A trio of deals totaling nearly USD 17bn – announced over two days last month – illustrates just how frenzied cybersecurity dealmaking has become.
First, Thoma Bravo agreed to take SailPoint Technologies private for USD 6.8bn on 11 April. Two hours later, Kaseya said it was paying USD 6.1bn for Datto. The next morning, KKR agreed to a USD 3.8bn deal for Barracuda Networks.
With less than five months of the year gone, acquisitions of North American-based cybersecurity firms have reached USD 29bn. That puts 2022 on pace to best 2021’s remarkable haul of USD 67.3bn – five and a half times 2020’s total, according to Dealogic. Funding rounds also rose over the same period, but less spectacularly – doubling to USD 10.4bn.
“We expected a banner year. We didn’t expect anything like we had,” says Eric McAlpine, co-founder of cybersecurity-focused investment bank Momentum Cyber.
Private hack
Private equity has driven much of the dealmaking. While financial sponsors inked nearly a third of last year’s 262 M&A and funding deals, they accounted for three-quarters of its value – or USD 58bn. A handful of mega transactions skewed the data: Advent International’s USD 15.4bn acquisition of McAfee, Thoma Bravo’s USD 12.4bn buyout of Proofpoint, and Francisco’s USD 5.4bn purchase of Quest Software.
PE likes the sector’s growth and maturity, says McAlpine. Microsoft [NASDAQ:MSFT] grew its cybersecurity business by 45% to USD 15bn in 2021. Much growth is down to the digital transformation of enterprises, accelerated by the pandemic, which forced IT departments to manage systems remotely and employees to collaborate from home.
No wonder financial sponsors keep investing. Thoma Bravo has bought SailPoint for a second time, after exiting the identity management company via IPO in 2017. A big cybersecurity booster, Thoma Bravo recently raised USD 26bn across three funds.
Cloud wars
The cloud wars are also driving activity.
The USD 5.4bn acquisition of Mandiant in March by Alphabet's [NASDAQ:GOOG] Google now gives the web search giant greater credibility with business customers, says Ubaid Dhiyan, a software banker at Union Square Advisors.
Aimed at differentiating Google’s cloud platform as more secure than Amazon’s [NASDAQ:AMZN] AWS and Microsoft’s Azure, the deal could push the two market leaders – along with another challenger, IBM [NYSE:IBM] – to respond with their own acquisitions. “You can only imagine the conversations in those boardrooms after this deal,” says McAlpine.
In cloud security, startups working with containers or Kubernetes – computing environments that help developers create software applications in the cloud – is an area to watch. Several cloud security unicorns are on track for an IPO – namely Aqua Security, Lacework, Orca Security and Wiz – but could be targeted by very large tech companies, says McAlpine. Several smaller ones – such as Fairwinds, Anchore and Sevco – are doing interesting things in cloud security and eventually could become acquisition candidates, he adds.
Trust no one
Technologies that enable zero trust network security – where every user needs to be verified before gaining access to a company network – will also flourish, says Dhiyan. Large security vendors such as Cisco [NASDAQ:CSCO], Palo Alto Networks [NASDAQ:PANW], ZScaler [NASDAQ:ZS] and Netskope “are all talking about zero trust,” he says.
Building blocks for that approach include identity management players like Okta [NASDAQ:OKTA] and passwordless authentication players like Stytch, 1Kosmos, Secret Double Octopus and LoginID, says Dhiyan. Versa Networks, a provider of secure network access, is another with a successful product, he adds.
“These companies are getting funded and M&A interest,” says Dhiyan.
