Infosec firms go public as data breaches grow

Rapid7, LogRhythm and Mimecast are joining a growing list of cybersecurity firms planning to go public in 2015 to capitalise on investor interest following a spate of hacker attacks.

Shares of publicly traded infosec firms have outperformed the market in recent months, as high-profile data breaches at Sony, JPMorgan and Anthem prompt businesses to spend more to secure their computer networks.

"The cybersecurity market is in the early innings of a massive growth opportunity," said FBR Capital Markets analyst Daniel Ives. "There are many innovative private security vendors. Tech investors' eyes are glued to who has the 'magic solution.'"

Boston-based Rapid7 provides software and services that help businesses assess and monitor security risks. It has more than 3500 customers, including Amazon.com, American Express and Bank of America.

Mimecast, also based in Boston, is an email security firm with 10,000 customers. According to its website, revenue rose 30 percent in 2014 to US$88.4 million. LogRhythm, based in Boulder, Colorado, provides technology to help companies monitor activity across their networks.

All three companies are planning to sell shares to the public and seeking valuations in excess of US$1 billion, according to people familiar with the matter, who declined to be identified because the plans are not yet public.

Rapid7, whose investors include Bain Capital Ventures and Technology Crossover Ventures, has chosen Morgan Stanley and Barclays to assist with an initial public offering, the people said.

LogRhythm, whose investors include Access Venture Partners, Adam Street Partners, Grotech Ventures and Riverwood Capital, has chosen JPMorgan Chase and MorganStanley for an IPO in the second half of the year, the sources said.

Mimecast, whose investors include Insight Venture Partners, Dawn Capital and Index Ventures, has spoken to some investment banks about an IPO later this year but has not hired any firms, the sources said.

Representatives from the three companies and the banks working with them all declined to comment.

Volatile stocks

With global spending on IT security set to increase 8.2 percent in 2015 to US$77 billion, according to market research firm Gartner, the shares of publicly traded cybersecurity firms have done well.

FireEye shares have risen 38 percent so far this year, while Qualys is up 24 percent and Palo Alto Networks has climbed 19 percent. The PureFunds ISE Cyber Security ETF has gained 9 percent over the same period, while the S&P 500 Index is up 1.9 percent.

But investing in cybersecurity is not without risk.

FireEye's share price plunged more than 70 percent in less than three months last year, after CEO Dave DeWalt and other insiders sold shares, spurring investors to take a more critical look at the firm's finances and valuation.

The stock had more than quadrupled in the first six months after its September 2013 IPO, even though FireEye later reported losses of US$121 million in 2013 and US$444 million in 2014.

Analysts do not expect FireEye to post a full-year net profit until 2018, though they are forecasting rapid revenue growth, according to Thomson Reuters data.

Amid investor enthusiasm for the cybersecurity industry, FireEye has recovered this year though at around US$42 a share, the stock remains far below its March 2014 high of US$97.35.

Rapid7, LogRhythm and Mimecast are not the only cybersecurity firms planning to tap public markets this year.

Veracode, which protects internet applications from hackers, has selected banks to lead a potential IPO that could value the company at between US$600 million and US800 million.

Another company widely expected to debut this year is Bit9 + Carbon Black, whose software protects computers from malware. The firm has not yet hired banks, according to people familiar with the matter. It declined to comment.

According to FBR's Ives, emerging cybersecurity companies could earn a combined annual revenue of US$15 billion to US$20 billion in three years. That excludes the slower growing but larger market for traditional cybersecurity technology, such as anti-virus software.

Venky Ganesan, managing director at Silicon Valley venture capital firm Menlo Ventures, said average corporate spending on cybersecurity will rise from about 0.25 percent of total revenue to as much as 2 percent of revenue in the coming years.

"The window is wide open for cybersecurity companies. We have a perfect storm of opportunity," said Ganesan, who had invested in Palo Alto Networks while at Globespan Capital.