Upload
others
View
0
Download
0
Embed Size (px)
Citation preview
The State of M&A in the Cybersecurity Market
October 28, 2015
1
AGC is at the Forefront of Emerging Technology Advisory
Full-service, partner owned boutique investment bank with offices in Boston,Foster City, New York, Minneapolis, and London
50+ person team – among largest in the industry dedicated to emerging growth
Sector expertise in Technology (Energy, Communications, Infrastructure / Cloud,Fintech, HCIT, Information Security / Defense, Semiconductors and Software);Digital Media / Internet / Mobile; Business & IT Services
Provide M&A, private capital raising and capital market advisory services
Strong momentum: closed 28 deals in 2014; 45+ active engagements in 2015
Founded in 2003, 259 transactions closed to date; 76 in Security
Ranked the #1 most active M&A advisor in Information Security andEnterprise Networking in 2012, 2013, & 2014 by 451 Research
AGC Ranked Top Tech Boutique: 259 Deals Done Since Inception
Confidential Materials. Do Not Distribute.
2
AGC’s Strong Track Record with the Largest Acquirers
Recognized in the Information Security community as the leading domain expertand best networked investment banker
Maria has built upon her 30+ years of industry experience and 90+ deals tomake AGC Partners the leading name in Information Security
Hosts annual premiere investor and strategic partner event in Pre-RSA SecurityConference and recently launched Disrupt!on at Black Hat 2013
Recognized by the 451 Research as Top Dealmaker in Security and EnterpriseNetworking for 2012, 2013, and 2014
Maria Lewis KussmaulCo-Founding PartnerInvestment Banking
Panelist/presenter at RSA Conference; Security Innovation Network (SINET) Advisory Board Member Has facilitated multiple “Blue Sky” strategic planning sessions with leading teams in the Security
industry such as BMC, Intel Security, Cisco, HP, Trend Micro, EMC, IBM, CA, Symantec, Oracle,Verisign, and Juniper Networks
Maria Lewis Kussmaul: Trusted Industry Advisor to Security Industry
Denotes transactions with valuations greater than $100M
201120122013
2014
2015
3
has completed aSeries C Equity Financing with
February 2015
has sold its LYNXeon assets to
March 2015
UNDISCLOSED
has been sold to
May 2015
has been sold to
July 2015
has been sold to
August 2015
has been sold to
October 2015
AGC’s Recent Security Transactions: 28 Since 2010
Transactions prior to 2011 4
AGC’s Market Leading Security Practice: 48 Deals Through 2010
Advanced Persistent Threats
Next‐Generation Endpoint
SCADA / IoT
Anti‐Fraud / Identity Management
Threat Intelligence
Application Security
BYOD & Mobile
Encryption
5
User Behavior Monitoring & Analytics
Sought After Sectors: Strategic M&A
DateDate TargetTarget EVEV LTM RevLTM Rev($ in Millions)
EV/LTM RevEV/LTM RevAcquirerAcquirer
Oct. 2015 $63,100 $24,691 2.6x
Apr. 2015 4,613 1,048 4.4x
Mar. 2015 2,400 650 3.7x
Apr. 2015 1,300 385 3.4x
Apr. 2015 850 216 3.9x
Jun. 2015 635 ND ND
Sep. 2015 425 211 2.0x
Sep. 2015 270* ND ND
Apr. 2015 240 75 3.2x
Apr. 2015 200* 60* 3.3x
6* 451 estimate
2015 Top M&A Deals
7Source: Tracxn, CapitalIQ and 451 Research
Business Model # Transactions Funding
Endpoint 15 $822
Network Security 31 $709
IAM 25 $697
Data Security 14 $445
Cloud Security 30 $399
Application Security 22 $292
Threat Intelligence 14 $211
Stealth 6 $95
BYOD Security 4 $56
Total 161 $3,726
LTM period as of 3Q’15
Illumio, CoreOS, Sumo Logic, Netskope, VectraNetworks, SentinelOne, Aorato, ForgeRock,Lookout, Sookasa, Simility
Prevoty, Zerto, Risk I/O, ThreatMetrix
Awake Networks, Okta, Skyhigh Networks, SumoLogic, Synack, Guardicore, Zerto
CoreOS, Shape Security, Ionic Security, Bit9,Synack, Area1 Security, Endgame
Cohesity, Bit9, Sumo Logic, Skyhigh, Adallom,SafeBreach, CoreOS, Okta, Keen.io, Forter
Scalyr, Cohesity, Agari, Guardicore, Lightcyber,RiskIQ, Veradocs, Zerto, KeyMe, BlockScore
Ionic Security, Shape Security, Synack, ThreatStream, Duo Security, MapR, Team8
Illumio, Okta, Tanium, Cipher Cloud, Bluebox,SignalFX, Lookout, Sookasa
Cylance, DB Networks, Okta, Vectra Networks,BlockScore
Active Investors in past 12 months:($ in Millions)
LTM Funding by Sector
8
Cybersecurity Enthusiasm Driver: Leadership is up for Grabs
As the “changing of the guards” takes place, the winners and the losers are quickly being separated
Old GuardOld Guard UndecidedUndecided New GuardNew Guard
Agents of TransformationAgents of Transformation
“Old guard” companies are scrambling to stay relevant in the rapidly changing market Public markets continue to amply reward newly public security companies, as evidenced by Rapid7 and
Cyber-Ark, which are trading up 17% and 188% after their recent IPOs, respectively
“New guard” companies are driving forward at an accelerated pace, with the fortitude andcapital to back them New Guard companies continue to strategically employee M&A as an agent of transformation
Others?
