Embracing a Best in Class IAM Solution – the Investor Perspective

Perfect. Lemme just go to the last page first, just for a quick intro from our end. So my name is Philip gr, pleasure to be here. We're an investment bank Stevens from the US privately owned investment bank with around 1,300 professionals. Rob and I work in the Frankfurt team, and our focus is entirely on B2B software and tech enabled services.

And, and one vertical is cybersecurity, where we've done a number of deals. So what we do is we advise companies, founders and investors on capital raises, sell sides, also buy sides, so m and a and all its variations, but also on IPOs in the space. And you see a, a few deals we've done recently. These are mostly European deals, the the first few. So it's a very active vertical for us, and yeah, great to be here.

Robin, quick intro from your end. Yeah, great to meet you all. My name is Robin Brun Bush. I'm a director of the Stevens office in Frankfurt. And as I've said also part of the software practice and cybersecurity is also part of my subsector focus and Philip and I have done all the deals in Germany or in in Europe together. And great to meet you all and looking forward to the discussion. So I mean, the way we work is we work with founders at a very early stage.

COE can be helpful when they may bring in a minority investor in a later stage when they may look to sell a majority stake to either a strategic or to private equity. And then, and then later on, if it's a IPO candidate, something we can help as well. So that's a bit our, our profile. So we wanna talk today about a bit the, the investor perspective and kind of the, the key themes, what are driving the m and a activity in the space. And there's a lot of, there's a lot of m and a activity as you know, and I think there's three key themes here. One important one is the convergence in the space.

So what we see is the, the customers more and more wanting to reduce the number of vendors to a minimum number and therefore as a vendor you want to have a, a broader portfolio of comprehensive solutions. So I think that's, that's one big theme. Technology enhancements, AI I think is the buzzword ev everywhere. So I AI automation, AI enablement, it's, yeah, it's, it's a way to, it's a way to automate, but it's not yet a product. And then regulation, everything around the EU wallet.

Dora, MS two, sorry, can you just take on the next one? Yep. Surely.

Yeah, as, as Philip said, the, the, the regulation, I think it's, especially in Germany or in Europe, we are in the forefront of the regulation. I mean the US has also caught up with that and in terms of data privacy, data security, there's also a shift going on, but I think they're looking at Europe and seeing, you know, the pioneer work that we do here. But this is, this is and will be a global theme going forward. And obviously all companies in Germany and Europe are, are working to towards it and are looking what they have to do and see how they can prepare for this, right?

So especially this two is something that is on the, on the agenda as it will directly affect a lot of companies. Sorry, that was something in the, in the throat. Yeah. The next one is pe. So why is PE interested? Private equity is a lot of interest in the space.

The one, the one key thing is cybersecurity is quite difficult to grasp for the outsiders and identity and access management is just something which is easy to understand. It's easy to, to grasp as a use case and it's the critical capability to start off in a, in a security stack. So it's the initial stepping stone.

The, the other thing is private equity wanna build a a, a clear best in breed solution, a comprehensive tech stack. And we see a number of deals in the space here. So Toma Bravo is probably the largest consolidator in the, in the community. They've got 30 billion of dollars invested in cybersecurity alone.

So one, I think one big theme is the acquisition of Ping Identity, which they emerged with Forge Rock. You see a couple of other deals in the peace space here. GA investing in Transmit, that was the biggest series A valuation in cybersecurity in history with over 2 billion Carlisle investing in IC consult. So more than system integrator space, having done a num a, a big roll up theme, cross-link with brive. And in the PAM space actually main capital and point shop was a deal we advised on. So there's a lot of p interest in the space.

And yeah, I think on the strategic side of it, we also see the same that strategics are more and more looking to innovate via m and a because they probably come to a stage where the innovation curve is kind of flattened out and they want to acquire companies just to add to their product portfolio again, to have an holistic solution. Okta is probably one of the most, yeah, most serial acquirers in the, in the space Author Air, that was three years ago. Tenable is another one. Delania.

So yeah, a lot of, a lot of examples there of, of conservation. So it's, it's gonna be, it's gonna be continuing conservation also of US platforms looking to acquire in Europe. And I think, you know, one of the big challenges in the European space is it's, it's far too fragmented compared to the, compared to the us and then you have to also differentiate between the product, the vendor side and the, and the services side. For private equity, often the, the services side is, is a bit easier to understand or grasp.

