The number of personal records exposed in data breaches worldwide nearly doubled to 169 million in 2015, according to the Identity Theft Resource Center. That surge has fueled strong demand for cybersecurity services. Research firm Markets and Markets estimates that the global cybersecurity market will grow from $106.3 billion in 2015 to $170.2 billion by 2020.
Yet that market remains heavily fragmented, with companies offering different bundles of services. Meanwhile, many cybersecurity stocks were crushed over the past year due to concerns about their high valuations in a choppy market. The PureFunds ISE Cyber Security ETF (HACK +1.07%), which contains a basket of these top stocks, has fallen more than 20% over the past 12 months. These two factors have fueled speculation that the entire cybersecurity sector could undergo a major consolidation later this year. Let's take a look at two big buyouts which could occur if that happens.
Image source: Pixabay.
Cisco buys FireEye
Cisco's (CSCO +4.79%) core businesses of routers and switches, which accounted for nearly half its revenue last quarter, face tough competition from cheaper rivals like Huawei and new cloud-based networking solutions that require less physical hardware. Sales of switches fell 4% annually last quarter, sales of routers climbed 5%, and the company's total revenue (excluding the divestment of its set-top business) inched up 2%.
Cisco has been trying to grow its top line by investing more heavily in its higher-growth service provider video, security, wireless, and IoT businesses. Revenue from its security business -- which has been strengthened by its purchases of firewall provider SourceFire and threat detection firm ThreatGRID -- rose 11% annually to $462 million but only accounted for 4% of its top line. To boost that revenue, several analysts have suggested that Cisco buy another threat detection firm, FireEye (FEYE +0.00%).
RBC Capital recently noted that FireEye's 60% plunge over the past 12 months -- which reduced its enterprise value to just $2.5 billion -- makes it a compelling target for Cisco, which finished last quarter with $60.4 billion in cash, cash equivalents, and investments. Rumors of a Cisco buyout surfaced before, but both companies shot down those reports last year. FireEye also claimed that it wouldn't sell itself until it generated $1 billion in annual revenue. FireEye's revenue rose 46% to $623 million last year, and is expected to rise another 33% to $829 million this year. Nonetheless, buying FireEye would more than double Cisco's annual security revenue and make it a billion-dollar business, so it wouldn't be a surprising purchase.
FireEye's real-time threat map. Image source: FireEye.
CheckPoint buys CyberArk
Check Point Software (CHKP 0.30%), the world's top firewall provider, could also be interested in making a major cybersecurity purchase to juice up its sales, which rose 9% annually last quarter. At the top of the list is CyberArk Software (CYBR +0.00%), which protects privileged accounts and isolates threats within a network for 40% of the Fortune 100 companies and 17 of the world's 20 biggest banks. Yet its stock has tumbled around 40% over the past year due to concerns about slowing sales growth and competition from larger firms.
Back in January, Check Point reportedly held takeover talks with CyberArk, which could complement its acquisition of two cybersecurity start-ups in 2015. At the time, Barclays analyst Saket Kalia said that the acquisition "would be a net positive with added growth and expense synergies" for Check Point. Oppenheimer & Co. analyst Shaul Eyal disagreed, noting that the smaller size of CheckPoint's most recent cybersecurity acquisitions (which were both under $200 million) indicated that there was "a low probability" that it would buy CyberArk, which has an enterprise value of $930 million.
However, Check Point could certainly afford to pay a hefty premium for CyberArk, since it finished last quarter with $3.7 billion in cash, marketable securities, and short-term deposits. CyberArk's sales are expected to rise 29% to $207 million this year, which would be equivalent to about 12% of CheckPoint's estimated sales this year. CyberArk is also profitable on a GAAP basis, which means that it wouldn't become a dead weight on Check Point's bottom line like many of its unprofitable peers. More importantly, bundling CyberArk's "best in breed" privileged accounts protection services with its market-leading firewall could sharpen its competitive edge against other IT security firms.
Which buyout could happen first?
I believe that Cisco will stay away from FireEye for now, because it likely believes that ThreatGRID already widens its moat against FireEye in the threat prevention market. But if FireEye continues to fall, Cisco might try to buy the company at a steep discount. Check Point's purchase of CyberArk seems more likely, since the companies have already held talks, but the lack of subsequent news suggests that a deal won't happen anytime soon. Investors shouldn't buy shares of FireEye of CyberArk expecting a big buyout, but they should keep an eye on these two stocks and the overall sector for signs of a major consolidation.
