Private equity enters the consolidation of the cybersecurity sub-sector
The fragmented identity and access management sub-sector of cybersecurity needs to be consolidated, and private equity firms are seizing the opportunity to combine vendors and create players that can better compete in the market.
Transaction activity in 2022 by Thoma Bravo LP is an example of this, according to Garrett Bekker, principal research analyst at 451 Research. The software-focused private equity firm completed its approximately $6.9 billion acquisition of SailPoint Technologies Holdings Inc. on Aug. 16 and is currently in the process of acquiring Ping Identity Holding Corp. for $2.8 billion.
“You might see a private equity business like, say, Thoma [Bravo] pick up Ping and SailPoint,” Bekker said. “Chances are they’re looking to combine these two companies.”
Identity and access management is a group of technology that deals with managing digital identities and controlling access to corporate resources. There are at least five sub-segments in the space, including authentication, identity governance, access management, privileged access management, and customer identity access management, Bekker said.
“These silos are starting to break down, and some of that is driven purely by market forces. Vendors in these categories are looking for new market opportunities. They’re also forced to compete with larger vendors that span multiple categories, like Microsoft. and Okta.”
Global private equity and venture capital deals in the identity and access management sector totaled $12.37 billion across 77 deals in the year to August 12, according to data from S&P Global Market Intelligence.
* Download a spreadsheet with data featured in this story.
* Click on here for more on global private equity and venture capital inflows in July.
* Click on here for greater private equity coverage.
The year-to-date value and volume of private equity-backed deals don’t appear to be on track to match 2021’s $34.44 billion, which was driven by the sale of McAfee Corp. . to a group of private equity investors for approximately $12 billion in cash, excluding debt.
“I don’t know if we’ll revisit the $12 billion deals, but there’s still a good amount of private equity out there, and there’s still, more importantly, a lot of viable targets,” says Becker.
Total M&A in the subsector is expected to surpass 2021 levels, with strategic acquisitions expected to more than offset the decline in private equity acquisitions. Private equity-backed deals fell to around 20% of total mergers and acquisitions so far in 2022, up from more than a third, even up to 38%, in recent years, Bekker said.
The rise of interest in cybersecurity
According to Bekker, cybersecurity mergers and acquisitions, particularly for the identity and access management industry, are strong in large part because cybersecurity is a relatively safe haven in a down market and relative to other sectors of technology, media and telecommunications.
“That’s even more true over time because we now have a lot more regulations than 20 years ago that really pushed cybersecurity. There’s more awareness at the board level that security is an essential thing to spend, whereas 20 years ago when the dot-com crashed, it was really hard to make that point.”
Bekker added that the shift to a new security paradigm called “zero trust” in recent years has made identity essential to online interaction. Zero trust requires verification, authentication, and verification of permissions and policies before anyone is allowed to access certain resources.
In the broader security industry, many companies are prime targets for private equity, Bekker said. “According to our calculations, there are probably around 4,000 security vendors. There may be at least several hundred identity and access management vendors. … If we look at the different cybersecurity sectors that have been the most active in terms of M&A, identity and access Management has been in the top 3 for at least 5 years, if not number 1.”
451 Research is part of S&P Global Market Intelligence.