You may not be able to tell from the current state of stocks in the tech sector, but make no mistake: Software and computing technology is crossing lines and proliferating all corners of the economy. Cloud computing (an app accessed from a remote location via an internet connection) is a total game changer. It helps organizations "do more with less," a critical need in this inflationary environment -- and a need that will continue to receive plenty of attention even if there's a recession in 2023.
However, this explosion in the number of apps used by nontech companies presents new security challenges. That's why leading cybersecurity company Palo Alto Networks (PANW 0.11%) went on the mergers and acquisitions (M&A) hunt again and recently closed a deal for an app security (AppSec) start-up. Here's why that's so important, and why Palo Alto Networks stock is a top buy in my book.
Helping customers "shift security left" toward app development security
After a multiyear spending spree on cybersecurity start-ups from late 2018 to early 2021, CEO Nikesh Arora has come out of acquisition hibernation to purchase Cider Security. The total price tag was $195 million, plus the cost to replace stock-based compensation for Cider employees.
This is relatively small coin for Palo Alto Networks, though some investors might be fretting over the short-term impact on profitability (more on that momentarily). But I believe Cider will play a key role in Palo Alto Networks' continued leadership in the security software space. In Palo Alto Networks' description, Cider is "a pioneer in AppSec and software supply chain security." What does that mean?
When broken down into simple terms, software development is not so different from the design and manufacture of any other product. A company makes a request for software to fulfill a need. Then engineers lay out plans for said product, start writing code (the basic building blocks of software), check it for quality, and then begin the process of distributing it (these days, increasingly via a cloud service).
Just like a company making a tangibly physical product might want to keep production under wraps from snooping eyes, so is the case with software. During production, code might be written and delivered by different people from different locations, and in this process there's opportunity for data theft -- or even the insertion of malicious code that could continuously snoop or steal information after the final software product is delivered and in use. Imagine, your software asset working for you, but also secretly for the wrong team!
This is what Cider aims to protect, the development process of software, as well as the ongoing security of the asset once it's put into operation. Cider apparently generates little in the way of revenue now (Palo Alto Networks said the acquisition will have no immediate impact on its financials, save for the cash outflow for the purchase). However, research points to rapidly rising attacks on apps. Palo Alto Networks cited a point from researcher Gartner that predicts a tripling in software supply chain attacks from 2021 to 2025.
Suffice to say the AppSec niche of the cybersecurity industry will be a critical piece of software security in the coming years. Interestingly, Gartner has semiconductor design software company Synopsys listed as the current leader in AppSec. Synopsys is a little-known business in the chip industry, but it's a pretty big deal. Palo Alto Networks is on to something here with its takeover of Cider.
Will the acquisition pay off for shareholders?
Though Palo Alto Networks just purchased a start-up with little in the way of sales, adding Cider to the mix could instantly up its current game in AppSec. Additionally, Palo Alto Networks' Prisma Cloud platform is already fueling massive growth. Next-gen security services (in which Prisma Cloud results are reported) revenue grew 67% on an annualized basis in the latest quarter, and the company expects annualized revenue to grow at least 40% in fiscal 2023 and represent about 30% of total sales. Arora and the company's outlook for total revenue this next year implies overall growth of at least 25%, and the goal is to double total revenue over the next few years or so.
What of profitability? On an unadjusted net income basis, Palo Alto Networks recently turned profitable. Purchasing Cider and adding new employee stock-based compensation will be a drag on this metric. However, on a free-cash-flow basis, Palo Alto Networks has been highly profitable for years.
Data by YCharts.
Arora is focused on converging these two profitability metrics over time, but stock-based comp (which is the primary cause of the difference between net income and free cash flow) will be a long-term project to get reduced. In the meantime, stock buybacks (funded from free cash flow) are being used to offset the effect of dilution on shareholders. Over the last reported 12-month stretch, Palo Alto Networks repurchased $915 million in stock to offset $1.02 billion worth of stock paid out to employees.
This is messy accounting, but I believe the strategy will work. Palo Alto Networks offers a compelling combination of growth and profitability, and Arora has demonstrated his ability to keep both engines running smoothly since taking over as CEO. The acquisition of Cider will most certainly help Palo Alto Networks keep moving forward as application security becomes an increasingly critical need.