*Aftermarket performance as of 10/23/15
9
Investors Eager to Exploit Leadership Shift…
“Next generation” security players haveevolved to keep up with increasinglysophisticated attacks by utilizing:
Today’s Information Security market is at a crossroads: Traditional security solutions are focused on barrier-based perimeter defenses
But the threat is already inside the Network/Enterprise
Endpoint and network visibility / detection solutions
Adversary intelligence – studying the attackers
Big Data collection and analytics that can be tracked, combined and acted upon
Leaders are combining pre and postcompromise detection, analytics, forensicsand response
10
…and Strong Sector Growth
With security budgets increasing across the board, InformationSecurity is exhibiting strong fundamental growth that is likely toremain robust
Source: Gartner, IDC, MarketsandMarkets
According to Gartner, enterprise security budgets are shifting towards anincreased focus on detection and response, and 60% of security budgets willbe allocated to these two areas by 2020
PwC Global State of Information Security Survey indicates 10,000+ respondentsreported their information security budgets increased by 24% in 2015 as aresponse to the 38% YoY increase in security incidents
IDC cites four hot areas for growth over next 5years: Security Analytics / SIEM (10% CAGR);Threat Intelligence (10%+); Mobile Security(30%); and Cloud Security (50%)
Additionally, IoT Security – a relatively newmarket – is expected to reach approximately $29billion by 2020
11
Rev
. Mul
tiple
Ent.
Valu
e ($
M)
April 2011 January 2014
EV: $145MMultiple: 4.8x
Rev Growth: 74%
Financing - $69M
EV: $989MMultiple: 9.7x
Rev Growth: 45%
Sale
2.7 Years
9.7x
4.8x
$989
$145
Ent.
Valu
e ($
M)
Rev
. Mul
tiple
July 2013 December 2013
EV: $315MMultiple: 7.5x
Rev Growth: 66%
Financing - $30M
EV: $415MMultiple: 8.5x
Rev Growth: 66%
Sale
6 months$315
$415
7.5x
8.5x
2.7 Years
Ent.
Valu
e ($
M)
Rev
. Mul
tiple
April 2008 April 2015
EV: $27MMultiple: 7.9x
Rev Growth: 521%
Financing - $22M
EV: $200MMultiple: 3.3x
Second Sale$200
$27
3.3x
7.9x
4.5x $90EV: $90M
Multiple: 4.5xRev Growth: 13%
First Sale
4.3 Years
August 2012
640% Enterprise Value Growth
*
*451 Research estimates
*
Cyber Success Stories
Source: 451 Research
12
OpenDNS provides Cisco a significant and valuable source of threat intelligence, which it
can leverage to improve a wide range of security and network products that it already sells,
most notably, its current strategy of building out its
security IoT segment
Acquiring CirroSecure solidifies Palo Alto’s position in cloud
application control technology and gives Palo Alto the ability to secure high risk, unsanctioned
applications with superior visibility and control
Adallom fills a gap between cloud-based IAM and third party
SaaS products, allowing Microsoft customers to add
much broader control over user authorization, monitoring and control of its cloud and office
programs
Xceedium complements CA’s privileged management portfolio allowing CA to
leverage a highly scalable offering for managing privileged access to virtualized and cloud-
based resources
Acquiring Voltage Security allows HP to utilize a powerful data-centric suite of protection solutions to further extend the capabilities of the HP Atalla portfolio, to bolster security, encryption, tokenization, and enterprise key management
