The State of M&A in the Cybersecurity Market. October 28, 2015

Transcription

1 The State of M&A in the Cybersecurity Market October 28, 2015

2 AGC is at the Forefront of Emerging Technology Advisory Full-service, partner owned boutique investment bank with offices in Boston, Foster City, New York, Minneapolis, and London 50+ person team among largest in the industry dedicated to emerging growth Sector expertise in Technology (Energy, Communications, Infrastructure / Cloud, Fintech, HCIT, Information Security / Defense, Semiconductors and Software); Digital Media / Internet / Mobile; Business & IT Services Provide M&A, private capital raising and capital market advisory services Strong momentum: closed 28 deals in 2014; 45+ active engagements in 2015 Founded in 2003, 259 transactions closed to date; 76 in Security Ranked the #1 most active M&A advisor in Information Security and Enterprise Networking in 2012, 2013, & 2014 by 451 Research 1

3 AGC Ranked Top Tech Boutique: 259 Deals Done Since Inception Maria Lewis Kussmaul: Trusted Industry Advisor to Security Industry Maria Lewis Kussmaul Co-Founding Partner Investment Banking Recognized in the Information Security community as the leading domain expert and best networked investment banker Maria has built upon her 30+ years of industry experience and 90+ deals to make AGC Partners the leading name in Information Security Hosts annual premiere investor and strategic partner event in Pre-RSA Security Conference and recently launched Disrupt!on at Black Hat 2013 Recognized by the 451 Research as Top Dealmaker in Security and Enterprise Networking for 2012, 2013, and 2014 Panelist/presenter at RSA Conference; Security Innovation Network (SINET) Advisory Board Member Has facilitated multiple Blue Sky strategic planning sessions with leading teams in the Security industrysuchasbmc,intelsecurity,cisco,hp,trendmicro,emc,ibm,ca,symantec,oracle, Verisign, and Juniper Networks AGC s Strong Track Record with the Largest Acquirers 2 Confidential Materials. Do Not Distribute.

4 AGC s Recent Security Transactions: 28 Since has been sold to has been sold to has been sold to has been sold to has sold its LYNXeon assets to has completed a Series C Equity Financing with UNDISCLOSED October 2015 August 2015 July 2015 May 2015 March 2015 February Denotes transactions with valuations greater than $100M 3

5 AGC s Market Leading Security Practice: 48 Deals Through 2010 Transactions prior to

6 Sought After Sectors: Strategic M&A User Behavior Monitoring & Analytics Next Generation Endpoint Threat Intelligence Advanced Persistent Threats Anti Fraud / Identity Management Encryption Application Security BYOD & Mobile SCADA / IoT 5

7 2015 Top M&A Deals ($ in Millions) Date Target Acquirer EV LTM Rev EV/LTM Rev Oct $63,100 $24, x Apr ,613 1, x Mar , x Apr , x Apr x Jun ND ND Sep x Sep * ND ND Apr x Apr * 60* 3.3x * 451 estimate 6

8 LTM Funding by Sector ($ in Millions) Business Model # Transactions Funding Endpoint 15 $822 Network Security 31 $709 IAM 25 $697 Data Security 14 $445 Cloud Security 30 $399 Active Investors in past 12 months: Illumio, CoreOS, Sumo Logic, Netskope, Vectra Networks, SentinelOne, Aorato, ForgeRock, Lookout, Sookasa, Simility Prevoty, Zerto, Risk I/O, ThreatMetrix Awake Networks, Okta, Skyhigh Networks, Sumo Logic, Synack, Guardicore, Zerto CoreOS, Shape Security, Ionic Security, Bit9, Synack, Area1 Security, Endgame Application Security Threat Intelligence 22 $ $211 Cohesity, Bit9, Sumo Logic, Skyhigh, Adallom, SafeBreach, CoreOS, Okta, Keen.io, Forter Scalyr, Cohesity, Agari, Guardicore, Lightcyber, RiskIQ, Veradocs, Zerto, KeyMe, BlockScore Stealth 6 $95 BYOD Security 4 $56 Total 161 $3,726 LTM period as of 3Q 15 Source: Tracxn, CapitalIQ and 451 Research Ionic Security, Shape Security, Synack, Threat Stream, Duo Security, MapR, Team8 Illumio, Okta, Tanium, Cipher Cloud, Bluebox, SignalFX, Lookout, Sookasa Cylance, DB Networks, Okta, Vectra Networks, BlockScore 7

