Tag: Q1 Labs

KEYW picks up Sensage to build out Project G

Ben Kolada

Contact: Ben Kolada

Just three days after announcing its largest acquisition – the $126m pickup of cybersecurity software development firm Poole & Associates – KEYW has snagged small security information and event management (SIEM) vendor Sensage for $24m, with an earnout potentially raising that price by $10.5m. The two companies had previously been partners, working together on KEYW’s networking cybersecurity platform, dubbed Project G.

KEYW is handing over $15m in cash and $9m in stock. The deal also includes an earnout of up to $3m in cash and $7.5m in stock, achievable based on unspecified revenue targets for the second half of the year. The transaction is expected to close in October.

The Redwood City, California-based target, which has 35 employees, generated about $12m in revenue last year and recorded a small operating loss for the first half of this year. However, although the legacy Sensage business will be retained, the company isn’t being valued on its sales, but rather its potential contribution to KEYW’s nascent Project G platform. Sensage CEO Joe Gottlieb will head the combined company’s Project G network security initiative. KEYW began commercially testing Project G in June.

Select precedent ESIM acquisitions

Date announced Acquirer Target Price/sales valuation
April 3, 2012 TIBCO Software LogLogic 3.5*
October 4, 2011 IBM Q1 Labs 8.8*
October 4, 2011 McAfee NitroSecurity 5.3*
June 23, 2011 SolarWinds TriGeo Network Security 3.9
September 13, 2010 Hewlett-Packard ArcSight 7.7

Source: The 451 M&A KnowledgeBase *451 Research estimate. Click links for full deal details.

For more real-time information on tech M&A, follow us on Twitter @MAKnowledgebase.

Big Blue’s recent shopping spree

Brenon Daly

Contact: Brenon Daly

After a slow start to the year, IBM has dramatically picked up the pace – and the spending – in its M&A program. Big Blue only announced its first deal of 2011 in late March, and then was out of the market for nearly a half-year. But in the past two months alone, it has announced four deals. And each of the purchases, according to our estimates, was valued in the hundreds of millions of dollars.

Since late August, IBM has acquired analytics and visualization software vendor i2 Group, an analytics firm focused on financial services called Algorithmics, security management specialist Q1 Labs, and – just last week – HPC pioneer Platform Computing. Although IBM only released the value of one of those transactions, we estimate the collective tab on the two-month shopping spree is in the neighborhood of $1.5bn.

The purchases come as IBM shares have been trading around their highest-ever levels. So far this year, Big Blue stock has tacked on some 27%, while the Nasdaq Index has basically flat-lined. IBM will give its latest check-up to Wall Street after the closing bell today, with investors looking for third-quarter earnings of about $3.22 per share on sales of some $26.3bn. Ahead of the release, the stock was trading in-line with the broad market.

Double-barrel SIEM deals

Brenon Daly

Contact: Brenon Daly

In a highly unusual twist of timing, both IBM and McAfee announced significant acquisitions of security event and incident management (SIEM) startups within hours of each other Tuesday morning. First up, IBM said it was adding Q1 Labs as part of a new initiative around ‘Security Intelligence.’ (The announcement confirmed the rumored pairing between the two companies that we noted on Monday.) That was followed just two hours later by McAfee’s reach for NitroSecurity.

The transactions, which are both expected to close before the end of the year, take the two largest privately held SIEM vendors off the market. According to our estimates, Q1 was tracking to about $70m in sales this year while NitroSecurity was likely to generate roughly $30m. Between them, the two startups counted more than 2,300 customers. Further, Q1 and NitroSecurity were the highest-ranked private SIEM providers in a recent survey of IT buyers by TheInfoPro, a division of The 451 Group.

All of that goes a long way toward explaining why both startups got valuations substantially above prevailing market multiples. Collectively, Q1 and NitroSecurity took in a total of about $75m in funding over the decade or so they had been in business. As we understand it, the aggregate price for the pair is somewhere in the neighborhood of 10 times the amount they raised.

Is Q1 the one for IBM?