Proofpoint’s advanced threat detection and response
products for email and social media security and compliance
will be further enhanced by pairing them with Emerging Threats’ deep research and
intelligence capabilities
Security Strategics Enhance Product Offerings
Combined with Metafor, Caspida allows Splunk to add
analytics into its emerging SIEM product to automate
detection, and provide better alerts on attacks and insider
threats in a digestible format for SOC analysts and incident
responders
BlackBerry will have significant additional capabilities to
support iOS and Android, which is the future for the enterprise mobility management (EMM)
provider as it increasingly steps away from its own device
business
13
Big 4 M&A Activity
June 2010 April 2014 December 2014
(assets)
May 2013 September 2015
July 2015January 2011
(Professional Services Security Practice)
June 2015
(assets)
March 2014
(Professional Services Consulting Group)
January 2010 August 2011 April 2013
October 2014
(assets)
November 2014 January 2015 March 2015 September 2015
$11.4M Private Placement
14
Resolution1 combined with Fidelis provides one of the most
comprehensive offerings in the TDR and incident-response
automation spaces for a comprehensive advanced threat
defense solution
Perspecsys' encryption gateway proxy should be a straightforward plug-in to Blue Coat's own proxy-based security appliances, while enabling Blue Coat to expand its addressable cloud security use
cases to clients facing data-residency requirements
Immediate Insight brings additional advanced security analytics to FireMon, giving it
more actionable security beyond firewall monitoring
Whitebox allows SailPoint to provide customers with a single
view of users and their associated privileges for accessing
applications, systems and, now, unstructured data
With an integrated suite of solutions that both shrink the
cyber-attack surface and contain breaches when they do occur,
BeyondTrust is well positioned to address anticipated market
demands
Bay31 enables Courion to extend its technology leadership in
identity analytics and enhance the company's product offerings in
role mining and role-based access control, particularly for large and complex applications
Private Equity Platform Plays
15
2007 2008 2009 2010 2011 2012 2013 2014 2015
$193M5.9x
$80M8.0x
$24M2.0x
ND
$233M3.0x
$1.3B3.4x
ND DIVESTED APR-15
$24MAssets DIVESTED JUL-15
$85M3.4x DIVESTED JAN-15
$140M5.0x DIVESTED MAR-15
ND DIVESTED JAN-15 Not Disclosed
Defense Contractor Activity
Record of defense players purchasing cyber product
companies has been mixed; divestitures becoming frequent
16
Jan – ‘12 Sep – ‘15Jan – ‘98 Sep – ‘01
Dotcom-Era Nasdaq Trading Multiples (TTM Rev.) Recent Security IPOs Trading Multiples (TTM Rev.)
Feb – ‘14Mar – ‘00
RSA Conference Exhibitor Numbers Cyber Security Unicorns
Source: CapitalIQ
Signs of Froth?
17
Growth Alone is No Longer a Golden Ticket
So far in 2015, cybersecurity firms have received more than $3.3 billion infunding in 130+ deals, putting the year on track to beat last year’s record pace
However, recent public marketvolatility has led to increasedscrutiny by investors and a “back-to-basics” mentality in venture tolate stage funding
* YTD as of September 23, 2015
Growth rate is no longer a golden ticket to attract capital as investors are nowlooking at growth coupled with profitability and cash flow generation
