Cybersecurity Market Update: September 2020

Key Takeaways for Q2 2020

• The demand for cybersecurity solutions accelerated in Q2 as many companies dealt with the challenges of securing an increasingly digital and distributed workforce

• Cybersecurity companies were handsomely rewarded within the public markets during the 2nd quarter as their solutions became more mission-critical than ever before

• Adams Street expects the cybersecurity sector to remain healthy and continue to outpace the rest of the market in the near term

Global uncertainty was reaching peak levels at the start of Q2 2020. The COVID-19 pandemic was picking up steam worldwide and the S&P 500 sat nearly 25% lower than its all-time high, which had occurred a mere 41 days prior. Communities around the globe came to the realization that facemasks, social distancing, and working from home would not be a quick remedy to the coronavirus, but rather a way of life for the foreseeable future. As individuals were forced to rapidly adapt to the “new normal” across both their personal and professional lives, many businesses faced similar predicaments and found themselves scrambling to maintain some level of operational continuity as they were forced to throw their traditional playbooks out the window. Reduced budgets, suspended business travel, and dislocated supply chains presented massive hurdles for many organizations across all sectors. For cybersecurity, the shift to working remote caused the most disruption, due to the need to instantaneously secure a fully distributed workforce.

Even with proper warning, overhauling a company’s IT infrastructure to ensure a secure remote working environment is an arduous task. As IT teams were not even afforded the luxury of a heads-up, they had to design and implement a plan within weeks which previously might have taken years to complete.

The demand for cybersecurity solutions accelerated in Q2 as many companies dealt with the security challenges of an increasingly digital and distributed workforce

As such, the demand for cybersecurity solutions accelerated in Q2 as many companies dealt with the security challenges of an increasingly digital and distributed workforce. Below are three sub-sectors that have been seeing particularly strong tailwinds as a result of COVID-19.

• Identity and Multi-Factor Authentication:
  Verifying that an employee is who they say they are is a necessity when granting access to internal systems. Now that employees are logging in from outside a company’s network, it is critical to use identity verification and multi-factor authentication tools to ensure internal systems are only accessed by appropriate parties. Okta (OKTA), Ping Identity (PING), SailPoint Technologies (SAIL), and OneSpan (OSPN), four public identity security providers, all saw 50%+ quarter-over-quarter stock price gains as demand for their solutions soared.
• Endpoint Security:
  While working at home, employees are forced to rely on laptops, tablets, and mobile phones to do their job. Not only does this result in a substantial increase in the number of endpoints within an organization’s perimeter, but these new endpoints are connected to less secure home networks and are used for both professional and personal use. Crowdstrike (CRWD), one of the leading endpoint security platforms, saw an 80% stock price increase in Q2, the largest gain of all public cybersecurity companies. CRWD handily exceeded the upper-end of their revenue guidance for their 1st Quarter (ending 4/30/20) and increased their guidance for the remainder of their fiscal year (ending 1/31/21).
• Managed Detection and Response (MDR):
  Many small- to medium-sized businesses, in particular, scrambled to establish adequate security protocols for a work-from-home environment. Time and budget pressures meant many of these businesses were forced to look outward for a quick and cost-effective solution. MDR and security operations center (SOC) platforms offer an immediate solution to shore up a company’s security operations without needing to add expensive cybersecurity talent. Adams Street’s portfolio company, Arctic Wolf Networks, provides a SOC-as-a-service platform and is seeing strong adoption as customers turn to their product as a turnkey solution for 24×7 protection.

Despite a pandemic, high unemployment, and civil unrest, the S&P 500 posted a 25% gain through Q2 to nearly reach pre-coronavirus levels. Cybersecurity companies meaningfully outpaced that. They were handsomely rewarded within the public markets during the quarter as, for many companies, their solutions became more mission-critical than ever before. The high-growth cybersecurity index (>20% YoY revenue growth) saw a 69% uptick while the low-growth cybersecurity index rose 35% within the quarter.

The cybersecurity subsector has been relatively sheltered through Q2

Similar to past IT spending downturns, the cybersecurity subsector has been relatively sheltered through Q2. According to Morgan Stanley research, 83% of CIOs have downwardly revised their 2020 IT spending budget due to COVID-19 impacts. However, security software is the third least likely IT project (of 41 total) to see reduced spending if the economy worsens. This is only behind digital transformation and cloud computing.

Public markets continue to reward cybersecurity companies for growth over profitability. As of June 30, 2020, the median TEV / NTM revenue for high-growth public cybersecurity companies (23.9x NTM revenue) was 3.7x that of the low-growth cohort (6.5x NTM revenue). Of the high-growth companies, none had a meaningful valuation multiple based on EBITDA.

Despite the disparity between the two sets of companies, one thing was consistent through Q2: multiple expansion. TEV / NTM revenue expanded for all 26 public cybersecurity companies during the quarter. Forward revenue multiples increased by 62% and 36% for the high-growth and low-growth buckets (respectively), reaching numerous record highs across the board.

The impact of COVID-19 on the public markets is far from over. While some may have predicted the rise of remote work and continued digital transformation, very few could have foreseen the dramatic fashion in which these two trends were thrust upon many businesses. IT teams had to lean heavily into leading cybersecurity solutions in order to establish and maintain a secure operating environment while many businesses are in their most vulnerable state. It is Adams Street’s view that the cybersecurity sector will continue to outpace the rest of the market in the near term. While growth will likely taper off as the initial buying scramble wanes, Adams Street believes the sector will remain healthy as organizations keep cybersecurity as a top priority.

Data and analytics provided by S&P Global Market Intelligence. List of all public cybersecurity companies compiled by Adams Street. Data sourced June 30, 2020.

Important Considerations: This information (the “Paper”) is provided for educational purposes only and is not investment advice or an offer or sale of any security or investment product or investment advice. Offerings are made only pursuant to a private offering memorandum containing important information. Statements in this Paper are made as of the date of this Paper unless stated otherwise, and there is no implication that the information contained herein is correct as of any time subsequent to such date. All information has been obtained from sources believed to be reliable and current, but accuracy cannot be guaranteed. References herein to specific companies or sectors are not to be considered a recommendation or solicitation for any such company or sector. Projections or forward-looking statements contained in the Paper are only estimates of future results or events that are based upon assumptions made at the time such projections or statements were developed or made; actual results may be significantly different from the projections. Also, general economic factors, which are not predictable, can have a material impact on the reliability of projections or forward-looking statements.