Security vendor Imperva has gone on a mini spending spree, buying out web application firewall subsidiary Incapsula, cloud security firm Skyfence and bringing in-house small US OEM partner Tomium Software.

Although widely described in the press as ‘acquisitions’, the phrase ‘buy-in’ is nearer the mark, particularly for Incapsula and Skyfence, both of which have financial and personnel links to Imperva going back to their common roots as Israeli startups.

The Incapsula buy is the least surprising although the history is slightly convoluted. Founded in 2009 as a majority-owned subsidiary, Imperva’s management spun it out while increasing their holding at the same time. With Incapsula having expanded its offerings into SaaS security, presumably the time was right to reclaim the child, as it were.

In between times, in 2011, Imperva went public, raising around $90 million. Having risen since then today it is valued at well north of $1 billion. Techworld understands that Imperva has now bought out the shares it did not own from the founder and employees but that the firm’s partly Israel-based workforce will stay on.

Skyfence’s connection to Imperva is through its founders, both of whom worked for Imperva in recent years. Other current Imperva employees also invested in the firm.

If the buy-ins sound incestuous, this are part really of the nature of tech startups that originate in Israel; people know one another, invest in each other’s enterprises and eventually buy each other out.

Imperva has also bought small Austin-based database startup Tomium Software, whose technology it has been licensing on an OEM basis since 2010.

Most vendors simply buy firms and let the analysts work out why. Refreshingly, Imperva has been upfront about its desire to diversify into cloud and services.

“The strategy we are unveiling today comprehensively addresses the dangerous security gaps raised by the move to the cloud,” said senior vice president for marketing, Mark Kraynak.

“Our acquisition strategy for Skyfence and Incapsula are very similar. We seeded Incapsula four years ago because we recognized that cloud delivery would change the web application security landscape.

“In the case of Skyfence, we believe that Software as a Service (SaaS) delivery models for internally facing corporate applications will substantially change the landscape for data center security and compliance. We are investing in this space early to put us in the best position possible to help new and existing customers,” he said.