Strategics have also become more cautious with respect to paying the frothyvaluations seen in recent years, portending a possible slow down in deal activity
18
YTD Cybersecurity Share Pricing
Source: CapitalIQThrough October 23, 2015TTM as of 2Q’15
Valuations Driven by Public Sentiment
Jan – ‘15 Feb – ‘15 Mar – ‘15 Apr – ‘15 May – ‘15 Jun – ‘15 Jul – ‘15 Aug – ‘15
47.8%
(HACK)
12.26%
5.2%
31.1%
*HACK metrics based on median values of holdings
*
Oct – ‘15
18.6%
Sep – ‘15
4.3%
($ in millions) Market Data Operating Data(c)
Enterprise EV / EBITDA Revenue EBITDA Revenue Growth LQ Gross LQ Adj.Company Value(a) (b) TTM 2015E TTM 2015E TTM 2015E TTM 2015E 14A/'13A 15E/'14A Margin Op. Margin(d)
Palo Alto Networks $13,232 14.3x 11.9x NM 64.5x $928 $1,113 ($105) $205 53% 51% 74% (12%)
Splunk 6,371 11.9x 10.1x NM NM 537 632 (225) 38 49% 40% 83% (43%)
FireEye 3,840 7.2x 6.0x NM NM 530 640 (397) (170) 163% 50% 63% (86%)
(HACK) 1,666 2.5x 2.6x 12.1x 11.6x 403 533 32 65 7% 9% 76% 7%
CyberArk 1,176 8.8x 7.9x 36.7x 37.2x 134 148 32 32 56% 44% 83% 18%
Barracuda 761 2.5x 2.5x NM 10.4x 299 309 5 73 18% 16% 80% (0%)
19
Public Sentiment on Growth
A: 2014 earnings released: Surpassed analyst estimates by 22%B: Congress unanimously passes Cybersecurity Information Sharing ActC: Announces $600M convertible notes offeringD: Chinese economy declines
EV: $3.8B 2013 2014 2015E
Revenue $162M $426M $640M
Growth % 94% 163% 50%
EBITDA ($143M) ($380M) ($168M)
Margin % (88%) (89%) (26%)
A
DB C
Jan – ‘15 Oct – ‘15
Jan – ‘15 Oct – ‘15
A: 2014 earnings released: Surpassed analyst estimates by 125%B: Congress unanimously passes Cybersecurity Information Sharing ActC: Acquires behavior analytics and machine learning provider CaspidaD: Chinese economy declines
EV: $6.4B 2013 2014 2015E
Revenue $303 $451M $632M
Growth % 52% 49% 40%
EBITDA ($70M) ($203M) $39M
Margin % (23%) (45%) 6%
AB
DC
Source: CapitalIQThrough October 23, 2015
20
Public Sentiment on Growth + ProfitabilityA: 2014 earnings released: Surpassed analyst estimates by 12%B: Congress unanimously passes Cybersecurity Information Sharing ActC: Acquires enterprise SaaS application security startup CirroSecureD: Chinese economy declines
EV: $13.2B 2013 2014 2015E
Revenue $483M $739M $1,110M
Growth % 49% 53% 50%
EBITDA ($0.4M) ($73M) $204M
Margin % (0%) (10%) 18%
A
DC
B
A: 2014 earnings released: Surpassed analyst estimates by 320%B: Announces secondary Nasdaq offeringC: Congress unanimously passes Cybersecurity Information Sharing ActD: Chinese economy declines
EV: $1.2B 2013 2014 2015E
Revenue $66M $103M $148M
Growth % 40% 56% 44%
EBITDA $10M $21M $32M
Margin % 15% 20% 22%
A
BC
D
Jan – ‘15 Oct – ‘15
Jan – ‘15 Oct – ‘15
Source: CapitalIQThrough October 23, 2015
21
Public Sentiment on Negative Developments
A: 2014 earnings released: Surpassed analyst estimates by 17%B: Congress unanimously passes Cybersecurity Information Sharing ActC: Announced FY’Q1 billing growth at 8%, well below 16-18% guidanceD: Chinese economy declinesE: Announced FY’Q2 billing growth at 10%, down from 15% in Q2 last year
EV: $761M 2013 2014 2015E
Revenue $234M $277M $321M
Growth % 18% 19% 17%
EBITDA ($0.2M) $8M $72M
Margin % (0%) 3% 23%
Jan – ‘15 Oct – ‘15
*CUDA FY ends in February
A
B
E
C
D
Source: CapitalIQThrough October 23, 2015
22
HACK Fund
Source: CapitalIQThrough October 23, 2015TTM as of 2Q’15
HACK Fund($ in millions) Market Data Operating Data(c)
