Identity management specialist Ping Identity (a portfolio company) just announced its acquisition by private equity firm Thoma Bravo for a $2.8 billion enterprise value and a massive 63% premium, marking the sixth multi-billion M&A deal in cybersecurity so far this year.
This deal follows the recent SailPoint takeover (also by Thoma Bravo), which was the first large public acquisition of an identity and access management (IAM) platform. As a reminder, IAM relates to all the technologies and frameworks surrounding connections to a proprietary network and is a key component of Zero Trust architectures. It is there to ensure that the network access is granted to the right people, at the right time, for the good reason, allowing them to access only the files/software they require. The first layer of IAM, authentication/identification, is used to onboard and verify users’ identity before accessing the applications/network and then manage the identity lifecycle.
As we said back in October, IAM is highly fragmented between identity specialists (Okta, Ping, SailPoint…) and access specialists (CyberArk…) and needs to scale and consolidate by offering end-to-end solutions. It’s likely that Thoma Bravo will seek to engage this process and combine its various identity & access management assets.
From a financial standpoint, the 63% premium offered for Ping (and 8.2x sales multiple) strengthens our view that the recent acquisition of Mandiant by Google at a whopping 57% premium (and 7.7x sales multiple) is sparking higher competition among suitors and, accordingly, higher bid prices. Premiums in previous sector transactions – Mimecast, Zix, McAfee – were in a 16-23% range.
Cybersecurity has indeed become a strategic industry, attracting increasing M&A interest from both Tech companies seeking to bolster their cloud offerings and private equity firms attempting to create cybersecurity one-stop shops through the combination of mid-cap security players.
Moreover, this premium is offered for a business that delivers modest growth (Ping’s Annual Recurring Revenue was up 21% in Q2) compared to some cybersecurity peers (around 50-60% growth for the likes of Zscaler and Crowdstrike), suggesting that future M&A deals could come with larger premiums. In the short term, the SailPoint and Ping acquisitions could raise the speculative appeal of Okta, Cyberark and Forgerock.
