trending Market Intelligence /marketintelligence/en/news-insights/trending/ZcOtmvntZ60pMPW3D7Rlug2 content esgSubNav
In This List

Cloud competition driving investment, M&A in cybersecurity sector

Podcast

Next in Tech | Episode 49: Carbon reduction in cloud

Blog

Volume of Investment Research Reports on Inflation Increased in Q4 2021

Blog

Price wars in India: Disney+ Hotstar vs. Amazon Prime Video vs. Netflix

Blog

Using ESG Analysis to Support a Sustainable Future


Cloud competition driving investment, M&A in cybersecurity sector

The changing nature of data storage and the increased move to hybrid cloud solutions is creating M&A targets of some of the higher-performing, small-to-midsized cybersecurity companies, analysts said.

Cybersecurity providers historically focused on endpoint security, protecting the computers and servers owned by a specific company. As data moves to centralized cloud servers hosted by third-party providers like Amazon.com Inc. and Microsoft Corp., the technology needed to secure data has changed. That shift is driving a wave of investment in cloud-focused tools in the cybersecurity community, and those furthest along in that transition are winning market share, analysts said.

Cloud security operates on a shared-responsibility model, where the cloud host provides its own firewall but companies are responsible for the transfer of data and intellectual property as it moves in and out of the cloud infrastructure. The shared model is further complicated by hybrid- and multi-cloud services, where a company may want to keep some operations on-premises or move data between two different cloud providers.

"Cloud spending has moved to the forefront, so some of the better-performing companies with better growth rates … their products have moved to the cloud," William Blair analyst Jonathan Ho said in an interview.

SNL Image

Big companies like Intel Corp. are investing in small cybersecurity firms. Palo Alto Networks Inc. recently acquired two as it looked to expand its cloud security suite. While much of the acquisitions have been in small, private companies, analysts said the deal activity could start involving small public cybersecurity companies as well, particularly those valued at under $5 billion.

"These technologies have to be bundled together to provide full solutions," Fitch Ratings analyst Alen Lin said in an interview. "I think M&A is going to be a continuing thing for this industry, and you're probably going to have to have the legacy players to be the consolidator."

Legacy cybersecurity company Symantec Corp. attempted to revamp its strategy for the new cloud-based market, but it struggled to execute since its 2016 acquisition of Blue Coat Systems Inc., leading Symantec itself to become an M&A target. Broadcom Inc. in August agreed to acquire Symantec's enterprise security business for $10.70 billion.

Symantec is not the only big name to struggle with making the transition via M&A. One of the hardest-hit cybersecurity stocks this year has been FireEye Inc., which had lost over 16% for the year to date as of Aug. 23, compared to an 11.9% gain for cybersecurity exchange-traded fund ETF Managers Trust - ETFMG Prime Cyber Security ETF and a 25.6% gain for broader information technology ETF Vanguard World Fund - Vanguard Information Technology ETF.

Wedbush analyst Dan Ives pointed to FireEye's product suite and a post-deal integration as responsible for the company's underperformance.

"Clearly the move to products and platform approach has more pain ahead and the stock will remain firmly in the investor penalty box," Ives said in a recent note on FireEye. He pointed to FireEye's 2014 acquisition of endpoint security provider Mandiant as an initial stumbling block in its shift to cloud-based platform solutions.

On the other hand, analysts said companies like Varonis Systems Inc. and NICE Ltd. are successfully navigating the move to cloud-based infrastructure, yielding market share wins.

"This quarter again was evidence that the shift to the cloud is paying serious dividends for NICE as the company is seeing increased adoption for its analytics and AI [artificial intelligence] offerings," Ives said in a note following the company's August earnings release.

However, even where market execution issues exist today, the analysts said most big cybersecurity companies have the resources to catch up.

"There's no immediate pressure [to sell]," Ho said. "Most companies, even if they have quarterly execution issues, their business models won't erode that quickly."

Despite its recent stock underperformance, FireEye, for example, had a 2.29 average "outperform" score as of Aug. 23 among analyst ratings compiled by S&P Global Market Intelligence.

SNL Image