Brenon Daly

Contact: Brenon Daly, Andrew Hay

Despite posturing for a public market debut for some time, we understand that Q1 Labs may instead be headed for a trade sale. IBM is reportedly set to acquire the fast-growing ESIM vendor in a deal to be announced this week. The price for Q1, which recorded sales of some $60m over the past four quarters, couldn’t be learned. Goldman Sachs was in line to be lead underwriter for the IPO but instead will get the print, according to our understanding.

Assuming it closes, the deal would come almost exactly a year after ESIM kingpin ArcSight sold to Hewlett-Packard. (In that process, we gather that IBM was a bidder for ArcSight through the late rounds, as was EMC. McAfee was interested as well but was priced out relatively early on.) HP paid roughly 8 times trailing sales for ArcSight. Slapping that same multiple on Q1 values the Waltham, Massachusetts-based company at nearly a half-billion dollars. IBM had paid a similar multiple for Netezza and BigFix and only a slightly lower one in its most recent significant security acquisition, Guardium.

Rumors about a possible sale of Q1 have swirled for a number of years, with suitors ranging from Cisco to Oracle to McAfee. However, the most consistent name attached to Q1 has been its largest OEM partner, Juniper Networks. Indeed, sources indicated earlier this year that Juniper was considering an acquisition but a wide gap emerged over the valuation. Apparently, Juniper was offering about $300m, while Q1 was holding out for a number significantly higher than that.

What lies ahead for independent ESIM vendors?

Contact: Thejeswi Venkatesh, Ben Kolada

Hewlett-Packard recently announced the availability of ArcSight Express 3.0, an upgraded version of the product it acquired last year. In light of this release, we note that independent ESIM vendors aren’t resting on their laurels, either. They continue to develop, innovate and position themselves as potential IPO/acquisition candidates. Competition is already fierce among ESIM players, with each trying to expand their addressable markets, but with HP, Attachmate and Sophos adding ESIM offerings to their portfolios, rivals might look to add to their own to compete effectively.

In a recent report, my colleague Andrew Hay notes that there are several potential acquirers and targets. The list of takeout candidates continues to include Q1 Labs, although there have been M&A rumors around the company for a decade. Q1 Labs is also primping itself for an IPO, but we wouldn’t be surprised if it became the latest target in the growing line of dual-track acquisitions announced so far this year. Given its enviable revenue growth (Q1 Labs reported that its revenue grew 75% in 2010), we expect that Q1 Labs would catch a valuation similar to ArcSight. HP picked up that Cupertino, California-based security provider in September 2010 in a deal valued at nearly 8 times trailing sales. Beyond Q1 Labs, we could point to NitroSecurity, which was allegedly in talks with McAfee earlier this year. We’d also note that McAfee lost out on the ArcSight assets, and could look to NitroSecurity as an alternative.

Maybe M&A for McAfee?

Brenon Daly

Contact: Brenon Daly, Andrew Hay

With the ink barely dry on the M&A papers of SolarWinds’ purchase of TriGeo, we understand that another deal in the enterprise security information management (ESIM) market may be already in the works. Several industry sources have indicated that McAfee and NitroSecurity are thought to be close to an agreement that would give Intel’s subsidiary a solid ESIM offering.

McAfee has been looking in this market for some time. We gather that the company lobbed a bid (thought be in the neighborhood of $600m) for ESIM kingpin ArcSight before that company went public in February 2008. More recently, we weren’t surprised to hear that McAfee was in the process early for ArcSight last summer but got outbid by Hewlett-Packard, which ended up paying $1.65bn, or a steep 8 times trailing revenue for ArcSight.

If the acquisition indeed comes together, NitroSecurity would make a great deal of sense for McAfee. NitroSecurity, which we understand is running at about $40m in revenue, sells big-ticket installations to enterprises and the federal government – a market that McAfee clearly wants to be in. (NitroSecurity is also one of the few security vendors that has been able to crack into the industrial control system market, which gives the company a shot at lucrative contracts securing some of the nation’s critical infrastructure.)

The only other ESIM provider of size that might also give McAfee a comparable presence in the enterprise market would be Q1 Labs. However, that firm has a deep relationship with Juniper Networks, which is its single largest OEM partner. Nonetheless, Q1 has ascribed itself a fairly rich valuation, according to sources. The market may well soon have its vote on that, as Q1 recently indicated that it is looking toward an IPO.