Tag: security

Post-acquisition decapitation

Brenon Daly

The write-offs from wrong-headed acquisitions just keep coming. And we don’t mean just financial write-offs. Instead, we’re referring to the practice of a company’s board ‘writing off’ the executives who crafted a deal. This week’s high-profile example came when Alcatel-Lucent finally tossed overboard the two architects of ‘la grande fusion.’ Since that deal was announced in April 2006, the combination has incinerated some $20bn over shareholder value, leaving the telco equipment vendor with a market capitalization of just $13.6bn. (That’s less than the sales the company posted in 2007.) That two-year performance finally got Serge Tchuruk, the company’s chairman who represents the Alcatel side of the combination, and Patricia Russo, the Lucent legacy, shown the door.

This house-cleaning at Acaltel-Lucent comes just two weeks after AMD kicked Hector Ruiz upstairs. In virtually the same breath that AMD announced Ruiz would be relieved of his CEO post but continue as chairman, the company said it will divest much of the business it picked up with its $5.4bn purchase of graphics chip maker ATI Technologies. Announcing the deal two years ago, Ruiz said his combination offered ‘limitless’ possibilities for innovation. Instead, the future of AMD looks rather limited, in large part because of the $2.5bn it borrowed to cover its disastrous purchase of ATI. AMD’s total debt stands at $5bn, compared with just $1.6bn in cash.

Meanwhile, a chief executive who we’ve always thought must be on the hot-seat for a misguided acquisition appears to have gotten a bit of a reprieve this week. Symantec CEO John Thompson said Wednesday that fiscal first-quarter sales of its backup products outpaced overall revenue growth. That reverses the recent weakness in the company’s storage offering, which Symantec acquired with its $13.5bn purchase of Veritas in December 2004. Wall Street applauded the company’s report, with shares up about 10% since Wednesday. Still, Thompson has yet to recognize much value from the three-and-half-year-old purchase of Veritas. Symantec shares, which changed hands at $21.74 midday on Friday, are still about $6 below where they were when the company picked up Veritas. Perhaps that goes some distance to explaining the loose rumors this week that something big – possibly the much-discussed divestiture of the storage business or even an outright sale of the company – was brewing at Symantec.

Leading the acquisition

Deal Stock performance since deal Status of acquiring company CEO since deal
Symantec-Veritas, Dec. 2004 Down 35% John Thompson, CEO since April 1999, continues to serve
Alcatel-Lucent, April 2006 Down 61% CEO Russo and chairman Tchuruk ousted this week
AMD-ATI, July 2006 Down 77% Long-time CEO Hector Ruiz replaced in mid-July
Secure Computing-CipherTrust, July 2006 Down 51% Chairman and CEO John McNulty replaced in April

Source: Company reports, The 451 M&A KnowledgeBase

Sizing up Secure Computing

Brenon Daly

In many ways, Secure Computing’s divestiture of its authentication business to Aladdin Knowledge Systems raises more questions than it answers. Secure’s rationale for the sale is pretty simple: pay down some debt and get out of a sideline business that’s dominated by RSA and has a solid number two in Vasco Data Security. (For the record, Vasco is about four times the size of Secure’s SafeWord business and runs at a highly respected 25% operating margin.)

So it’s pretty clear why Secure was a willing seller (in fact, we hear that Secure had been a willing seller of the business for more than a year). Less clear is why Aladdin was a willing buyer of the property – at a relatively rich price of 2x sales, no less. Aladdin investors chose not to stick around for the company’s explanation of why it was willing to shell out two-thirds of its cash holdings for a product line in a cutthroat market. They fled the stock, trimming 14% off the price and sending Vasco to its lowest level since January 2004.

Of course, Secure has had an even rougher run of it on the market recently, as the company has come up short of Wall Street estimates for the past two quarters. Shares of Secure currently change hands lower than they have at any point during the past half-decade. Since the beginning of the year, the stock has shed 60%, a decline that recently cost longtime CEO James McNulty his job.

The long, uninterrupted slide in Secure’s valuation raises an even larger question about the divestiture: Was the sale of SafeWord just a prelude to an outright sale of the company itself? The numbers certainly don’t work against a deal. In fact, Secure is currently valued at basically 1x sales – just half the level it got for the divested property. (Usually, it’s the reverse, with corporate cast-offs getting sold at less than half the overall company’s valuation.)