9 Cybersecurity Enthusiasm Driver: Leadership is up for Grabs As the changing of the guards takes place, the winners and the losers are quickly being separated Old Guard Undecided New Guard Agents of Transformation Others? Old guard companies are scrambling to stay relevant in the rapidly changing market Public markets continue to amply reward newly public security companies, as evidenced by Rapid7 and Cyber-Ark, which are trading up 17% and 188% after their recent IPOs, respectively New guard companies are driving forward at an accelerated pace, with the fortitude and capital to back them New Guard companies continue to strategically employee M&A as an agent of transformation *Aftermarket performance as of 10/23/15 8

10 Investors Eager to Exploit Leadership Shift Today s Information Security market is at a crossroads: Traditional security solutions are focused on barrier-based perimeter defenses But the threat is already inside the Network/Enterprise Leaders are combining pre and post compromise detection, analytics, forensics and response Next generation security players have evolved to keep up with increasingly sophisticated attacks by utilizing: Endpoint and network visibility / detection solutions Adversary intelligence studying the attackers Big Data collection and analytics that can be tracked, combined and acted upon 9

11 and Strong Sector Growth With security budgets increasing across the board, Information Security is exhibiting strong fundamental growth that is likely to remain robust According to Gartner, enterprise security budgets are shifting towards an increased focus on detection and response, and 60% of security budgets will be allocated to these two areas by 2020 PwC Global State of Information Security Survey indicates 10,000+ respondents reported their information security budgets increased by 24% in 2015 as a response to the 38% YoY increase in security incidents IDC cites four hot areas for growth over next 5 years: Security Analytics / SIEM (10% CAGR); Threat Intelligence (10%+); Mobile Security (30%); and Cloud Security (50%) Additionally, IoT Security a relatively new market is expected to reach approximately $29 billion by 2020 Source: Gartner, IDC, MarketsandMarkets 10

12 Cyber Success Stories 640% Enterprise Value Growth 3.3x Financing - $22M First Sale Second Sale $200 Rev. Multiple 4.5x $90 EV: $27M EV: $90M * EV: $200M * Multiple: 7.9x Multiple: 4.5x Multiple: 3.3x Rev Growth: 521% Rev Growth: 13% 7.9x $ Years 2.7 Years Ent. Value ($M) April 2008 August 2012 April 2015 *451 Research estimates 9.7x Financing - $69M Sale $989 Rev. Multiple 4.8x EV: $145M Multiple: 4.8x Rev Growth: 74% 2.7 Years EV: $989M Multiple: 9.7x Rev Growth: 45% Ent. Value ($M) $145 April 2011 January x Financing - $30M Sale $415 Rev. Multiple 7.5x EV: $315M Multiple: 7.5x Rev Growth: 66% 6 months EV: $415M Multiple: 8.5x Rev Growth: 66% Ent. Value ($M) $315 July 2013 December 2013 Source: 451 Research 11

