Credit: Shutterstock photoMost cybersecurity stocks seem to be in a funk heading into 2018 but a pickup in initial public offerings - and, perhaps, mergers - next year might pique the interest of investors.
[ibd-display-video id=3017249 width=50 float=left autostart=true] Venture capital funding for possible new players continues to be strong, says CBI Insights. Among well-funded startups are these names: Tanium, Lookout, Illumio, Cybereason, CrowdStrike, Netskope, Cloudflare, Stackpath, Draktrace and Cylance.
Illumio and Cloudflare bear watching in particular as possible IPOs. Other computer security providers that may go the IPO route in 2018 are Zscaler, Tanium, AlienVault, Centrify and ForgeRock, says Renaissance Capital.
"There have been some 1,300 startup companies that have been funded in the cybersecurity world overall the past 3 to 4 years," said Jonathan Ho, analyst at William Blair. "So there's increased competition. A lot of those startups are generating revenue, they're starting to eat into the market opportunity of the bigger (public) companies."
The reason for the prospective onslaught? Weak December quarter guidance from several computer security providers generally led to a recurrence of malaise in the sector, analysts say. One exception was an above-consensus outlook from Palo Alto Networks ( PANW ), which drove its shares higher.
What's perplexing to some investors is that security has underperformed other software sectors and the S&P 500 for over two years. That's despite a steady stream of reports over computer hackers like those who breached 3 billion accounts at Yahoo, data breaches similar to those at Equifax, and ransomware attacks just like those at WannaCry.
Cloud Computing Factors In
The shift to cloud computing may be one reason for slower revenue growth at security vendors. As large companies shift computing workloads from private data centers to the likes of Amazon Web Services, part of Amazon.com ( AMZN ), they're reassessing what security technology they need. Another factor could be an overcrowded market.
This year's crop of security IPOs has been mixed. Okta, which went public at 17 in April, is trading above 30 a share. Okta, a provider of identity management services, raised $187 million. Still, investors have been cool to two other smallish IPOs, Sailpoint ( SAIL ) and Forescout Technologies ( FSCT ).
IBD'S TAKE:IBD's Computer-Software Security group is ranked No. 128 out of 197 industry groups, down from No. 63 two months ago. Qualys has the highest Composite Rating at 96 out of a possible 99, followed by Fortinet at 94 and Palo Alto Networks at 91. No other companies are above 90. Learn more at IBD Stock Checkup .
Some IPOs over the next 12-18 months, however, could be bigger. Tanium, Lookout, Illumio, Cloudflare and CrowdStrike are among security startups called unicorns by CBI Insights because their valuations top $1 billion.
One problem for public cybersecurity vendors that might want to acquire a hot startup is that valuations are running high.
"The public companies are being selective in terms of what they're acquiring," said William Blair's Ho. "They're more willing to look at companies that are struggling, that can be plugged into their sales channel, as opposed to buying the market leader at a high multiple."
Proofpoint ( PFPT ) in November acquired Cloudmark for $110 million. McAfee, recently spun off by Intel (INTC), in November acquired Skyhigh Networks, a specialist in cloud security. Terms weren't disclosed.
Walking A Tightrope With Investors
One problem for public companies is that as startups go forward with IPOs, they could undermine confidence in existing technologies as they make their case to investors.
"The shift to Cloudflare is likely pressuring some of the traditional firewall, web application firewall vendors and other providers," Adam Holt, analyst at MoffettNathanson, said in a note to clients. "We'd expect to see an IPO in the next 12-18 months." Cloudfare provides content delivery as well as security products.
Brad Zelnick, a Credit Suisse analyst, has a similar view.
"We expect that a pipeline of security IPOs will educate investors on the declining role of firewalls," Zelnick said in his note to clients.
Firewall network products are the biggest part of the cybersecurity market. Palo Alto, Fortinet (FTNT), Check Point Software Technologies (CHKP), Cisco Systems (CSCO) and others compete in the firewall market. Firewalls are located between private networks and the internet and block unauthorized traffic.
There's been speculation 2018 could be the start of an upgrade cycle, with companies buying next-generation firewall products. Spending on firewalls and threat detection technologies popped in 2014-15 after a few well-publicized cyberattacks.
Zelnick is among analysts that say firewall vendors are in trouble because of cloud computing.
"The cloud dissolves the concept of network perimeter," he wrote. "As the corporate network disintegrates we anticipate spend will be redistributed away from the network to the detriment of incumbent firewall vendors." Some firewall vendors are adapting to cloud computing by focusing on software-as-a-service rather than network appliances that plug into networks.
Palo Alto Defies The Odds
One firewall vendor avoided the recent sell-off. Shares in Palo Alto jumped on Nov. 21 after it reported earnings and revenue that topped views.
"Given the overall malaise in the security market, evidenced by the weak guidance for Q4 from nearly every vendor, we believe Palo Alto's strong growth rate and impressive guidance suggests the company is taking share across the board," Andrew Nowinski, Piper Jaffray analyst, said in a note.
Palo Alto looms as an industry consolidator as it develops a broader product line, say analysts. William Blair's Ho says Palo Alto's platform provides customers with access to third-party security tools, giving it a view into what startups are gaining traction and might make a good purchase.
If growth slows in the firewall market, security vendors may expand into identity and access management or target artificial intelligence tools that aid in external threat detection, analysts say.
Andrew Nowinski, analyst at Piper Jaffray, says startups Carbon Black and CrowdStrike are battling incumbent FireEye in the endpoint security market - detecting threats from smartphones, laptops and other devices connected via the web to corporate networks. The endpoint detection market is expected to reach $1.5 billion by 2020, says research firm Gartner.
Mountain View, Calif.-based Symantec (SYMC) has been busy. Symantec acquired Blue Coat Systems in 2016 for $4.65 billion and also purchased LifeLock, a provider of consumer identity-theft protection services, for $2.3 billion.
Acquisitions by private equity firms slowed in 2017 amid uncertainty over corporate tax reform. Thoma Bravo in November said it will acquire Barracuda Networks (CUDA) in a cash deal valued at $1.6 billion, perhaps a sign of PE firms being more active again, analysts say.
RELATED:
2018 Stock Market Outlook: What To Watch For In The New Year
In AI Technology Race, U.S. Chips May Be Ace-In-The-Hole Vs. China
Cybersecurity Firm Palo Alto Networks Earnings, Revenue Beat
The views and opinions expressed herein are the views and opinions of the author and do not necessarily reflect those of Nasdaq, Inc.
The views and opinions expressed herein are the views and opinions of the author and do not necessarily reflect those of Nasdaq, Inc.