Any planned acquisition, however, would probably have to go through Warburg Pincus, which holds the equivalent of about 7% of Secure’s common stock, going back to a financing deal it struck to help Secure buy CipherTrust in July 2006 for $264m. Warburg invested $70m at a time when Secure stock was trading at about 3x higher than it is now. With Warburg that far underwater on its holding, we can only imagine the pointed questions the private equity firm will ask Secure.

Sophos bags an elephant

Brenon Daly

In a twist on a private-public transaction, Sophos laid out on Monday a bold $340m plan to pick up Utimaco, an encryption vendor that trades on the Frankfurt Stock Exchange. Rather than rolling into the public company, Sophos plans to take Utimaco off the market. It plans to fund the acquisition by drawing on three sources. (My colleague, Nick Selby, has the details on the financing as well as the strategy.)

The financing is crucial because this deal is a whopper. If it goes through, it’ll be the largest IT security deal in seven months. More significantly, however, Sophos’ planned acquisition of Utimaco stands as the biggest purchase by a privately held security company. In fact, it’s nearly twice the size as the number two deal, Barracuda’s unsolicited run at Sourcefire. (And it’s not certain that deal will close at all. Sourcefire, which is slated to report second-quarter earnings on Thursday, has shot down the deal so far.)

Although Utimaco will be erased from the market, we view the disappearance as temporary. Once the two companies get through the integration, we expect Sophos to try to go public once again. (Recall that last fall, it announced plans to list on the London Stock Exchange but shelved them as the markets deteriorated.) Among the underwriters for the planned IPO was Deutsche Bank, which advised Sophos on the purchase of Utimaco. Indeed, it was the same DB banker on this deal that also co-advised on a very similar transaction last fall, McAfee’s $350m purchase of Dutch encryption vendor SafeBoot. (DB and UBS Investment Bank advised SafeBoot, while Morgan Stanley advised McAfee.)

Lessons from a big Yahoo

Brenon Daly

Talk about being thrown straight into the shark tank (or more accurately a barracuda tank): John Burris has agreed to step from the board to the CEO spot at Sourcefire. The appointment comes just two weeks after Barracuda Networks made an unsolicited offer for the network security vendor. We noted that the low-ball bid of $7.50 per share from Barracuda – an aggressive company that lives up to its name – will likely set the ‘floor price’ for any sale of Sourcefire. (Since the bared-teeth bid was revealed, Sourcefire’s long-suffering shares have closed above the offer price in every trading session, finishing Wednesday at $7.92. The $0.42 difference equates to about a $10m gulf between what the market says Sourcefire is worth and what Barracuda says the company is worth.)

The fact that Sourcefire – which had been looking for a chief executive replacement since February – stayed in-house to fill the top spot makes us wonder if the company hasn’t resigned itself to a sale. Don’t forget that Sourcefire was supposed to be sold to Check Point Software Technologies more than two years ago – at a higher price than its current valuation, no less. And although we are far from experts in employment contracts, we saw nothing in Burris’ agreement that would make an acquisition of Sourcefire prohibitively expensive. Certainly nothing like the employee severance plan at Yahoo, which is effectively a poison pill.

Indeed, Burris may well look at the tenure of Yahoo’s Jerry Yang during Microsoft’s unsolicited approach to the search engine as a quick executive lesson in how not to handle M&A. On the no-no list: refusing to talk to a suitor, erecting all sorts of obstacles to consolidation and, above all, continuing to insist that you know best in creating value at a company – even when all evidence points to the contrary. “I bleed purple,” Yang said at one point, using Yahoo’s signature color to demonstrate his closeness to the company he helped found. Yang may see it that way, but Carl Icahn and other Yahoo shareholders don’t particularly care. They’re very clear that blood is red, just as money is green. We think Burris – whose connection to Sourcefire only dates back to March and who previously headed up sales at Citrix Systems – won’t suffer a similar case of color blindness.

How do you say ‘Tumbleweed’ in French?

Brenon Daly

About a year and a half ago, we heard Tumbleweed Communications was being shopped hard by private equity firms. The intervening credit crises – which bumped up the price of debt and trimmed the returns on LBOs – quite likely tabled any buyout. The email security vendor has struggled since then. It came up short of Wall Street estimates in every quarter in 2007. Shares that changed hands above $3 each in early 2007 dropped in a straight line to just above $1 this March.