Enterprise EV / Revenue EV / EBITDA Revenue EBITDA Revenue Growth LQ Gross LQ Adj.Company Value(a) (b) TTM 2015E TTM 2015E TTM 2015E TTM 2015E 14A/'13A 15E/'14A Margin Op. Margin(d)
Cisco $114,255 2.3x 2.3x 8.5x 8.4x $49,161 $50,163 $13,391 $13,550 0% 4% 60% 23%
Palo Alto Networks 13,232 14.3x 11.9x NM 64.5x 928 1,113 (105) 205 53% 51% 74% (12%)
Check Point 13,319 8.5x 8.2x 16.0x 14.5x 1,559 1,627 834 921 7% 9% 89% 50%
Symantec 12,224 1.9x 2.0x 6.8x 6.1x 6,272 6,152 1,809 2,019 (3%) (7%) 84% 22%
Juniper 12,071 2.6x 2.5x 12.1x 9.3x 4,640 4,834 1,000 1,303 (1%) 4% 64% 21%
VeriSign 8,911 8.5x 8.4x 13.7x 12.5x 1,043 1,055 652 710 5% 4% 82% 58%
F5 7,687 4.1x 3.9x 12.9x 9.8x 1,884 1,969 596 783 17% 10% 82% 29%
Gemalto 6,675 2.1x 1.9x 13.0x 10.8x 3,154 3,479 515 616 (9%) 17% 38% 8%
Splunk 6,371 11.9x 10.1x NM NM 537 632 (225) 38 49% 40% 83% (43%)
Booz Allen Hamilton 5,570 1.1x 1.1x 11.0x 11.0x 5,304 5,275 507 508 (5%) (1%) 24% 9%
Fortinet 5,067 5.4x 5.0x 90.4x 30.8x 937 1,009 56 165 25% 31% 72% 2%
Trend Micro 4,129 4.2x 4.0x 12.2x 11.8x 986 1,022 338 351 (7%) 6% 83% 25%
Leidos 4,109 0.8x 0.8x 9.8x 10.2x 5,063 4,960 418 403 (12%) (2%) 11% 7%
FireEye 3,840 7.2x 6.0x NM NM 530 640 (397) (170) 163% 50% 63% (86%)
SAIC 2,978 0.7x 0.7x 10.6x 9.7x 4,064 4,342 281 306 (6%) 12% 10% 6%
Sophos(e) 2,587 5.8x ND 40.0x ND 447 ND 65 ND 18% NM NM NM
Proofpoint 2,466 10.0x 9.3x NM NM 247 264 (51) 4 42% 35% 70% (32%)
Imperva 1,632 8.5x 7.5x NM NM 192 217 (56) (7) 19% 32% 78% (32%)
AVG 1,416 3.5x 3.3x 11.6x 8.9x 403 433 122 159 (8%) 16% 85% 15%
CyberArk 1,176 8.8x 7.9x 36.7x 37.2x 134 148 32 32 56% 44% 83% 18%
ManTech 1,088 0.7x 0.7x 8.9x 9.2x 1,613 1,584 122 118 (23%) (11%) 15% 5%
Qualys 1,034 7.0x 6.2x 33.7x 21.7x 148 166 31 48 24% 24% 80% 13%
Rapid7 996 10.9x 9.6x NM NM 92 104 (24) (31) 28% 35% 74% (32%)
Barracuda Networks 761 2.5x 2.5x NM 10.4x 299 309 5 73 18% 16% 80% (0%)
Infoblox 635 2.1x 1.8x NM 16.4x 306 344 (17) 39 9% 29% 79% (5%)
Radware 587 2.5x 2.7x 12.4x 14.3x 231 215 47 41 15% (3%) 83% 14%
VASCO 558 2.3x 2.3x 9.8x 9.7x 246 238 57 58 30% 18% 59% 24%
Intralinks 525 2.0x 1.9x 43.2x 13.7x 268 274 12 38 9% 7% 72% (11%)
KEYW 395 1.3x 1.3x NM 43.4x 303 312 1 9 (3%) 7% 33% (5%)
F-Secure 373 2.1x 2.3x 13.5x 12.3x 174 162 28 30 (13%) (13%) 97% 16%
AhnLab 265 2.3x ND 19.9x ND 115 ND 13 ND (5%) NM 77% 6%
Zix 265 5.0x 4.8x 25.2x 16.9x 53 55 10 16 5% 9% 83% 25%
Absolute Software 210 2.2x 2.3x 12.0x 14.7x 94 93 17 14 8% (1%) 81% 1%
Guidance Software 165 1.5x 1.5x NM NM 109 110 (6) 1 (2%) 1% 66% (13%)
Comp S.A. 109 0.7x ND 7.6x ND 160 ND 14 ND (5%) NM 25% 6%
MEDIAN $1,632 2.5x 2.6x 12.4x 12.0x $403 $533 $32 $65 7% 9% 76% 7%
Notes(a) Based on closing stock prices on October 23 2015(b) Calculated as Equity Value plus total debt, minority interest (at book value unless otherwise noted) and preferred stock, less cash & equivalents(c) Projections represent Wall Street & Yahoo Finance estimates(d) Adjusted operating margin excludes extraordinary and non-recurring items(e) Sophos fiscal year ends March 31st
23
Cyber threats are endemic
Industry leadership is in flux
Demand for effective counter-measures is strong and rising
Capital availability is at unprecedented levels and valuations are high
Cyber talent is scarce
Cyber investments and M&A will undoubtedly continue …• … but at a more discriminating pace and with more disparate
outcomes
Concluding Thoughts