First CyberArk, now Barracuda, as security M&A talk hots up

Growing understanding of cyber threats could drive consolidation among vendors, analyst argues

Two weeks after reports linked CyberArk with a possible sale, fellow mid-sized security vendor Barracuda Networks has reportedly launched a search for a potential buyer.

According to Bloomberg, security, application delivery and data protection specialist Barracuda has asked investment bank Morgan Stanley to seek possible suitors.

Barracuda and CyberArk - which was linked to a potential sale to Check Point last month - have seen their shares tumble in recent months amid what some have suggested is part of a polarisation in the fortunes of cybersecurity vendors.

NASDAQ-listed CyberArk's shares have fallen from a peak of $76.35 (£53.10) last June to $44.13, giving the privileged account management specialist a current market value of about $1.4bn.

Rumours of Barracuda's sale strategy follow a poor run of results at the New York-listed vendor that has seen its share price fall by more than two thirds over the past 12 months. Its market capitalisation currently stands at $624m.

A deal for Barracuda may not happen at all and no buyers have yet emerged, said the Bloomberg report, which cited "people familiar with the matter".

James McKee, sales manager at Barracuda partner Qual, said any turmoil at a corporate level had not been felt by resellers and that Barracuda is gaining ground across the multiple sectors in which it operates.

"We are doing really well with them," he said.

"Barracuda have half a dozen or so products that go out the door on a regular basis. Their next-generation firewall is starting to get some good traction and their purpose-built backup appliance is one of our best sellers. It would be interesting to follow [the story]. It would be disappointing if it made changes that affect us but if it's just a new investor that puts in cash and helps with development, then happy days."

The report comes two weeks after Israeli newspaper TheMarker reported on rumoured talks between CyberArk and Israel-based security vendor Check Point.

Since then, Check Point CEO Gil Shwed said on a Q4 earnings call that the vendor is "very open" to making an acquisition.

"...We are looking at the entire spectrum. And if we find the right opportunity and mainly the right strategic match, it can be small, it can be large," Shwed said on the call, a transcript of which can be found here.

A CyberArk representative told CRN the firm "does not comment on rumours" but in an interview with Reuters last week, CEO Udi Mokady cast doubt over any deal with Check Point, saying the firm is focused on building the company "independently".

Analyst Megabuyte said it suspected mid-sized and large enterprises' understanding of cyber threats had improved, making them more discerning about the solutions they deploy. This has led to a "polarisation of performance" among next-generation vendors, it said.

"Against this polarising backdrop, consolidation in the cybersecurity sector has looked increasingly likely in recent months, as the strong look to consolidate the weak... It certainly feels like the security software sector is moving from a period of innovation to one of consolidation," it said.

Barracuda sent us the following statement: "As our official company policy, Barracuda does not comment on any speculation or rumours."