Tag: ArcSight

KEYW picks up Sensage to build out Project G

Ben Kolada

Contact: Ben Kolada

Just three days after announcing its largest acquisition – the $126m pickup of cybersecurity software development firm Poole & Associates – KEYW has snagged small security information and event management (SIEM) vendor Sensage for $24m, with an earnout potentially raising that price by $10.5m. The two companies had previously been partners, working together on KEYW’s networking cybersecurity platform, dubbed Project G.

KEYW is handing over $15m in cash and $9m in stock. The deal also includes an earnout of up to $3m in cash and $7.5m in stock, achievable based on unspecified revenue targets for the second half of the year. The transaction is expected to close in October.

The Redwood City, California-based target, which has 35 employees, generated about $12m in revenue last year and recorded a small operating loss for the first half of this year. However, although the legacy Sensage business will be retained, the company isn’t being valued on its sales, but rather its potential contribution to KEYW’s nascent Project G platform. Sensage CEO Joe Gottlieb will head the combined company’s Project G network security initiative. KEYW began commercially testing Project G in June.

Select precedent ESIM acquisitions

Date announced Acquirer Target Price/sales valuation
April 3, 2012 TIBCO Software LogLogic 3.5*
October 4, 2011 IBM Q1 Labs 8.8*
October 4, 2011 McAfee NitroSecurity 5.3*
June 23, 2011 SolarWinds TriGeo Network Security 3.9
September 13, 2010 Hewlett-Packard ArcSight 7.7

Source: The 451 M&A KnowledgeBase *451 Research estimate. Click links for full deal details.

For more real-time information on tech M&A, follow us on Twitter @MAKnowledgebase.

What lies ahead for independent ESIM vendors?

Contact: Thejeswi Venkatesh, Ben Kolada

Hewlett-Packard recently announced the availability of ArcSight Express 3.0, an upgraded version of the product it acquired last year. In light of this release, we note that independent ESIM vendors aren’t resting on their laurels, either. They continue to develop, innovate and position themselves as potential IPO/acquisition candidates. Competition is already fierce among ESIM players, with each trying to expand their addressable markets, but with HP, Attachmate and Sophos adding ESIM offerings to their portfolios, rivals might look to add to their own to compete effectively.

In a recent report, my colleague Andrew Hay notes that there are several potential acquirers and targets. The list of takeout candidates continues to include Q1 Labs, although there have been M&A rumors around the company for a decade. Q1 Labs is also primping itself for an IPO, but we wouldn’t be surprised if it became the latest target in the growing line of dual-track acquisitions announced so far this year. Given its enviable revenue growth (Q1 Labs reported that its revenue grew 75% in 2010), we expect that Q1 Labs would catch a valuation similar to ArcSight. HP picked up that Cupertino, California-based security provider in September 2010 in a deal valued at nearly 8 times trailing sales. Beyond Q1 Labs, we could point to NitroSecurity, which was allegedly in talks with McAfee earlier this year. We’d also note that McAfee lost out on the ArcSight assets, and could look to NitroSecurity as an alternative.

Talk is cheap, but BMC isn’t

Brenon Daly

Contact: Brenon Daly

All the talk around an acquisition of BMC may be just that – talk. We have a hard time believing some of the rumored buyers for the IT management vendor. That skepticism was shared by a few bankers who we spoke with about the rumor. In fact, they reminded us that the most recent M&A buzz around BMC had the company as a buyer, not a seller. Several sources have indicated that BMC was an early bidder for security provider ArcSight, but dropped out quickly when the price got a bit rich.

Nonetheless, M&A speculation pushed BMC shares Thursday to their highest level in a decade. Currently, the company garners a market cap of $7.6bn. Fittingly for a 30-year-old firm, BMC sits on a pile of cash. It has some $1.4bn in its treasury, although a bit of debt lowers its net cash position to about $1.1bn. The company recently indicated that it would generate in the neighborhood of $700m in cash from operations in the current fiscal year, which ends in March. Sales for the fiscal year are expected to come in at $2bn.

With an enterprise value of roughly $6.2bn, BMC currently trades at more than 3 times projected sales and almost 9x projected cash flow. Even without a take-out premium, those are fairly rich multiples for a company that grows just 2% per year. A premium could take BMC’s equity value to around $10bn.

Obviously, there are only a few companies that could write that a check that big and if we were to short-list them we would probably put Oracle and Cisco Systems on there – but for different reasons. The $1bn of maintenance revenue that flows steadily to BMC each year would undoubtedly catch Oracle’s eye. But buying $1bn of annual maintenance revenue for, say, $8bn (on a net cost basis) doesn’t look like the kind of bargain Oracle typically strikes.

And while Cisco has partnered with BMC for the management within its Unified Computing System, it’s not clear to us that Cisco actually needs to own BMC to further its interest in outfitting datacenters. To our mind, Cisco should just put the money it would spend on BMC toward the company that it should really buy: EMC.

Is HP overcompensating?

