Beware of the cyber Frankenstein: Figuring out Thoma Bravo’s next move
Beware of the cyber Frankenstein: Figuring out Thoma Bravo’s next move
If the American investment fund, which has already purchased 15 cyber companies since 2009, decides to merge them into one entity, a giant will be created that will dwarf many of the leaders in the field
In a recent interview with Calcalist, Nir Zuk, Founder of Palo Alto Networks, described what American investment fund Thoma Bravo is trying to build in recent years as Frankenstein’s monster. The fund's acquisition spree, which began in 2009, has already crossed $30 billion and includes about 15 companies. In total, Thoma Bravo manages $130 billion in its funds, which makes it one of the largest investment funds in the world, specializing mainly in software companies.
The fund's name comes up as an immediate suspect in any cyber transaction, especially if the candidate is a large, public company. In the summary of the cyber transactions made in 2022, Thoma Bravo's name appeared more than any other company in the field, including acquisition enthusiasts Palo Alto Networks or CrowdStrike.
Even recently, when it was revealed that the Israeli cyber company SentinelOne was on the shelf, the hottest name that everyone was betting on as a buyer was Thoma Bravo. What strengthens the estimations that it - and not necessarily the Israeli company Wiz - will be the one to buy SentinelOne, is the fund's fondness for buying public companies and removing them from trading, in order to make deep changes in them and present an improvement in the operating indicators in preparation for a further sale or IPO.
No one really understands fully what Thoma Bravo's master plan is for the cyber portfolio it has built, but it has been hovering like a heavy cloud over the industry and has been threatening other players for years. Palo Alto Networks, which is traded at more than $70 billion, CrowdStrike, which is currently worth about $40 billion, and Fortinet, which is valued at $47 billion, are the largest companies in cyber alongside Microsoft, which has built a huge division in the field. But as of today, Thoma Bravo's portfolio of cyber companies have an aggregate enterprise value of at least $40 billion, together employ 20,000 people, and generate annual revenues of nearly $6 billion. These numbers mean it can become a true competitor to all the classic cyber companies mentioned above.
If the fund decides to merge all or some of the companies into one entity, a giant will be created overnight, one that is active in almost every significant category in the cyber market. However, so far it seems that Thoma Bravo is enjoying keeping everyone in suspense, and is in no rush to take drastic steps. It even sold Imperva two months ago, which was one of the first bricks in its cyber wall, to the French Thales Group for $3.6 billion, four years after it paid $2.1 billion. In late 2022, it also sold Barracuda, which was among its first major cyber investments, to the KKR investment fund for $4 billion. Thoma Bravo exited both companies with a double-digit return, nothing phenomenal but very decent, in less than seven years, the accepted time period for realization in the field of private investments.
U.S. antitrust authorities have also taken notice of Thoma Bravo's moves, and unusually for private investment funds, its two latest acquisitions in the field of identity management - Ping for $2.8 billion and ForgeRock for $2.3 billion - were met with a significant obstacle. In December 2022, three months after the announcement of the purchase of ForgeRock, the U.S. Department of Justice began reviewing the transaction, and it was only approved one month ago.
What played in Thoma Bravo's favor was the fact that, despite its acquisitions and the trend of consolidation in the cyber market, the two companies together hold a share of only 9% of the identity management market. Immediately after receiving the approval, the fund announced the official merger of Ping and ForgeRock into one company. Magnet Forensics, which it acquired in early 2023 for $1.3 billion, was also quick to merge almost immediately with its other strategic investment in the field, Grayshift, which was acquired in July 2022. At this stage, Sailpoint, which was acquired last year for $6.9 billion, and Imprivata, which was acquired in 2016 for half a billion dollars, both continue to operate in the enterprise identity management market as independent companies.
At this stage, Thoma Bravo's "Frankenstein" does not yet threaten all areas of cyber, but mainly concentrates on identity management. This is one of the hottest categories in cyber, since most of the hacks are done with the unintended "assistance" of employees in organizations, who click on problematic links or open emails that seem innocent, thus letting the attackers in. The most significant Israeli player in this market is CyberArk, which is traded on Wall Street at a value of $7 billion. The American company Okta and Microsoft lead the market, while Palo Alto Networks has avoided entering it.
Despite the fear in the cyber market of further acquisitions by Thoma Bravo or additional mergers between more of its portfolio companies, the industry takes consolation in the fact that the fund mostly focuses on the operational side and less on innovation. "Companies that are sold to private investment funds usually do not engage in development, and this budget was pushed aside in an attempt to improve the operating indicators of the acquired company. To my delight, every time a technology company is sold to a fund, it stops investing in innovation," a senior official in the Israeli cyber industry told Calcalist.
And yet, every time you look at the map of cyber companies, which is undergoing significant structural changes with the recent acquisition fever, the market players remember that lurking in the corner are not only the usual competitors, but also the ever-growing multi-armed Frankenstein, Thoma Bravo.