So, you know, if it's MSPs, if it's VADs, if it's resellers is system integrators, the product side is often complex for private equity to differentiate, you know, where, where, where, where the different right, right. Wins and, and use use cases are Don't be, don't be shocked by the number of logos here, but this is a bit the, the market map, how we, how we view or how we cut the identity and access management market. And I think what this shows is you've got various buckets within this space.

And if you look about, if, if you look from an investor perspective, the question is you wanna, you want to build a platform in this, in this segment is where do you start as a, as a conversation platform. So we, we see for example, privilege access management space, we see a, a trend of them looking to acquire maybe in the governance space. So IGA we also see others going from IGA or, or the customer, IM on the top left moving more toward the access management piece. So there's, you, you see actually the conservation between these segments coming more and more together.

But as you see these, there, there are a lot of names, it's fragmented and there'll be more consideration coming in this space. Yeah, looking at the, at the valuation over time. So as you can see, we, we started off in 19 then the, so I have a laser, yeah, here.

So the, the first dip that you see obviously is the, the COVID-19 lockdown dip. This is something that every industry in the world has seen. So no surprise there. I think the recovery was quite, quite oppressive.

So that, that also, you know, talks to the cybersecurity space in general, how resilient it is. I mean you see quite a, quite a peak here.

So that's, that's the, the gray line is the general cybersecurity index. So that's, that's endpoint cloud security and, and other segments in there as well. And the light blue is the identity and access management index. So you have companies like CyberArk and obviously ForgeRock and, and the companies like this. And so what you can see here is basically after the drop, during COVID-19, you saw quite a, quite a, a jump in, in the, in the purchase prices and the, and the valuations. This was you obviously everything changed in the world.

There was remote work, you know, new work, different model to how people are working more from home. You need to take care of a lot of things around remote access, you know, iot security, et cetera, and things like this. So the market, the market recovered quite a lot. But then to be honest, after a while we saw that as well as advisors, the market cooled down again. So the valuation levels, the peak was here as you can see somewhere in, in mid late 2021 and then going into 2022, the variation levels overall they cooled down.

I mean they still remained pretty high, so they remained definitely higher than they were before Covid, but I mean, especially owners and, and private equity owners, but also founders, they were still thinking about the good old times and the year before where the variation level was, was really, really high. So that was something we had to, to, to deal with, right? And had to educate our clients saying, you know, need to be a little more realistic.

And so looking at this, this, if you keep this one in mind, so exactly this timeframe that I talked about in 2022, when we go to the next page, you can see how that really translated into, into some substantial consolidation in the identity and access management space. Phil mentioned it, Toma Bravo really took this opportunity to go on a buying spree in the IM space. So SailPoint is quite interesting because they used to own SailPoint, took it public then in, in late 20 20 27.

And then as you know, as the valuation went down and they saw an opportunity at an, for them attractive valuation because they knew the company obviously very well, they took it private again and delisted the company. So that wasn't the deal was announced in, in April, 2022 and it was closed in August, 2022. Then later this year, clo closely, closely afterwards they acquired Ping identity for roughly 3 billion Euros dollars. And then Forge Rock closed after for roughly $2 billion and SailPoint was around $7 billion.

So in total we're talking about $12 billion being deployed only in the identity and access management space, which was extremely impressive. So if Phil mentioned 30 billion in total, so roughly, yeah, almost half of it was spent on IAM and then the very first time actually at Toma Bravo did that, they combined Ford Truck and Ping identity though they merged Ford truck into ping identity. I mean the, the portfolio was quite complimentary or was on the other way on the other, on the other hand it was pretty, pretty strong overlap.

So they said, you know, the customers didn't know what, what will happen with them. And the the result was they say we need to build something bigger. There are large players out there, Okta and Microsoft obviously are the, the biggest players in the identity X management space and we need to build something of scale and let's put this one together, combine the best of of them and, and build something that has, that has scale that can compete with Microsoft and Okta on a global basis. Right? So this is, this is what happened.

And as mentioned, this is the first time they did that because Toma Bravo has a portfolio of, of a lot of cyber businesses to name a few Barracuda, Sophos Entrust and, and, and a few others. And they never combined it to one group. This was the very first time quite interesting. And then on the bottom you see, you know, not only Toma Bravo was active, but also Okta, I just mentioned them, one of the largest IM players in the world. And they used the opportunity also to do, to go on a buying spree and, and acquire businesses that are complimentary to the offering.

