Peter Rus’ Post

M&A dollar volume is down in cybersecurity (and everywhere), but one thing hasn't changed: Cybersecurity's most active strategic buyers aren't slowing down (much). The strategy for several large cybersecurity companies (and professional services firms) is to grow through acquisitions. Don't think for a minute that some little economic downturn is going to slow them down. Altitude Cyber ran the numbers on cybersecurity's most active strategic buyers (by transaction volume) in their 2023 Cybersecurity Year In Review report. Guess what's happening... Our most active strategic buyers for the past three years are...well, pretty similar. (Note: This is Altitude Cyber's graphic. I just marked it up.) I'm sure if we looked at all of the underlying data, the companies who dropped off in one or more years would still be pretty active. > So, where are all the new buyers? The part that hasn't happened (yet?!) is a rush of new strategic buyers (e.g. the IPO pipeline and unicorns of 2021) into the M&A market. Some people thought there were going to be fire sales. There weren't, and definitely not for our best companies. This could change, but it's probably safe to say that great companies are going to continue selling at a premium. M&A activity is starting to broaden, though. We've seen several recent examples of new(er) buyers making acquisitions. Another set of companies (like Wiz) have raised (or are actively raising) capital and have made it clear they're using the money for M&A. Even with new strategic buyers in the market, the long-term trend is pretty clear: our most active buyers will keep being our most active buyers.

Private equity buyers have been really active in cybersecurity, and they have more money to spend than ever. Back in 2010, it seemed like private equity buyers cared more about the color of their ties than the cybersecurity industry. They did five total deals for just over a billion. Boy, how times have changed. The next decade-plus was a flood of money into the industry from private equity firms. They're literally spending more money on acquisitions than strategic buyers now. This wasn't from a handful of large deals, either. Private equity firms do close to half the acquisitions in cybersecurity. And (like it or not) the trend is absolutely going to keep going up. Private equity firms have three times more capital available to deploy today than they did for most of the last decade. ___ Notes: 1/ I stitched together some data from Momentum Cyber and Altitude Cyber's annual industry reports to get the long-term trend in the graphic. 2/ 2024 might be a close call with some large acquisitions by strategic buyers (mainly Cisco-Splunk closing in March). Regardless, PE activity is still very high compared to historical averages.

There isn't a lot of precedent in cybersecurity for this potential Wiz-Lacework deal. Here's why. → Larger companies in our high growth markets don't consolidate market share very often. Cloud security is only ~15 years old and growing 25%+ year-over-year. Most of the acquisitions we've seen so far are strategic buyers picking up earlier stage companies to speed up product development and round out their platforms. Our consolidation plays have typically happened in more mature markets — Cohesity-Veritas ($7B in backup and recovery) and Ping-ForgeRock (identity) are a couple recent examples. Wiz-Lacework is unprecedented because it's a rare case of a private company in a high growth market acquiring a (partial) competitor to gain revenue and market share. → Cybersecurity doesn't have many $200-million-plus acquisitions, let alone two by the same company in the same month. A deal of this size is in the top 10% of transactions in the entire history of cybersecurity — and probably more like 5% if you exclude private equity and only count strategic buyers. We've only had ~250 (disclosed) deals over $200 million. Ever. That's not very many. Lacework would be Wiz's second acquisition over $200 million *this month* if it happens. → This could be one of the largest valuation declines we've ever seen. Only four private cybersecurity companies have ever been valued higher than Lacework's $8.7 billion (post). That alone is rare territory in our industry. Unfortunately, it also means a valuation decline to anywhere near the price range here is completely unheard of, and hopefully a situation we never see again. --- Wiz-Lacework is all speculation right now. It's a complex transaction, and stuff happens. It could still fall through. Deal or not, this scenario is worth studying inside and out if your work or interests are anywhere near the M&A space in cybersecurity. It's one of the most interesting thought experiments you're ever going to find.

The potential acquisition of Lacework from Wiz is an indicator of three main points in the current investment market: 1) OverValuation (especially at the beginning of the curve) is a danger. 2) The market consolidation path, from a timeframe perspective, is currently and rapidly changing. This is an important factor to keep in mind, especially for Fund Managers 3) Founders: the less rounds you get the more money you exit with. Of course, if your idea solves a real problem and if you execute it well.

