Consolidation is on the rise in cybersecurity, with large companies in the field acquiring startups to help address an ever-expanding attack surface as companies move more activities to the cloud. In the latest development, Cyber Ark, one of his leading security companies founded in Israel, is acquiring his machine identity specialist Venafi for his $1.54 billion.
CyberArk will pay $1 billion in cash and approximately $540 million in stock. Shareholders of both companies have approved the transaction, which is expected to close in the second half of 2024, the companies said.
Venafi is majority-owned by Thomas Bravo and was valued at $1.15 billion when the private equity firm bought a controlling stake in 2020. In other words, Venafi's selling price today shows a modest increase since 2020.
The news confirmed rumors of an agreement between the two companies that had been under investigation for the past few days.
CyberArk's interest in Venafi comes at a time when security teams are seeking a better, more comprehensive understanding of their organizations' threat landscape and attack surface. In today's market, this is a very complex puzzle to solve thanks to the growth of mobile technology, cloud services, and distributed work.
Essentially, all of this has led to an explosion of computing endpoints. This includes the many devices that people may use to connect to your network, as well as other devices on your network where data is processed or stored. A rule of thumb is that there are 40 “machines” for every person on a corporate network. All of this has led to a significant surge in business for companies focused on identity security. Some startups in this space have raised significant amounts of funding. Oasis Security and Silverfort are good examples.
Venafi's technology is focused on securing and understanding the flow of data between these machines.
The startup is said to be an expert in PKI and certificate management, and CyberArk says the deal will expand its total addressable market by $10 billion (totaling $60 billion).
“This acquisition is a pivotal milestone for CyberArk and allows us to further advance our vision of protecting every human and machine identity with the right level of privilege control.” CyberArk Ark CEO Matt Cohen said in a statement. “By joining forces with Venafi, we are expanding our ability to protect machine identities in a cloud-first, GenAI, and post-quantum world. Our combined technology, capabilities, and expertise will help global enterprises , and enables chief information security officers to defend against increasingly sophisticated attacks that leverage human and machine identities as part of the attack chain.”
The acquisition also highlights some of the themes playing out among cybersecurity companies around consolidation.
Some companies that raised money at high valuations a few years ago are now seeing their valuations come under pressure as they fail to achieve ARR growth or profitability for various reasons and are nearing a predictable demise. aware of being exposed.
These companies are now looking to exit, sometimes being sold for far less than their final valuation. For example, in recent weeks, Akamai acquired his Noname Security for $450 million, less than half of its previous valuation. Wiz then acquired Lacework, which was previously valued at $8.3 billion, for just over $150 million, and attempted to return to investors about $800 million in cash that Lacework had kept in the bank. The deal fell through.
On the other hand, a select few cybersecurity companies are currently experiencing significant growth and are being named as integrators. Wiz raised $1 billion a few weeks ago to fuel its acquisition spree, and CyberArk, with a market cap of over $10 billion, is clearly another company in this category.
The trend toward consolidation is also underway among acquired companies. In May 2020, Venafi acquired Jetstack, bringing Kubernetes expertise to the company. The day before, CyberArk acquired Idaptive.