by Brenon Daly
In its sixth acquisition of a publicly traded information security vendor in just the past decade, Thoma Bravo says it will pay $3.8bn for endpoint security specialist Sophos. The deal represents a massive bet by the buyout shop on the infosec market, with the bill for Sophos equaling the combined spending of the firm’s two next-largest take-privates. It also has some distinct echoes of the blockbuster Symantec split announced just two months ago.
Both Sophos and Symantec date back to the 1980s. As stalwarts in the first generation of antivirus providers, both companies have nonetheless struggled to match the innovation of fresher, nimbler startups. As a consequence, the two middle-aged vendors have largely been spectators as hundreds of billions of dollars of value has flown predominantly to the industry’s newer entrants.
That’s not entirely fair to Sophos, which has more than doubled its value on the London Stock Exchange since its mid-2015 IPO. (But it is very much the case at Big Yellow, with shares having flatlined over the past half-decade.) Still, the roughly $2bn in market value Sophos created on the LSE is a tiny fraction of the value that has been ascribed to the unicorn-heavy infosec sector since the middle of the decade. (Granted, much of that is ‘paper value’ for startups that exists only in the minds of venture capitalists.)
With the pace of disruption and displacement accelerating in the infosec space, it’s perhaps not surprising that both Symantec and now Sophos find themselves owned by financially minded acquirers in transactions that feature similarly reasonable valuations. Thoma is valuing Sophos at $3.8bn, or about 4.2 times the $895m the company recorded in sales in its fiscal year that ended in March. That multiple lines up very closely with the 4.5x that Broadcom is paying for Symantec’s enterprise security business.
On their own, the two deals almost set a record for annual M&A spending in the infosec market, according to 451 Research‘s M&A KnowledgeBase. Combined with this year’s other big prints in the sector – including VMware’s $2.1bn consolidation of Carbon Black and Insight Venture Partners’ recap of Recorded Future – 2019 has set a new high-water mark for annual deal value in our database. With still two and a half months of the year remaining, 2019 has already seen an unprecedented $21.6bn worth of infosec transactions, 40% higher than the previous record.