𝘾𝙤𝙪𝙡𝙙 𝘾𝙮𝙗𝙚𝙧𝙨𝙚𝙘𝙪𝙧𝙞𝙩𝙮 𝙗𝙚 𝙩𝙝𝙚 𝙝𝙞𝙙𝙙𝙚𝙣 𝙝𝙚𝙧𝙤 𝙤𝙛 𝙫𝙖𝙡𝙪𝙖𝙩𝙞𝙤𝙣 𝙖𝙣𝙙 𝙙𝙪𝙚 𝙙𝙞𝙡𝙞𝙜𝙚𝙣𝙘𝙚 𝙞𝙣 𝙈&𝘼? 🔍 🤷♀️ Let’s have a heart-to-heart about M&A: It’s not all boardrooms and big decisions. There’s a lot that goes on behind the scenes, especially when it comes to cybersecurity. 🛡️ The importance of cybersecurity during due diligence in mergers and acquisitions has surged in recent years, reflecting an increased awareness of cyber risks (thankfully). Studies have shown that a significant percentage of companies 𝗿𝗲𝗴𝗿𝗲𝘁 their M&A decisions due to #cybersecurity issues uncovered post-acquisition. 👇Did you know? 🔴 𝟲𝟱% 𝗼𝗳 𝗰𝗼𝗺𝗽𝗮𝗻𝗶𝗲𝘀 report 𝗿𝗲𝗴𝗿𝗲𝘁 over M&A deals due to unforeseen cybersecurity concerns uncovered post-acquisition (https://lnkd.in/d7Vd8SAj) 🔴 𝟵𝟮% 𝗼𝗳 𝗖𝗜𝗢𝘀 indicated that cybersecurity due diligence uncovered key risks or had a 𝗺𝗮𝘁𝗲𝗿𝗶𝗮𝗹 𝗶𝗺𝗽𝗮𝗰𝘁 on their deals (https://lnkd.in/dMvyBAPy) 🔴 𝟯𝟱% 𝗼𝗳 𝗖𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗗𝘂𝗲 𝗗𝗶𝗹𝗶𝗴𝗲𝗻𝗰𝗲 𝗲𝗳𝗳𝗼𝗿𝘁𝘀 reveal a minimum of $𝟴 𝗺𝗶𝗹𝗹𝗶𝗼𝗻 in remediation costs (https://lnkd.in/dMvyBAPy) 🔴 𝟲𝟮% 𝗼𝗳 𝗜𝗧 𝗮𝗻𝗱 𝗕𝘂𝘀𝗶𝗻𝗲𝘀𝘀 𝗱𝗲𝗰𝗶𝘀𝗶𝗼𝗻 𝗺𝗮𝗸𝗲𝗿𝘀 express 𝗿𝗲𝗴𝗿𝗲𝘁 over M&A transactions because of cybersecurity issues, citing lost time or money as major factors (https://lnkd.in/dMvyBAPy) Note that this not only affect the M&A sector, but any other that relies on external capital. Let's talk! We can help 🚀

While mergers and acquisitions (M&A) make for an exciting time for companies, they come with increased cybersecurity risks. When companies undergo M&A transactions, they often overlook or underestimate the potential cyber threats that can arise during and after the process. This oversight can lead to significant financial and reputational damage if not managed properly. The article emphasizes the need for a comprehensive cybersecurity checklist to identify, assess, and mitigate these risks throughout the M&A lifecycle, from due diligence to post-merger integration. Reach out for more details on how Darktrace works with companies on this to proactively address these cybersecurity concerns, and allow businesses to safeguard their M&A deals to ensure a smoother transition.

When it comes to merger and acquisition activity, secrecy and security are not the same thing. Our CISO and Cyber Security practice lead, Dom Hardman, explains...   "Merger and acquisition activity is, by its nature, very confidential. Bid and deal teams are often small and specialised, working under strict NDAs and with a degree of detachment from everyday business operations. Keeping M&A activity confidential is important as premature leaking of bid activity can prevent a deal from proceeding or materially increase the price as other potential bidders are alerted. There are frequently regulatory and legal frameworks under which M&A activity must take place, all of which are designed to ensure that transactions not only comply with competition law, but also uphold best practices and safeguard all parties involved.    "However, even within this context, few businesses would embark upon M&A activity without representation from finance or legal experts on their bid teams, and I believe that cyber security expertise is an equally important requirement for successful, well-executed M&A activity. "Working with the right cyber partner can demystify cyber security and ensure businesses can identify, mitigate, and communicate cyber risks alongside other, more traditional threats to growth, revenue, and profitability, enabling the navigation of the global threat landscape, where the direction of travel is becoming ever more complex and challenging.    "At Iridium, when we talk about 'normalising the cyber conversation,' we mean recognising the positive potential of cyber security and understanding how it can drive business growth." Read Dom's full article, 'Why cyber security matters in mergers and acquisitions', here: https://lnkd.in/e8-JmHjC #mergersandacquisitions #mergers #acquisitions #cybersecurity #cyber #security #CISO

Another #Cybersecurity vendor exploring going back to private, this time it is Trend Micro. Mixed views on this one, but for me the overall sentiment is a sad one despite that this might be a good opportunity to shape up for the next phase. #privateequity #acquisitions CRN

TL; DR: Fewer total deals, but bigger pricetags when they do happen. This ebb and flow will continue; it always has. We will continue to see new technology advances, and acquisitions; especially in the coming years as the principals of some of these absorbed entities splinter out and continue creating. It will always be exciting times in cybersecurity.

There aren't as many buyers for cybersecurity companies as you might think. A total of 53 buyers across both strategics and private equity have made a cybersecurity-related acquisition of $1 billion or more. The number doesn't get a whole lot bigger if we look at disclosed acquisitions over $100 million. It's somewhere around 200-250 buyers, depending on how you define the cybersecurity industry. ~250 total buyers. That's it. When you factor in things like strategic fit, recent activity, and other ways to qualify potential buyers, the buyer universe for any specific company can be low double digits or smaller. So, what does this mean for cybersecurity companies? The number of potential buyers is big enough that it's tough to manage on your own. That's where investment bankers can help. But it's also small enough that you need to be both realistic and thoughtful about who could acquire your company. There's not an infinite sea of buyers out there just waiting to fork over their money. I see all of this more as good news than bad. A manageable and predictable set of potential buyers means you can be intentional about relationships, partnerships, and other actions that position your company for a potential acquisition.