Rather than a PE shop, however, it turns out Tumbleweed’s buyer will be the Sopra Group, a French IT consulting firm. Sopra will make the acquisition through its Axway subsidiary, paying $2.70 in cash for each share. With about 51 million shares outstanding, Tumbleweed gets a an equity value of about $138m, only slightly more than twice the sales it is expected to record this year. Sopra also got a discount from its currency: the Euro has climbed about 18% in value since we reported on Tumbleweed in February 2007. See full report.

Creative destruction and its discontents

Brenon Daly

In a February 2007 report, we asked an egghead question about valuations in a sector that had been ‘creatively destroyed,’ to borrow Joseph Schumpeter’s oft-used phrase. At the time, we weren’t asking for purely academic reasons. Rather, we were trying to put a price on Tumbleweed Communications following Cisco’s purchase of rival anti-spam appliance vendor IronPort Systems. (Rumors had private equity firms looking at Tumbleweed.)

It turns out we weren’t far off in our valuation. We slapped a $150m price tag on Tumbleweed; last Friday, French IT consulting firm Sopra Group said it would pay $138m in cash for the company. The deal is expected to close in the third quarter. While the companies see a bright future for the combination, we have some reservations. Specifically, we wonder how Sopra, which is making the acquisition through its Axway subsidiary, will hit its target of 12-15% operating margins for the combined company next year. (Tumbleweed has run at negative operating margins for years, piling up an accumulated deficit of $300m in its history.)

Whatever the performance of Tumbleweed under its new owners, we have to say that Sopra certainly didn’t overpay for the company, which should double its sales here in North America. At just two times trailing sales, Tumbleweed was valued at less than half the price-to-sales multiple found in comparable transactions.

Anti-spam shopping

Acquirer Target Date Price Target TTM sales
Sopra/Axway Tumbleweed June 2008 $138m $58m
Google Postini July 2007 $625m $70m*
Cisco IronPort Jan. 2007 $830m $100m
Secure Computing CipherTrust July 2006 $264m $48m
Symantec Brightmail May 2004 $370m $26m

*estimated, Source: The 451 M&A KnowledgeBase

Deal-making in a desert

Brenon Daly

Exactly a year ago, SonicWall handed over $25m in cash for Aventail. The deal looked like a ‘last-gasp’ transaction in a number of ways, not the least of which was that Aventail’s purchase price was less than one-quarter of the venture funding the company had raised over the years. Beyond the money-in/money-out gulf at Aventail, we would note that in the year that has passed, not a single significant SSL VPN deal has been reached.

Since the big-name consolidation in this market began in mid-2003, most of the large security acquirers have gone shopping here. SSL VPN deal flow hit its high point early on, with NetScreen shelling out $265m, mostly in stock, for Neoteris. (A half-year later, Juniper Networks threw $4bn in stock at NetScreen, in a deal that Juniper has yet to recognize much of a return on.) Other tech giants quickly inked deals of their own, including Cisco, Citrix and Microsoft.

In contrast, the handful of companies that have acquired SSL VPN technology since mid-2007 have been tiny outfits, with a number of consulting shops doing the buying. That hardly suggests top-dollar acquisitions. The SSL VPN vendors that missed out when the big buyers came through the market may need to scale back their exit expectations. We would drop PortWise and Array Networks, among others, into that bucket. 

Significant SSL VPN deals

Acquirer Target Date Price
F5 Networks uRoam July 2003 $25m
NetScreen Neoteris Oct. 2003 $265m
Cisco Twingo March 2004 $5m
Citrix Net6 Nov. 2004 $50m
Microsoft Whale Communications May 2006 $75m*
SonicWall Aventail June 2007 $25m

*estimated, Source: The 451 M&A KnowledgeBase

Barracuda bares its teeth

Brenon Daly

Never known as a shy or retiring competitor, Barracuda Networks has lobbed an unsolicited bid to acquire Sourcefire for $7.50 per share in cash. (Full report.) That works out to a slight 13% premium on Sourcefire’s closing price ahead of the bid, and essentially where the shares began 2008.

We look at Barracuda’s bid as setting a ‘floor price’ for Sourcefire. It is certainly an opportunistic offer, as Sourcefire has been burned on Wall Street. (The company didn’t help itself when it came up short of investors’ expectations in its first quarter as a public company a year ago.) To get this deal closed, however, we suspect Barracuda will have to raise its bid. Investors have already pushed Sourcefire shares above the offer price.

To push this deal along, Barracuda can draw on the experience of one of its two outside backers, Francisco Partners. The buyout shop took IT security appliance vendor WatchGuard Technologies private in July 2006 after a protracted and bitter campaign.