Written by Chris Ahern
With 2018 firmly in the rear-view mirror, Strategic Cyber Ventures took a data-driven approach to identify trends and insights from cybersecurity investment over the past year. Overall, 2018 was an exciting year for cybersecurity investing, with record highs in dollars invested and average deal size, the continued rise of investment outside of the US, a vibrant and robust M&A market, and an open and (mostly) healthy IPO market. Let's take a look…
In 2018 we saw $5.3 billion in global venture capital funding, nearly double that of 2016 (81%). To get right to the point, this rate of investment is not sustainable. This is the case with the broader tech ecosystem as a whole, as others have stated. In cybersecurity, there are likely many zombies out there. They've raised big rounds, growth has slowed, perhaps due to vendor fatigue or increased competition, and now these companies can't raise at increased valuations from prior rounds, or at all, and are being propped up by existing investors that will eventually grow weary of keeping them alive. These companies will eventually float to the surface over the next few years with less than desirable outcomes for investors and founders.
As you can see, the total funding increased substantially, while the total number of deals remained relatively the same as in 2017. This means the average deal size is now $15.8 million, a heavy right-skew driven by "mega" cyber deals (deals over $100M) over the past several years. Many of these companies are going out for their second and even third helpings (Tanium, CrowdStrike) of investment:
These targets are considered to be "on deck" to go public this upcoming year. But it's still unclear what the public equity markets have in store in 2019. A few weeks in and we're already experiencing a government shutdown, trade wars with China, and expected slow down in global economic growth.
Rise of the Rest (of the World)
Asia and Europe, together, now account for 22.6% of global investment in cybersecurity companies, double that of 2014 (12.7%), and as high as 24.1% in 2016. This is led by investment in the UK, Chinese and Israeli companies.
We've seen this trend in the broader tech ecosystem as well, with many, large international funds and investment outside of the US. Simply put, amazing and valuable technology companies are being created outside of the US. But, to keep things in perspective, California continues to lead the way, alone, accounting for almost half of worldwide investment in cybersecurity companies in 2018 (46%).
Cyber investing in the DMV
Being an investor based in Washington, D.C., Strategic Cyber Ventures was curious how things looked here at home. We were somewhat surprised by how disproportionate funding was towards Virginia and Maryland. Sure, we expected Maryland and Virginia to command most of the region's investment, but only $80 million of nearly $1 billion, went to DC venture-backed start-ups over this 4-year period.
As DC residents, we have to think there is more the city could do to entice cybersecurity companies to establish their headquarters in the city. Virtru drove the only funding of cybersecurity investment into DC proper.
M&A markets
We saw a strong M&A market in 2018, though still short of the 5-year highs we saw in 2015.
Significant M&A activity includes:
- Duo Security acquired by Cisco for $2.4 billion
- Cylance to be acquired by Blackberry for $1.4 billion
- ThreatMetrix acquired by RELX Group for $817 million
- AlienVault acquired by AT&T reportedly for $600 million
- InfoArmor acquired by Allstate for $525 million
- Phantom Cyber acquired by Splunk for $350 million
- Evident.io acquired by Palo Alto Networks for $300 million
- Iovation acquired by TransUnion
An exciting development in 2018 is that we saw private equity more than dip its toes into the cybersecurity market with the following significant acquisitions:
- Barracuda Networks acquired for $1.6 billion by Thoma Bravo
- Bomgar acquired for approximately $739 million by Francisco Partners
- Centrify acquired for reportedly $400 million by Thoma Bravo
- Cofense acquired for $400 million by BlackRock
And acted as financial sponsor to many other bolt-on acquisitions including:
- Skyhigh Networks acquired by McAfee via its financial sponsor Thoma Bravo and TPG Capital
- Avecto and BeyondTrust acquired by Bomgar via its financial sponsor Francisco Partners
Public markets
2018 was another strong year for cybersecurity company IPOs with 4 significant IPOs on major stock exchanges, raising about $1.4 billion.
This is the second consecutive year of 4 cybersecurity IPOs. On deck for 2019 are rumored to be: CrowdStrike, DarkTrace, Pindrop, Tanium, and Illumio. Looking forward, we expect significant investment (both equity financings and M&A) in cybersecurity companies to continue in 2019, but at or just below the levels we saw in 2018. We also believe that if public equity markets maintain their strong start to the year due to optimism on a China-US trade deal and the Federal Reserve's slightly dovish tone of late, we could see some Q1 or Q2 cybersecurity IPOs. However, only time will tell what 2019 has in store.
ABOUT STRATEGIC CYBER VENTURES
Cybersecurity is national security, and we're a D.C.-based venture capital firm on a mission to find cutting-edge startups that help us make an impact. We go beyond the check to help our founders win by leveraging our industry connections and experience as cybersecurity veterans to fuel their companies from inception to exit.
To learn more about our investment strategy and portfolio, explore www.scvgroup.com or connect with us on X @SCV_Cyber to be part of our mission in shaping the future of cybersecurity.