Consolidation is happening in the cybersecurity space as larger players in the space opt for startups that can help them address the ever-expanding attack surface for enterprises as more activity moves to the cloud. In the latest release, CyberArk — one of an army of larger security corporations founded in Israel — is Venafi’s takeovermachine identity specialist, for $1.54 billion.
CyberArk can pay $1 billion in money and about $540 million in stock. Shareholders of each corporations approved the transaction, which the corporations expect to be finalized in the second half of 2024.
The majority owner of Venafi is Thoma Bravo, and its valuation at the time was $1.15 billion the private equity firm bought a controlling stake in 2020. In other words, Venafi’s selling price today represents a moderate increase from 2020.
The message confirms gossip agreement between the two corporations, which has been circulating for several days.
CyberArk’s interest in Venafi comes at a time when security teams are trying to gain a higher and more holistic understanding of their organizations’ threat landscape and attack surface. In today’s market, this is an extremely complex puzzle to solve thanks to the development of mobile technology, cloud services and distributed work.
In fact, all of this has led to an explosion in computing endpoints, which include not only the many devices that individuals can use to connect to a network, but also any other device on the network where data is processed or stored. A general rule of thumb is that for every human in a company’s network, there are 40 “machines”. All this has led to a significant increase in interest in corporations focusing on identity security. Some startups in the industry have also raised large sums – Oasis Security and Silverfort are good examples.
Venafi’s technology focuses on securing and understanding the flow of data between these machines.
The startup is described as a specialist in PKI and certificate management, and CyberArk says the deal will expand its own total addressable market by $10 billion (to a total of $60 billion).
“This acquisition represents a key milestone for CyberArk, enabling us to realize our vision of securing every identity – human and machine – with the right level of permission control,” Matt Cohen, CEO of CyberArk, said in a statement. “By joining forces with Venafi, we are expanding our capabilities to secure machine identity in the post-quantum cloud-based world, GenAI. Our integrated technologies, capabilities and expertise will meet the needs of global enterprises and enable chief information security officers to defend against increasingly sophisticated attacks that leverage human and machine identities as part of the attack chain.
The acquisition also highlights some prevailing themes among cybersecurity corporations around consolidation.
Some corporations that raised money at higher valuations a few years ago are finding themselves under pressure at those valuations as they fail to various degrees to grow ARR or achieve profitability and are reaching the predictable end of their runway.
These corporations are now looking for an exit, and sometimes that comes at a price well below their recent valuations. For example, in recent weeks: Akamai acquired Noname Security for $450 million, lower than half of its last valuation; and Wiz attempted to acquire Lacework, last valued at $8.3 billion, for just over $150 million, returning roughly $800 million in money that Lacework had in the bank to investors – a deal that fell through.
On the other hand, a select few cybersecurity corporations are currently experiencing significant growth and are being designated as consolidators. A few weeks ago, Wiz raised $1 billion to fuel the acquisition frenzy, and CyberArk, which has a market capitalization of over $10 billion, is definitely one other company in this category.
The consolidation trend occurs even among acquired corporations. In May 2020, Venafi acquired Jetstack to leverage its Kubernetes expertise inside the company. Just a day earlier, CyberArk acquired Idaptive.