WA MarketView: Darktrace's likely return to private ownership

In its statement to shareholders, Darktrace noted that the cybersecurity market is fragmented with “few truly global players”. It went on to add that “serving the world's largest customers and enterprises requires Darktrace to continually make significant technology investments and further scale globally, to ensure that its platform can stay ahead of changing cyber threats.” The announcement surprised the cybersecurity community, though perhaps it should have been expected; there are similarities with two other UK cybersecurity companies, Mimecast and Sophos. Both were similar in size and at identical stages of development when they reverted to private ownership, gaining investment and strategic support to innovate and scale operations.

The intended acquisition of Darktrace for $5.3B is on annual sales of $545M in FY 2023 and revenue growth of 31% on the previous year. Continued growth is expected in FY 2024 with guidance increasing at the Half Year to around $685M. The company estimates that there are 150,000 potential customers which, based on the number of current customers (~8,800), represents a customer market share of only 6%, providing space for organic customer acquisition. Thoma Bravo noted the opportunity to “accelerate its development into a scaled, global leader, further strengthening its capability and offer to customers”. The headline is clear enough – take an organisation with a global presence and established channels, expand its reach, and invest in its platform to capture new business and upsell and cross-sell to existing customers. It’s not a dissimilar story to Darktrace’s potential stable mate, Sophos.

Thoma Bravo completed the acquisition of Sophos in Q1 2020 at a valuation of $3.9B, around five years after its IPO. Sales were $762M and given its trajectory and investment in staff, sales are now estimated to be over $1B, all achieved outside of the public spotlight. At the time of acquisition, EMEA was the biggest sales region, but the US still made up over 30% of revenue. Since then, the headcount has grown in India – where there was already a significant operation – and in the US and Canada to further expand its presence in the North American market. During its time under Thoma Bravo’s stewardship, Sophos has transitioned to delivering XDR and MTR, expanding its platform and evolving the business model through innovations and acquisitions (SOC.OS, 2022).

Mimecast was taken private by Permira at the start of 2022 with projected revenues in FY 2022 of $592M and a valuation of $5.8B. The company had a positive net income, over 90% customer retention and 98% of the revenue was recurring. Over 50% of the business was in the US, with 28% in the UK,10% in South Africa and only 11% in the rest of the world. Going private has allowed Mimecast to focus on longer term strategic plans to leverage its position in the US, enter new regional markets, and continue the expansion of its platform. Whilst Mimecast no longer publicly reports sales it has continued to grow quickly through cross selling services.

So, what do Sophos, Mimecast and Darktrace have in common? Firstly, there’s a similar growth story. If the Darktrace acquisition completes, then all were public companies for 4-6 years with revenues over $500M before returning to private ownership. They were growing, profitable and importantly have built a significant US market presence without being the dominant player. All have strong channels to market with solid customer bases and repeatable business. Finally, they are pursuing a platform strategy that will deliver cross-sell and upsell opportunities. For investors this is important – growing existing customer revenue delivers a lower cost of sale and contributes strongly to profitability.

Secondly, all three companies share a similar investment story and future – accelerate platform development and market presence. The investment case for Darktrace is about building on a winning model rather than resuscitating a broken one. This means providing investment and strategic support to develop solutions to address new threats and use-cases, delivering additional services to existing customers. In addition, building a global model will allow Darktrace to further strengthen its position in the US, by far the largest market, and to focus on customer acquisition in new markets. This is where the similarities between Sophos, Mimecast and Darktrace are likely to continue.