Brenon Daly

Contact: Brenon Daly

Since when does an army without its top general go on the attack? That strategy would seem to go against convention, yet Hewlett-Packard has done just that since dumping Mark Hurd for his foibles. The tech giant has chased a pair of deals to valuations that are basically 2-3 times the prevailing market multiple. HP’s recent bidding war over 3PAR and the purchase of ArcSight shows a level of aggressiveness that indicates to us that the drivers for the acquisitions may have been emotional as well as financial, at least to a small degree.

If we step back and look at the setting for both deals, we can’t help but conclude that HP announced the transactions at a time when it looked vulnerable. Its star CEO had dramatically crashed back to earth, while its board (yet again) appeared to have bungled what looked like a fairly routine internal investigation. Statements by the company that it was ‘business as usual’ didn’t get much of a hearing on Wall Street. Shares that changed hands in the low $50s in April have been worth less than $40 for much of the past month. HP’s market cap lingers below $100bn, despite the company ringing up sales of about $120bn.

At the risk of drifting too far into psychology, we wonder if the deals weren’t a bit of overcompensation. (Certainly, paying 11x trailing sales for 3PAR might be considered overcompensation, or at the least, ‘heavy compensation,’ if you’ll forgive the pun.) If investors and others were going to view HP as weak or directionless while its corner office was empty, well, HP could use its vast resources to counter with a signal to remind everyone that it was formidable, with or without a fulltime CEO. Of course, we’re just playing armchair psychologist here. But something beyond just straight numbers seemed to be at work in HP’s recent moves.

A second exits gets ArcSight a 2x valuation

Brenon Daly

Contact: Brenon Daly

Hewlett-Packard’s pending purchase of ArcSight is the third IT security deal so far this year valued at more than $1bn, after not having a single security transaction valued in 10 digits in 2009. While the other two deals have gone off at basically market multiples, ArcSight is being valued at twice that level. The largest ESIM vendor agreed to sell itself to HP for $43.50 per share, valuing the security firm at more than four times the level it went public just two and a half years ago.

HP put the enterprise value of the transaction, which is slated to close by the end of the year, at $1.5bn. That means the tech giant is paying 7.5 times ArcSight’s trailing sales of $200m. (For the current fiscal year, ArcSight is expected to put up about $225m in sales, meaning HP is paying about 6.7x projected sales.) On a trailing basis, both McAfee and VeriSign’s identity and authentication business garnered 3.5x sales in their respective sales to Intel and Symantec. (Morgan Stanley advised both McAfee and ArcSight, while JP Morgan Securities advised VeriSign.)

The high-multiple deal represents a stunningly successful outcome for ArcSight. As we have mentioned in the past, both HP and McAfee approached ArcSight in the summer of 2007, ahead of the company’s IPO. We gather that both were bidders in the range of $600-750m. Unlike other dual-track candidates, ArcSight didn’t opt for the trade sale, but went ahead with its offering even as the equity market turned bearish. ArcSight spent virtually its entire first year as a public company trading in the single digits, including a fair amount of time below its offer price. (At one point when its shares were underwater, CA Technologies lobbed a low-ball bid at the firm, we understand.) If we had to guess at another suitor in the current process around ArcSight, we might tap EMC as an interested party.

Even as its stock took off over the past two years, ArcSight never did a secondary offering. (For a company with about $200m in sales, it has a very narrow base of shares, totaling only about 38 million.) In this case, the unwillingness to sell shares – either a small chunk or all of them – except at an eye-popping valuation has generated a return that seems reminiscent of the late 1990s. ArcSight raised only about $30m to build a business that got valued at 55 times that level on the exit.

A deal in sight for ArchSight?

Brenon Daly

Contact: Brenon Daly

If nothing else, the long Labor Day weekend gave us all a chance to catch our breath following a week of some of the most frenetic dealmaking we’ve seen in some time. We had bidding wars, doubleheader deals and even a billion-dollar chip transaction. But in some ways, the loudest buzz in the tech M&A market came from a deal that didn’t happen: ArcSight still stands on its own.

The ESIM vendor was supposedly in play, at least according to a thinly sourced and almost woefully vague recent article in The Wall Street Journal. Not to pick apart the piece, but listing a half-dozen of the largest tech companies as ‘potential bidders’ misses a great deal of context. For instance, we noted two and a half years ago that Hewlett-Packard was rumored to have offered about $600m for ArcSight the summer before it went public. ArcSight is now worth twice HP’s rumored bid, and roughly four times the amount the market valued it at when it came onto the Nasdaq in February 2008, just before the IPO window pretty much slammed shut. (For the record, Morgan Stanley led the ArcSight offering.)

That stellar aftermarket performance raises another interesting point about ArcSight: despite the fact that its shares have quadrupled during a time when the Nasdaq has essentially flat-lined, the company has never done a secondary offering. It has just 37 million shares outstanding. That strikes us a narrow base for a firm with $200m in sales and a market valuation of more than $1bn. But maybe the company figures it shouldn’t bother selling shares at current market prices if it stands to get a substantial takeout premium on top of that. For our part, we wouldn’t at all be surprised to see ArcSight get a second exit.