I mean, UNO for example was helped them complement their, their Okta personal consumer business, which was the first approach of Okta in the, in the, in the B2C space. So you can also see that also larger corporates have a need for tuck-in opportunities, technologically know go to market customer access. These are things that, that are really high on the agenda of strategic buyers as well. If you go here one further, I mean this is, this is quite an incredible yeah graph.

If you see, you look here on the top, I mean this was something we, we just, we've just seen Okta Ortho for example was a $7 billion transaction and that was basically a good, good chunk of the entire Im spending that took place in the year 2021. And then we just have, again, the, the, the deals that we just mentioned. So basically Toma Bravo was responsible for the entire deal volume in the identity and access management space in 2022. So it was in total 12 billion and Toma Bravo was more than 11 billion of it.

So that, that's quite incredible. And then the volume went down again to, to a very low level. So this is, this is very impressive and this also obviously reflected here in the valuation because the valuation is always relative to the performance of a business. So if it's, if the performance goes down, the multiple goes up. And this really helped to, to my brow because they were able to, to pay a premium obviously on these companies, especially SailPoint because they knew the business, the performance went down a little bit after Covid and they, they saw a chance and, and bought it.

Yeah, just maybe a few themes on valuation and what investors are looking for in particular if your company wanting to look to sell at a certain stage to be well prepared and maximize value. The key, the key question we always get when selling a cybersecurity company and also in an entity space is, you know, what's your right to win against the major platform? So how defensible is your value proposition? That is absolutely key. And you have to demonstrate to investors, your, your USPS from a, you know, offering point of point of view.

The second, the second point, investors always look, you know, how scalable is your, is your product. And we often see that companies are very focused on one geographic market, let's say the German speaking market or just in Scandinavia. Investors will want to have a proof, proof points that you can also expand into other geographies and not just be in one, you know, in one geography. So scalability is key. And so investing in in growth is, is, is absolutely, absolutely important.

I think the market dynamics that they're attractive and, and regulation is a key driver for, for is a key market tailwind. I think that's, that's pretty easy demonstrate. So that's a tick in the box. The next point is, is really crucial in particular for private equity is retention. So they're very KPI focused on net retention rates, gross retention rates, churn rates, and just seeing first of all how well the company actually can grow with their existing customer base. Also with upselling and cross-selling and then adding a new, new logos as well.

So having the balance right, it's mostly growing, let's say 60% with your existing customer base and 40% with new logos. Getting that balance right is really important and, and, and the retention rates in the best possible way. Investors are very, very focused on that. Obviously the, your growth strategy and you know how you get to the next level with just from a valuation point, there's certain, there's certain scale levels which are important. So the first probably is 5 million ar the nex is 10.

You, you, you get in those brackets a different multiple valuation multiple, and then the next is probably 20. So those are really important growth levels for a company. When you think about exit and valuation is, and also demonstrating how you get there from a growth strategy point, sales performance efficiency, it's probably in the private equity playbook, the number one where they can really add value in addition to providing capital for add-ons and buy and build is, you know, how can you optimize your, your pricing price increases. Often something that is, is a big lever.

Everything around contract efficiencies, auto renewals, you know, just, just, just supporting with, with, with sales and pricing strategies and, and also marketing and sales efficiencies in terms of incentivizing the sales team, et cetera. Yeah, and I think that that all plays into the quality of the revenue mix. In Europe you often have a, a number of solutions still still on-prem. So investors look really how, you know, how quick can the transformation from on-prem to, to a subscription model, ideally to a pure SaaS model. How quickly can, can can you go with that?

And then the last is, is profitability. It's something two, three years ago all investors were only looking at growth, growth, growth, growth. That has changed. So I mean the, the, the rule of 40 is still in the mind of investors. So growth rate plus your profitability is the rule of 40. And I'd say a few years ago it was all about growth, but now investors are very focused on, you know, you don't have to be highly profitable. Growth is still probably more important, but at least a route to profitability. And that is more and more on a focus.

So that's really important to, to bear in mind as, as kind of a, you know, key metrics of investors looking, looking if they value a company in the cybersecurity space. I think we're, we're up on time, so thanks, thanks for for joining us. Thank You guys. Time for a quick question if anybody has one.

Okay, well thank you. Alright, thank You. Thanks so.