VCs See Cybersecurity Startup Funding Rounds Rise As S&P Cyber Index Up 28.15%

Cybersecurity startups are seeing funding rounds rise as corporate customers free up more budget to prevent embarrassing and financially devastating hacks. 

As a result, valuations are also rising, suggesting that investors and corporate executives have finally gotten beyond thinking of security as a cost and more as a necessity that provides strategic differentiation. JL

James Rundle reports in the Wall Street Journal:

Cybersecurity startups are seeing funding rounds rise, as customers are spending and rivals acquire each other. Demand for cybersecurity products and services has remained high. Increased compliance obligations and strings of attacks have solidified security’s importance in budgets. “Nobody wants to see the company name on the front page, letting the world know their corporate network has been hacked.” Thousands of companies sell cybersecurity products, but only 70 primarily focus on security are publicly traded. The S&P Cyber Security Index, which tracks 30 U.S. cybersecurity stocks with a market capitalization over $300 million and have more than $2 million in daily traded value, has returned 28.15% over the past year.

Cybersecurity startups are seeing funding rounds rise from the doldrums of 2022, while their customers are spending money and rivals acquire each other. But few feel comfortable enough to plunge into public markets.

Part of the reluctance stems from the mixed results cybersecurity companies have posted since 2021, amid a tougher environment generally for technology companies. Cybersecurity sales have picked up, but changing customer spending behaviors have sometimes stretched contracts and caused uncertainty. Meanwhile, valuations for private companies plummeted in recent years as economic conditions tightened, and investors revised their calculations for when and where to deploy capital.

Nowhere is this more evident than in the pipeline for initial public offerings, which has been sparse for years and shows little sign of recovering quickly. The April listing of data company Rubrik, which raised $752 million, was the first cybersecurity IPO since 2021, and has been the only significant cyber listing this year.

 

Demand for cybersecurity products and services has remained high despite a turbulent period for vendors. Increasing compliance obligations and strings of attacks have solidified security’s importance in budgets, said Shaul Eyal, managing director and senior analyst at investment bank TD Cowen.

“Nobody wants to see the company named on the front page, letting the world know their corporate network has been hacked,” he said. Eyal expects the market to grow around 11% to 12% annually over the next several years.

Merger-and-acquisition activity also has picked up. This month, Darktrace applied to delist from the London Stock Exchange as part of a $5.3 billion acquisition by private-equity firm Thoma Bravo, while CyberArk Software completed its $1.5 billion purchase of Venafi from the same firm. Also, Check Point Software Technologies completed its acquisition of Cyberint, and industrial cyber provider Dragos announced that it bought Network Perception, both for undisclosed amounts.

That all followed Mastercard’s September announcement that it plans to acquire cybersecurity intelligence company Recorded Future for $2.65 billion.

While many companies say they are planning to list in the future, few are in a rush to do so. Cloud security company Wiz will list once it reaches $1 billion in annual recurring revenue, said Chief Executive Assaf Rappaport in a July email to staff, after talks regarding a proposed $23 billion acquisition by Alphabet’s Google fell apart.

At email security company Abnormal Security, which raised $250 million in Series D financing in August, Chief Executive Evan Reiser said the company is provisionally planning to list in its 2025 fiscal year and preparing for that. However, the date could easily change depending on market conditions and the company’s needs, he said.

“We have to plan for a very specific milestone, but your attitude and mindset is like, it’s going to happen at some point,” he said.

Thousands of companies sell cybersecurity products, but only around 70 that wholly or primarily focus on security are publicly traded.

“From an investment perspective, the need to have exposure to that creates a little bit of imbalance in supply and demand,” said TD Cowen’s Eyal.

The S&P Kensho Cyber Security Index from S&P Global, which tracks around 30 U.S. cybersecurity stocks with a market capitalization of $300 million or more and that have more than $2 million in daily traded value, has returned 28.15% over the past year.

“There’s healthy demand to own these assets,” Eyal said.