Lou Hazim

Learn the ins and outs of internet exposure in the context of vulnerability management: https://lnkd.in/eta2umrs.

9

What would it take for SailPoint to go public again? Bloomberg and Michael Novinson at ISMG did some solid reporting in the past week, breaking the news that Thoma Bravo is in the early stages of taking SailPoint public again. > Already?! They've only been private for two years! I know – this seems like it's defying the odds for a normal private equity transaction. It's defying the odds of the current IPO window, too. There hasn't been a traditional IPO for a pure cybersecurity company for 1,099 days and counting. SailPoint is anything but typical, though. I'm not convinced they even needed to go private. Here's what it would take to go public again: → Profitable growth and scale SailPoint was sitting at $495.4M of revenue (TTM), $429.5M of ARR, and 31% revenue growth as of their last public earnings report in June 2022. Its net income was -$61.6M as of FY'21 year end. Roughly speaking, the current IPO expectations are $500M+ revenue scale, 20%+ growth, profitability, and a clear path to $1 billion. If we project out SailPoint's revenue since going private at 30% growth, they're likely approaching $1 billion in both ARR and total revenue. This might be generous, but they're getting close at anything over 20%. Their losses got out of control, but they're in good shape if they can get net income back to pre-2020 levels (-$10M or lower). → A good story around their ability to compete with Okta, CyberArk, and Microsoft The narrative for a SailPoint IPO is pretty good right now: there is a unique opportunity in the identity security market right now. SailPoint is well positioned to capture it. Under Thoma Bravo's ownership, they've acquired PAM and third party access companies. This matches Okta's entry into the PAM market and puts them in a position to compete with CyberArk in some market segments. I'm a little surprised they didn't try to add SSO to complete the narrative of being a full workforce identity platform (and fully compete with Okta). They were in the middle of their transition from on-premise to SaaS (which probably drove them to go private). I've heard good momentum on SaaS adoption for new implementations. This has to be part of the narrative if they're going to go public again. → No strategic buyers at a higher price than an IPO A strategic acquisition seems like a long shot. At a $6.9 billion acquisition price in 2022, a strategic acquisition might require close to $10 billion – otherwise, an IPO could be a more attractive exit. Large and mega-cap tech companies are the only buyers who can realistically absorb an acquisition of this scale. Palo Alto Networks, CrowdStrike, and the rest of the pure cybersecurity companies aren't doing this big of an acquisition. There just aren't many buyers. I don't see SailPoint wanting to move to another private equity firm, either – there's too much mutual respect between Thoma Bravo and SailPoint for that. The only option here might be to go public.

65

📢 Check Point Again a Frost Radar XDR Leader in 2024 In this report, Check Point was cited as a Growth and Innovation Leader in Extended Detection and Response (XDR). Check Point XDR/XPR Key Highlights: • Collaborative Threat Prevention • AI Copilot • Consolidated Threat Intelligence and Analytics • Infinity Playblocks Automation • Centralized IOC Management • Threat Intelligence & Event Correlation Download your free copy of the Frost Radar™ XDR Report to learn more about why Check Point is a Growth and Innovation leader in Extended Detection and Response 👉 https://lnkd.in/gecJVKrG Yael Cinamon

2

🪧 SIEM ≠ MDR Welcome to part one of our three-part blog series where we share the difference between a SIEM system and MDR and how MDR can transform and augment your SIEM tool investment.

1

VM remains a cornerstone of preventive cybersecurity, but organizations still struggle with vulnerability overload and sophisticated threats. Tenable’s new Exposure Signals gives security teams comprehensive context, so they can shift from VM to exposure management and effectively prioritize high-risk exposures across their complex attack surface. http://ow.ly/oGFk105PbnX

3

Cillian M discusses the challenges MSSPs face and how Tenable can help them thrive in today's market. From self-provisioning through to the Tenable One Exposure Management Platform 👀 watch now! ➡️ Learn more: https://lnkd.in/eiMtnJZH #Cybersecurity

9

Interesting Okta vulnerability (see link below) allowed users with usernames longer than 52 characters to potentially log in without password being validated. Kudos to Okta for a very detailed post on the issue but the root cause is that Okta seems to have used a password hashing algorithm (bcrypt) to generate a key. The fix was to use a key derivation function (PBKDF2) instead. Okta asked customers to verify logs to see any improper authentication methods. It is unlikely this was abused as the vulnerability was found (disclosed responsibly it looks like) and fixed quickly. But my co-founder Kartik CDS who full name expands to 45 characters breathed a sigh of relief :) It's 2024 - bcrypt and other password hashing functions have been around for a long time. It is well known that most implementations of bcrypt have limitations on password length (usually 72 bytes). Okta used a combination of user id + user name + password to derive a key. 20 byte user id and a 52 byte user name will easily go past the 72 byte limit rendering the password useless. Crypto is hard to get right and the impact of even a slightly improper use of crypto can be dangerous as can be seen by this advisory. We all write encryption/crypto policies as part of our compliance programs. The policies are almost always right but subtle mistakes such as these can be hidden everywhere. #encryption #keyderivation https://lnkd.in/g9dUQYXf

75

2 Comments

💡 Do I need to report PKI maturity level? Reporting your PKI maturity level isn’t just a checkbox! 🛠️ While not mandated by the PKI Consortium, documenting your PKI maturity level can: 📈 Highlight your current PKI status to stakeholders 🚀 Pinpoint key areas for improvement 📊 Track progress over time effectively Depending on your organization's needs, regulatory requirements, or improvement goals, reporting might be essential. Learn more about PKI Maturity Model: https://pkic.org/pkimm/ #pki #pkimm #pkic #maturity #improvement #assessment #benchmark #guidance PKI Consortium Paul van Brouwershaven Leigh Bailey

9

1 Comment

If it’s true that Thoma Bravo is once again exploring a SailPoint IPO, a few things need to happen for the exit to succeed. On the surface, this move seems like it's defying the odds for a normal four-to-seven year private equity holding period. It's defying the odds of the current IPO window, too. There hasn't been a traditional IPO for a pure cybersecurity company for over 1,000 days (and counting). Current market conditions are anything but favorable, at least for anyone other than the crème de la crème of the IPO pipeline. SailPoint is anything but typical, though. I'm not convinced they even needed to go private in the first place, but here we are. News of an impending IPO is exciting to anyone who (a) likes SailPoint, and (b) wants this IPO drought for our industry to end. This is far from a done deal, but it's credible enough to do some educated speculation about what it might take for SailPoint to go public again and stay there this time. My latest article is about the metrics, narrative, and alternatives that could lead to a second SailPoint IPO. You can read more by following the link on my profile.

37

4 Comments

In today’s complex cybersecurity landscape, silos and inefficiencies are major challenges, creating gaps, increasing risk and costs. Discover how Cyware’s Cyber Fusion Center (CFC) addresses these problems head-on by integrating resources and fostering collaboration: 🔒 Risk Reduction Through Intelligent Correlation 🤝 Operational Efficiency Through Collaboration 💡 Cost Savings Through Orchestration 🔗 Learn more - https://lnkd.in/eiguaFm6 #Cybersecurity #RiskManagement #Automation #Collaboration

8