13 Security Strategics Enhance Product Offerings OpenDNS provides Cisco a significant and valuable source of threat intelligence, which it can leverage to improve a wide range of security and network products that it already sells, most notably, its current strategy of building out its security IoT segment Acquiring CirroSecure solidifies Palo Alto s position in cloud application control technology and gives Palo Alto the ability to secure high risk, unsanctioned applications with superior visibility and control Acquiring Voltage Security allows HP to utilize a powerful data-centric suite of protection solutions to further extend the capabilities of the HP Atalla portfolio, to bolster security, encryption, tokenization, and enterprise key management Combined with Metafor, Caspida allows Splunk to add analytics into its emerging SIEM product to automate detection, and provide better alerts on attacks and insider threats in a digestible format for SOC analysts and incident responders Adallom fills a gap between cloud-based IAM and third party SaaS products, allowing Microsoft customers to add much broader control over user authorization, monitoring and control of its cloud and office programs Xceedium complements CA s privileged management portfolio allowing CA to leverage a highly scalable offering for managing privileged access to virtualized and cloudbased resources Proofpoint s advanced threat detection and response products for and social media security and compliance will be further enhanced by pairing them with Emerging Threats deep research and intelligence capabilities BlackBerry will have significant additional capabilities to support ios and Android, which is the future for the enterprise mobility management (EMM) provider as it increasingly steps away from its own device business 12

14 Big 4 M&A Activity June 2010 May 2013 April 2014 December 2014 September 2015 (assets) October 2014 November 2014 January 2015 March 2015 September 2015 (assets) $11.4M Private Placement January 2010 August 2011 April 2013 March 2014 (Professional Services Consulting Group) (assets) January 2011 June 2015 July 2015 (Professional Services Security Practice) 13

15 Private Equity Platform Plays Resolution1 combined with Fidelis provides one of the most comprehensive offerings in the TDR and incident-response automation spaces for a comprehensive advanced threat defense solution Perspecsys' encryption gateway proxy should be a straightforward plug-in to Blue Coat's own proxybased security appliances, while enabling Blue Coat to expand its addressable cloud security use cases to clients facing dataresidency requirements With an integrated suite of solutions that both shrink the cyber-attack surface and contain breaches when they do occur, BeyondTrust is well positioned to address anticipated market demands Immediate Insight brings additional advanced security analytics to FireMon, giving it more actionable security beyond firewall monitoring Whitebox allows SailPoint to provide customers with a single view of users and their associated privileges for accessing applications, systems and, now, unstructured data Bay31 enables Courion to extend its technology leadership in identity analytics and enhance the company's product offerings in role mining and role-based access control, particularly for large and complex applications 14

16 Defense Contractor Activity $193M 5.9x $80M 8.0x ND DIVESTED JAN-15 Not Disclosed $140M 5.0x DIVESTED MAR-15 $85M 3.4x DIVESTED JAN-15 $24M Assets DIVESTED JUL-15 ND DIVESTED APR-15 Record of defense players purchasing cyber product companies has been mixed; divestitures becoming frequent $24M 2.0x ND $233M 3.0x $1.3B 3.4x

17 Signs of Froth? Dotcom-Era Nasdaq Trading Multiples (TTM Rev.) Recent Security IPOs Trading Multiples (TTM Rev.) Jan 98 Mar 00 Sep 01 Jan 12 Feb 14 Sep 15 Source: CapitalIQ RSA Conference Exhibitor Numbers Cyber Security Unicorns 16

18 Growth Alone is No Longer a Golden Ticket So far in 2015, cybersecurity firms have received more than $3.3 billion in funding in 130+ deals, putting the year on track to beat last year s record pace However, recent public market volatility has led to increased scrutiny by investors and a backto-basics mentality in venture to late stage funding Growth rate is no longer a golden ticket to attract capital as investors are now looking at growth coupled with profitability and cash flow generation Strategics have also become more cautious with respect to paying the frothy valuations seen in recent years, portending a possible slow down in deal activity * YTD as of September 23,

