Consolidation is here in cybersecurity as the biggest players in the space are taking on startups to help them address the ever-expanding attack surface for businesses as they move more business to the cloud. In the latest development, CyberArk — one of the largest Israeli-founded security companies — is acquiring Benafimachine identity specialist, for $1.54 billion.
CyberArk will pay $1 billion in cash and about $540 million in stock. Shareholders in both companies have approved the deal, which is expected to close in the second half of 2024, the companies said.
Venafi is majority owned by Thoma Bravo and was valued at $1.15 billion when the private equity firm bought its controlling stake in 2020. In other words, Benafi’s sales price today represents a modest increase from 2020.
The news confirms rumours of an agreement between the two companies that have been doing the rounds in recent days.
CyberArk’s interest in Venafi comes at a time when security teams are trying to gain a better and more holistic understanding of their organizations’ threat landscape and attack surface. In today’s market, this is an extremely complex puzzle to solve thanks to the growth of mobile technology, cloud services and distributed work.
In essence, all of this has led to an explosion of computing endpoints, which includes not only the many devices people might use to connect to a network, but any other device on the network where data is processed or stored. The rule of thumb is that there are 40 “machines” for every human on a corporate network. All of this has led to a big wave of business for companies focused on identity security. Some startups in the space have also raised large sums of money — Oasis Security and Silverfort are good examples.
Venafi’s technology focuses on securing and understanding the flow of data between these machines.
The startup is described as specializing in PKI and certificate management, and CyberArk says the deal will expand its own total addressable market by $10 billion (for a total of $60 billion).
“This acquisition marks a pivotal milestone for CyberArk, allowing us to advance our vision to secure every identity – human and machine – with the right level of privilege control,” Matt Cohen, CEO of CyberArk, said in a statement. “By joining forces with Venafi, we are expanding our capabilities to secure machine identities in a cloud-first post-quantum GenAI world. Our integrated technologies, capabilities and expertise will meet the needs of global enterprises and empower Chief Information Security Officers to defend against increasingly sophisticated attacks that leverage human and machine identity as part of the attack chain.”
The acquisition also highlights some issues playing out among cybersecurity companies around consolidation.
Some companies that raised money several years ago at higher valuations are finding those valuations under pressure as they somehow fail to grow ARR or reach profitability and are nearing the predictable end of their runs.
These companies are now looking for an exit, and sometimes that comes at a price well below their latest valuations. For example, in recent weeks: Akamai acquired Noname Security for $450 million, less than half of its last valuation. and Wiz tried to buy Lacework, valued last time at $8.3 billion, for just over $150 million, returning about $800 million in cash Lacework had in the bank to investors — that deal fell through.
On the other hand, some select cybersecurity firms are seeing significant growth right now and are destined to be the unifiers. Wiz raised $1 billion a few weeks ago to fuel an acquisition spree, and CyberArk, which has a market cap of more than $10 billion, is clearly another in that category.
The consolidation trend is playing out even among those being acquired. In May 2020, Venafi acquired Jetstack to bring its Kubernetes expertise to bear. Just a day before that, CyberArk had acquired Idaptive.
