Is Sucuri for sale?

Contact: Ben Kolada

Just a month after its newfound partner VirusTotal was scooped up by Google, antimalware detection and remediation startup Sucuri may be next on the auction block. Word has it that the two-year-old company is attracting takeover attention. That shouldn’t come as too much of a surprise, given the growth potential of the website antimalware monitoring market and the strategic importance companies are placing these days on their online presences.

Sucuri provides a website malware detection product and associated remediation service meant to prevent customers’ websites from being blacklisted by search engines, namely Google. The company’s software scans websites for malware infection and alerts the customer. Sucuri then provides a cleanup service to remove the malware. As businesses continue to transition from brick-and-mortar to e-commerce models, such services will become increasingly important to growing sales, especially during the upcoming holiday season. Given its short lifespan, we suspect that the company is currently generating less than $10m in revenue.

No word yet on which companies may be looking to acquire Sucuri, but the list likely includes mass-market hosting vendors and large security firms. Like its competitors, Sucuri’s go-to-market strategy so far has been partnering with hosting companies, though it also sells directly to customers. The company lists Web host ClickHOST as a partner, as well as a half-dozen WordPress hosting and site design vendors. As for possible security suitors, the most likely acquirers that immediately come to mind are Proofpoint, Kaspersky Lab, Websense, Symantec, AVG Technologies or AVAST Software.

For more real-time information on tech M&A, follow us on Twitter @MAKnowledgebase.

Proofpoint buys Fortiva, expands into email archiving

After a courtship that lasted the better part of a year, on-demand security provider Proofpoint finally picked up software-as-a-service email archiving startup Fortiva this week. Based on similar transactions and industry buzz, we estimate this tuck-in acquisition cost Proofpoint somewhere in the neighborhood of $70m. Fortiva, which has 45 employees, was running at about $15-20m in revenue from about 200 enterprise customers. This marks a solid exit for the company’s venture backers, Cargill Ventures, Ventures West and McLean Watson Capital, which only pumped $8m into Fortiva.

The interesting question sparked by this transaction is what’s next for Proofpoint, which is now up to 250 employees. Though some have suggested the company has now effectively dressed itself up as an acquisition target, we believe otherwise. We think an IPO will represent the next major milestone for the company. (In wrap-up of April’s RSA conference, we said as much, adding that an acquisition by Proofpoint was likely in the next few months.)

Proofpoint has drawn in some $86m in funding since its inception in 2002, including a $28m round in February, even though it was running at close to breakeven. With more than 1,600 customers, bookings are up 70% on a year-over-year basis for 2008. The growth comes despite stiff competition. Google, Cisco and Autonomy Corp made a big push into the market last year with their respective acquisitions of Postini, IronPort Systems and Zantaz.

Yet, Proofpoint has held its own against these larger vendors, even recruiting a few high-ranking employees from Postini, we’ve heard. Speaking of hiring at Proofpoint, we would also highlight last year’s move to bring Paul Auvil on board as CFO. Auvil served as the top numbers guy at VMware, guiding that company from the tens of millions of dollars in revenue to hundreds of millions of dollars. Of course, that company never made it fully public. We have a feeling Auvil may yet have a chance to be CFO at a public company, given the direction of Proofpoint.

Select on-demand security deals

Announced Acquirer Target Deal value Target revenue
July 9, 2007 Google Postini $625m $70m*
July 3, 2007 Autonomy Zantaz $375m Not available
May 14, 2007 Verizon Business Cybertrust $450m* $225m*
April 26, 2007 Websense SurfControl $400m $220m
Jan. 4, 2007 Cisco IronPort $830m $100m*
May 19, 2004 Symantec Brightmail $370m $26m

Source: The 451 M&A KnowledgeBase, * official 451 Group estimates