19 Valuations Driven by Public Sentiment YTD Cybersecurity Share Pricing 31.1% 18.6% (HACK) 5.2% 4.3% 12.26% 47.8% Jan 15 Feb 15 Mar 15 Apr 15 May 15 Jun 15 Jul 15 Aug 15 Sep 15 Oct 15 ($ in millions) Market Data Operating Data (c) Enterprise EV / EBITDA Revenue EBITDA Revenue Growth LQ Gross LQ Adj. Company Value (a) (b) TTM 2015E TTM 2015E TTM 2015E TTM 2015E 14A/'13A 15E/'14A Margin Op. Margin (d) Palo Alto Networks $13, x 11.9x NM 64.5x $928 $1,113 ($105) $205 53% 51% 74% (12%) Splunk 6, x 10.1x NM NM (225) 38 49% 40% 83% (43%) FireEye 3, x 6.0x NM NM (397) (170) 163% 50% 63% (86%) (HACK) * 1, x 2.6x 12.1x 11.6x % 9% 76% 7% CyberArk 1, x 7.9x 36.7x 37.2x % 44% 83% 18% Barracuda x 2.5x NM 10.4x % 16% 80% (0%) *HACK metrics based on median values of holdings Source: CapitalIQ Through October 23, 2015 TTM as of 2Q 15 18

20 Public Sentiment on Growth C D A: 2014 earnings released: Surpassed analyst estimates by 125% B: Congress unanimously passes Cybersecurity Information Sharing Act C: Acquires behavior analytics and machine learning provider Caspida D: Chinese economy declines A B EV: $6.4B E Revenue $303 $451M $632M Growth % 52% 49% 40% EBITDA ($70M) ($203M) $39M Margin % (23%) (45%) 6% Jan 15 Oct 15 B C D A: 2014 earnings released: Surpassed analyst estimates by 22% B: Congress unanimously passes Cybersecurity Information Sharing Act C: Announces $600M convertible notes offering D: Chinese economy declines A EV: $3.8B E Revenue $162M $426M $640M Growth % 94% 163% 50% EBITDA ($143M) ($380M) ($168M) Margin % (88%) (89%) (26%) Jan 15 Oct 15 Source: CapitalIQ Through October 23,

21 Public Sentiment on Growth + Profitability C D A: 2014 earnings released: Surpassed analyst estimates by 12% B: Congress unanimously passes Cybersecurity Information Sharing Act C: Acquires enterprise SaaS application security startup CirroSecure D: Chinese economy declines B A EV: $13.2B E Revenue $483M $739M $1,110M Growth % 49% 53% 50% EBITDA ($0.4M) ($73M) $204M Margin % (0%) (10%) 18% Jan 15 Oct 15 B C D A: 2014 earnings released: Surpassed analyst estimates by 320% B: Announces secondary Nasdaq offering C: Congress unanimously passes Cybersecurity Information Sharing Act D: Chinese economy declines A EV: $1.2B E Revenue $66M $103M $148M Growth % 40% 56% 44% EBITDA $10M $21M $32M Margin % 15% 20% 22% Jan 15 Oct 15 Source: CapitalIQ Through October 23,

22 Public Sentiment on Negative Developments B C A D E Jan 15 Oct 15 A: 2014 earnings released: Surpassed analyst estimates by 17% B: Congress unanimously passes Cybersecurity Information Sharing Act C: Announced FY Q1 billing growth at 8%, well below 16-18% guidance D: Chinese economy declines E: Announced FY Q2 billing growth at 10%, down from 15% in Q2 last year EV: $761M E Revenue $234M $277M $321M Growth % 18% 19% 17% EBITDA ($0.2M) $8M $72M Margin % (0%) 3% 23% *CUDA FY ends in February Source: CapitalIQ Through October 23,

