Look for more mergers and acquisitions among cybersecurity firms in 2023 as companies race to build broad platform offerings. This consolidation trend could boost cybersecurity stocks, which underperformed during the bear market.
In 2022, private equity firms were active in buying cybersecurity firms. With valuations of public companies much lower heading into 2023, industry incumbents could step up, analysts say. The big question is whether they'll target smaller companies, either privately held or public.
The IBD Computer Software-Security group ranked No. 182 out of 197 industry groups tracked as of Dec. 28. The group is down more than 40% for 2022.
A recent Morgan Stanley report points to cash-rich incumbents Palo Alto Networks, Check Point Software Technologies, Fortinet and CrowdStrike Holdings as possible acquirers in 2023.
Cybersecurity Stocks: Driving Consolidation
Wall Street analysts say corporate America aims to bring more computer protection under the control of fewer cybersecurity stocks.
"Consolidation of security functions into broader security platforms is a positive trend," Baird analyst Shrenik Kothari said in a recent note to clients. "We expect vendors that offer a broader security platform, such as Palo Alto and Fortinet, to benefit from the vendor consolidation trends. We also expect longer-term disruption by cloud-native security providers such as Zscaler, CrowdStrike, and Cloudflare."
In its latest deal, CrowdStrike bought Reposify in September. Cloudflare in early 2022 acquired Area 1 Security for $162 million.
Palo Alto Networks has spent over $3.6 billion making 11 acquisitions over the past three years. Further, with roots in the "firewall" network security market, Palo Alto aims to build a broad cloud-based security platform.
In its latest deal, Palo Alto Networks in November bought Cider Security for $195 million in cash.
PE Firm Thoma Bravo Steps Up
Among PE firms, Thoma Bravo has been the most aggressive buyer of cybersecurity stocks. Thoma Bravo in October agreed to buy ForgeRock in an all-cash $2.3 billion deal.
The Justice Department is conducting an antitrust review of the deal. San Francisco-based ForgeRock provides identity and access management solutions for consumers and workforces, as well as devices that are part of the Internet of Things.
Thoma Bravo earlier acquired Ping Identity Holdings, SailPoint Technology, Proofpoint, Sophos and Barracuda. Also, more consolidation is expected among cybersecurity firms that sell products targeting consumer-facing businesses and identity and access management.
"The race is on between CyberArk, Okta, Thoma Bravo and Microsoft as each company develops or acquires the pieces to deliver a consolidated identity platform," cybersecurity stocks analyst Alex Zukin of Wolfe Research said in a 2023 outlook report.
Among possible targets, analysts have pointed to Tenable and Rapid7.
Building The Best Platform
While Microsoft is oft-viewed as a possible acquirer, cloud-computing rival Google has also been active. Google-parent Alphabet in 2022 acquired cybersecurity firm Mandiant in an all-cash $5.4 billion deal. Mandiant is now part of Google's cloud-computing business.
Earlier, Google acquired Siemplify, a security orchestration, automation and response provider, for around $500 million.
Meanwhile, Baird's Kothari said the challenge for cybersecurity stocks is building integrated platforms, not offering price discounts on product packages.
"Several vendors have already constructed full security platforms that include security analytics and incident response capabilities," he wrote. "(But) buyers are making the distinction between integrated solutions and bundles offering many stand-alone products."
Follow Reinhardt Krause on Twitter @reinhardtk_tech for updates on 5G wireless, artificial intelligence, cybersecurity and cloud computing.
