Mergers & Money: Email Security Proves Popular In Dealmaking And The Market

Editor’s note: This is Mergers & Money, a monthly column by Senior Reporter Chris Metinko that covers dealmaking in the enterprise tech space.

In an industry with popular buzzwords like “zero-day” and “honeypots,” and more acronyms than one can shake a stick at, email security can sometimes get lost in the noise.

Subscribe to the Crunchbase Daily

However, that is not the case this quarter when it comes to private equity and even the stock market itself. Email security has seen big deals and even a related IPO as the market grows with companies continuing to look for ways to keep employee communications safe — even as a pandemic has separated many from the IT and security professionals that in the past helped keep them safe.

Thoma Bravo made history in April when it announced it would take Sunnyvale, California-based Proofpoint private — after the company had spent nearly a decade trading on the public market — in a $12.3 billion deal. The acquisition was the largest in cybersecurity history, beating out Broadcom’s $10.7 billion purchase in 2019 of another well-known email security provider, Symantec, which sold its enterprise division in the transaction.

Then just this month, private equity popped up again in a major cybersecurity deal when the Symphony Technology Group (STG) agreed to buy FireEye’s enterprise security division — which includes its email business — for the tidy sum of $1.2 billion. That came just a few months after STG bought McAfee’s enterprise business for $4 billion.

Other smaller deals in the space include Leesburg, Virginia-based Cofense buying Israel-based anti-phishing provider Cyberfish and Eden Prairie, Minnesota-based HelpSystems acquiring Foster City, California-based email security provider Agari. Terms of those deals were not disclosed.

None of that even touches on KnowBe4’s solid IPO showing. While the Clearwater, Florida-based company specializes in cybersecurity awareness training, a large aspect of that business centers on training people how to stop phishing and other malicious attacks coming through email. The company saw its shares immediately pop 25 percent after debuting on the Nasdaq and its shares continue to hover around that price — giving it a market cap of $3.3 billion.

While hacks such as those that happened to Colonial Pipeline and SolarWinds draw international attention, most attacks come through companies’ communication platforms, with email being a main culprit.

Cyber giant Check Point Software Technologies estimates about 90 percent of attacks on organizations originate with malicious emails. A recent report on global email security estimates the market should grow to about $3.52 billion this year and stand at about $5.27 billion by 2025 — a compound annual growth rate of nearly 11 percent.

Some of the growth and interest in the space can undoubtedly be attributed to the pandemic, as companies have scrambled to better secure and protect their growing remote workforce — including adding more security around email and other forms of communications their employees use constantly.

Mimecast — one of Proofpoint’s largest competitors in recent years — recently estimated there was a 64 percent increase in the number of email threats last year as cybercriminals took advantage of the rise in digital activity due to the pandemic.

While many of the large players in email are now owned by private equity, several venture-backed companies have slowly crept in to try to keep communications safe. Both Redwood City, California-based Material Security and Sunnyvale, California-based Armorblox have raised large rounds just this year. Two San Francisco-based security companies — Valimail and Abnormal Security — also have seen significant funding since being founded, raising $84 million and $74 million, respectively, according to Crunchbase.

With the need for email security seemingly only growing, both financial and strategic buyers could eye those players still in the private markets as their next target to help get into the expanding market.

Cybersecurity and the public markets

Speaking of security and the markets — as well as buzzwords and acronyms — earlier this month, SentinelOne filed its S-1 to go public. The filing was not a surprise, as Bloomberg reported in late February the company was preparing for an initial public offering later this year that could value it at more than $10 billion.

Nevertheless, it does give us a look at its numbers of the Mountain View, California-based extended detection and response (XDR) provider for the first time. The company reported 100 percent year-to-year growth, with revenue increasing from $46.5 million for its fiscal year 2020 to $93.1 million for fiscal year 2021 ended Jan. 31.

However, that was not enough to get the AI endpoint security provider profitable. According to the filing, SentinelOne watched its net losses grow from  $76.6 million in fiscal 2020 to $117.6 million last year.

The filing also showed the company’s largest stakeholders — including Insight Venture Partners with a 15.7 percent stake, Tiger Global Management (12.4 percent), Third Point Ventures (11.3 percent) and Redpoint Ventures (8 percent).

Last November, the company closed a $267 million Series F led by Tiger that valued the company at $3 billion — which tripled its valuation from just nine months prior.

Aside from being one of the largest private cybersecurity companies, the filing also is notable as it marks the return of endpoint companies to the IPO calendar. SentinelOne’s largest competitor — CrowdStrike — undertook its IPO in June 2019 and was one of the most successful cyber offerings ever — watching its stock pop and nearly double on its first day of trading — raising more than $610 million at an initial valuation of about $6.7 billion.

CrowdStrike’s market cap now stands at more than $52 billion, more than 8x its value when it went public.

Around CrowdStrike’s IPO, a lot of dealmaking occurred in the endpoint space. In November 2018, Blackberry announced it would acquire endpoint security provider Cylance for $1.4 billion — right as that company had reportedly been considering an IPO. Then in August 2019, VMware acquired Carbon Black for $2.1 billion.

Illustration: Dom Guzman