3G, and 4G network. “Our strategy is to be seamless —to have minimal to no impact [on other choices]”, he says, noting that Visibility Without Borders is all about “any network, any vendor, any cloud!”.

“NETSCOUT’s Visibility Without Borders offers independence and agility as things are never static… CSPs can change network equipment vendor for price reasons, network technology for efficiency, cloud provider for flexibility, and not impact the consumers of NETSCOUT’s Smart Data. The service assurance, security and big data workflows would stay the same.


Economics on the edge: Kelley on the challenges that operators are facing in unlocking the 5G/edge opportunity

How scaling out security is key to protecting edge and enterprise IoT…

“One of the big changes is the way that people address DDoS attacks. The legacy approach of backhauling all of the traffic into a centralised scrubbing centre and using security hardware appliances to separate good traffic from bad has become cost-prohibitive as the attack size increases. This is just too much traffic to backhaul. The main reason for backhauling all the traffic to a centralised location was that CSPs/ISPs could not afford to put hardware-based security appliances at all edge locations. With the paradigm shift to software, this is now possible. DDoS detection and mitigation can now be done at the edge. This has less impact on the network as bad traffic is detected and mitigated without traversing the network.


NETSCOUT, Vodafone Supplier Awards

NETSCOUT, Vodafone Supplier Awards

Source: Vodafonewatch

NETSCOUT and Vodafone: a new footing

NETSCOUT has “been doing business with Vodafone” for around 20 years, and the relationship covers “13-plus countries”, according to Stefano Rebosio, Regional Director for Europe, Service Providers at NETSCOUT. The partnership encompasses both service assurance and security, where the vendor inherited a long-term relationship with Vodafone through the 2015 buyout of Arbor and its DDoS-detection product portfolio.

The main focus of the relationship, in recent times, has been to “attack tech legacy” in line with the supplier’s shift away from aggregated products, says Rebosio. For NETSCOUT, the partnership with Vodafone appears to have been an early driver of the strategy shift, with changes beginning in or around the time NETSCOUT acquired the Danaher assets in 2015, and aligning with evolution of 4G networks. The vendor worked to “disrupt the model” after discussions at top executive level within Vodafone, as well as with engineering stakeholders and the Vodafone Procurement Company.

There has evidently been impact. The supplier landed the Outstanding Quality and Delivery award at Vodafone’s 2019 ArchSummit (Vodafonewatch, #174). Further, NETSCOUT flagged an expansion of the Vodafone relationship in 2017, securing a deal to provide a version of its InfiniStreamNG solution across the operator’s Europe Region (Vodafonewatch, #155). This was billed as a “software-only” deployment.

Looking forward, NETSCOUT is seeking to further raise awareness within Vodafone of its now software-based model and how its solutions could be used in new ways, such as to support big data analytics, and Kelley says it has “started to integrate in Vodafone with the big data groups”, regarding commercial and operational use-cases.

Vodafone Business recently referenced NETSCOUT as a partner on its expansion around analytics-centred services, encompassing enterprise IoT, network security, and location-intelligence propositions, and supported by the Group’s recent deal to migrate its “data ocean” to GoogleCloud (Vodafonewatch, #180).