Reports that

RSA Security

(RSAS)

may serve itself up to

EMC

(EMC)

in a merger surprised many watchers on Wall Street who had expected the storage giant's acquisition behavior to be more restrained.

In a statement earlier Thursday, RSA confirmed that it was in "negotiations with parties regarding a potential strategic transaction." This followed a

New York Times

report stating that the storage company EMC was close to a deal. The paper also said there may be a second suitor vying for the company.

EMC had no comment on the news.

Shares of RSA Security recently shot up 18.6%, adding $3.60 to $22.96 in recent trading; EMC was off 14 cents, or 1.2%, to $11.11.

Punk Ziegel analyst Steve Berg said RSA's encryption technology would enhance EMC's Clariion and Symmetrix networked storage products, adding that RSA's digital certificates would complement EMC's Documentum software.

"On the other hand," Berg said, "I'm pretty sure that EMC was pretty clear that they were pursuing this string of pearls strategy -- a lot of tiny acquisitions." Given RSA's market cap

of $1.7 billion before the reports, "this seems more like a brooch than a string of pearls."

"It's going against what management said they might be pursuing," Berg said.

However, EMC's apparent decision to acquire a security provider isn't surprising. At the company's analyst day in June, CEO Joe Tucci highlighted five areas that he believes could become "$1 billion businesses" for EMC; one of them was security.

EMC has made a number of relatively large acquisitions in recent years, although none has approached the size or scope of multi-billion blockbusters that have rocked the worlds of enterprise software and media. Indeed, in addition to Tucci's aforementioned "string of pearls" acquisition strategy, he also has said he prefers "tuck-in" acquisitions to blockbusters.

But EMC has never ruled out an acquisition the size of RSA, said a company spokesman.

Once a pure-play provider of storage hardware, EMC has used acquisitions

to transform itself into a hybrid provider of hardware and software, which now account for more than a third of total revenue.

Wall Street hasn't always been supportive of Tucci's strategy. The $1.7 billion for Documentum, which provides software used to manage content, was criticized as being too far afield. But the purchase of VMware, acquired in early 2004 for $625 million, has been called a "home run" and will likely post $600 million in revenue this year.

There is also some feeling on Wall Street that a major acquisition would not be the best use of the company's $7 billion horde of cash. Sushil Wagle, an analyst with Seligman Technology, which holds shares, said in a recent interview that one of the factors holding down the company's stock is fear that it will spend too much on acquisitions. A better use of cash, he said, would be an accelerated buyback of shares.

Punk Ziegel's Berg said a lot of unknowns make it difficult to judge whether an EMC/RSA deal makes sense. Even if RSA gets an offer, there is no assurance that a deal will be reached. Also, it's possible the security company is saying there is another suitor solely to bid the price up. The final price tag for the potential deal is also important to consider. Berg does not own shares and Punk Ziegel doesn't do investment banking.

Following RSA's own admission of talks, its stock was recently nearing a suggested price tag of one analyst.

"We think a $24 price per share would be a very good buyout price," said Horacio Zambrano, an analyst with Wedbush Morgan Securities, who has a buy rating on the stock. "We think the valuation is pretty reasonable." Wedbush seeks to do investment banking with the companies it covers.

Zambrano added that if RSA inks a deal with EMC,

Symantec

(SYMC) - Get Report

could feel the impact, as it also already moved into the storage area with its Veritas acquisition.

Zambrano also speculated that

Oracle

(ORCL) - Get Report

or

CA

(CA) - Get Report

might be the second bidder, as both companies use acquisitions as part of their corporate strategy for growth, and "authentication is an important linchpin of identity management."

Because many of the identity management players also partner with RSA, an acquisition by Oracle or CA "would result in "a lot more strategic partners from the other identity-management players."