23 HACK Fund HACK Fund ($ in millions) Market Data Operating Data (c) Enterprise EV / Revenue EV / EBITDA Revenue EBITDA Revenue Growth LQ Gross LQ Adj. Company Value (a) (b) TTM 2015E TTM 2015E TTM 2015E TTM 2015E 14A/'13A 15E/'14A Margin Op. Margin (d) Cisco $114, x 2.3x 8.5x 8.4x $49,161 $50,163 $13,391 $13,550 0% 4% 60% 23% Palo Alto Networks 13, x 11.9x NM 64.5x 928 1,113 (105) % 51% 74% (12%) Check Point 13, x 8.2x 16.0x 14.5x 1,559 1, % 9% 89% 50% Symantec 12, x 2.0x 6.8x 6.1x 6,272 6,152 1,809 2,019 (3%) (7%) 84% 22% Juniper 12, x 2.5x 12.1x 9.3x 4,640 4,834 1,000 1,303 (1%) 4% 64% 21% VeriSign 8, x 8.4x 13.7x 12.5x 1,043 1, % 4% 82% 58% F5 7, x 3.9x 12.9x 9.8x 1,884 1, % 10% 82% 29% Gemalto 6, x 1.9x 13.0x 10.8x 3,154 3, (9%) 17% 38% 8% Splunk 6, x 10.1x NM NM (225) 38 49% 40% 83% (43%) Booz Allen Hamilton 5, x 1.1x 11.0x 11.0x 5,304 5, (5%) (1%) 24% 9% Fortinet 5, x 5.0x 90.4x 30.8x 937 1, % 31% 72% 2% Trend Micro 4, x 4.0x 12.2x 11.8x 986 1, (7%) 6% 83% 25% Leidos 4, x 0.8x 9.8x 10.2x 5,063 4, (12%) (2%) 11% 7% FireEye 3, x 6.0x NM NM (397) (170) 163% 50% 63% (86%) SAIC 2, x 0.7x 10.6x 9.7x 4,064 4, (6%) 12% 10% 6% Sophos (e) 2, x ND 40.0x ND 447 ND 65 ND 18% NM NM NM Proofpoint 2, x 9.3x NM NM (51) 4 42% 35% 70% (32%) Imperva 1, x 7.5x NM NM (56) (7) 19% 32% 78% (32%) AVG 1, x 3.3x 11.6x 8.9x (8%) 16% 85% 15% CyberArk 1, x 7.9x 36.7x 37.2x % 44% 83% 18% ManTech 1, x 0.7x 8.9x 9.2x 1,613 1, (23%) (11%) 15% 5% Qualys 1, x 6.2x 33.7x 21.7x % 24% 80% 13% Rapid x 9.6x NM NM (24) (31) 28% 35% 74% (32%) Barracuda Networks x 2.5x NM 10.4x % 16% 80% (0%) Infoblox x 1.8x NM 16.4x (17) 39 9% 29% 79% (5%) Radware x 2.7x 12.4x 14.3x % (3%) 83% 14% VASCO x 2.3x 9.8x 9.7x % 18% 59% 24% Intralinks x 1.9x 43.2x 13.7x % 7% 72% (11%) KEYW x 1.3x NM 43.4x (3%) 7% 33% (5%) F-Secure x 2.3x 13.5x 12.3x (13%) (13%) 97% 16% AhnLab x ND 19.9x ND 115 ND 13 ND (5%) NM 77% 6% Zix x 4.8x 25.2x 16.9x % 9% 83% 25% Absolute Software x 2.3x 12.0x 14.7x % (1%) 81% 1% Guidance Software x 1.5x NM NM (6) 1 (2%) 1% 66% (13%) Comp S.A x ND 7.6x ND 160 ND 14 ND (5%) NM 25% 6% MEDIAN $1, x 2.6x 12.4x 12.0x $403 $533 $32 $65 7% 9% 76% 7% Notes (a) Based on closing stock prices on October (b) Calculated as Equity Value plus total debt, minority interest (at book value unless otherwise noted) and preferred stock, less cash & equivalents (c) Projections represent Wall Street & Yahoo Finance estimates (d) Adjusted operating margin excludes extraordinary and non-recurring items (e) Sophos fiscal year ends March 31st Source: CapitalIQ Through October 23, 2015 TTM as of 2Q 15 22

24 Concluding Thoughts Cyber threats are endemic Industry leadership is in flux Demand for effective countermeasures is strong and rising Capital availability is at unprecedented levels and valuations are high Cyber talent is scarce Cyber investments and M&A will undoubtedly continue but at a more discriminating pace and with more disparate outcomes 23