IPO prospects remain thin this year while industry consolidation is likely to pick up
nvestors and bankers don’t expect a surge of stock listings from cybersecurity companies in 2025, but they say the sector is primed for mergers and acquisitions as the largest vendors expand.
The cybersecurity industry is in flux, as providers experiment with new strategies to bundle more services into their offerings and startup funding remains unsteady, giving founders and chief executives a challenging environment in which to raise money and giving larger firms an impetus to acquire smaller ones.
Worldwide venture capital funding for cybersecurity companies totaled $8.8 billion over the first three quarters of 2024, putting the sector on track to beat 2023’s total of $10.9 billion, according to research firm PitchBook.
But funding in the third quarter declined to $2 billion, compared with $2.9 billion in the same quarter a year earlier, according to PitchBook.
Global deal counts for the third quarter fell to just under 1,200, down from 1,600 during the same quarter in 2023, according to venture firm DataTribe, as investors grappled with uncertainty caused by dozens of elections globally, the impact of interest-rate cuts in the U.S. and geopolitical tension in the Middle East.
Only Series C rounds—typically for more-established startups—posted a year-over-year increase in deal volume in the third quarter, which more than tripled, while total deal value rose just under 50%, DataTribe said. Early stage companies, particularly those moving from seed to Series A and to Series B financing, sometimes found it tough to raise cash in 2024, with more seeing a decline in their valuations across rounds.
That could point to a tough market in 2025 that favors investors, DataTribe said.
One reason for the drop is a general decline from the anomalous heights of 2021 and 2022 , when investors piled into cybersecurity startups, driving their values sky-high. Lingering uncertainty about the economy’s health curtailed that in recent years, forcing some companies to accept severe cuts to their valuations to fill investment rounds.
“As we sometimes put it, tongue-in-cheek, the tourists have kind of gone away,” said John Funge, managing director at DataTribe.
Meanwhile, M&A increased among private cyber companies in 2024, particularly transactions involving smaller vendors as the market consolidates, said Keith Skirbe, a managing director at investment bank Houlihan Lokey.
“Midmarket is where we see a lot of the security deals, so that’s where we’re spending our time,” he said. The bank recently advised on a merger between U.K. cybersecurity companies Wavenet and Daisy Group, Innovery’s acquisition by Neverhack, and PDI Technologies’ acquisition of Nuspire.
He expects M&A activity to pick up further in the first half of 2025, as deals move forward after delays due to uncertainty over the economy or the political environment. Midmarket cyber vendors are ripe for consolidation, he said, given the proliferation of startups in recent years. Security chiefs who use smaller providers could therefore find their service providers changing.
Increased spending by security chiefs on cyber, on the other hand, might benefit the largest public companies. Many chief information security officers are trying to cut the number of cyber companies they use, preferring fewer vendors that can provide more tools rather than contracting for each individual need.
Just 12 out of 42 publicly traded cybersecurity companies increased their revenue by 20% or more during the 12-month period that ended Sept. 30, according to PitchBook data, as they deal with delayed commercial projects and tighter client budgets. That revenue challenge is forcing many to explore new ways of delivering their products.
Palo Alto Networks and CrowdStrike, for instance, are pursuing so-called platform strategies , in which they offer a suite of services. Sometimes this involves reorganizing their products, and other times, it involves acquiring other companies to fill a functional gap in their overall offerings.
Acquisition-hungry giants are part of the reason not many cybersecurity companies have matured enough for initial public offerings, with few listings in recent years. And private-equity companies have taken some off the markets, including cyber artificial intelligence company Darktrace, which Thoma Bravo acquired in October and delisted from the London Stock Exchange.
“Most companies sell before they IPO. I wouldn’t bet on there being a resurgence of IPO activity in cybersecurity anytime soon,” Skirbe said. Some particularly large vendors such as cloud security companies Netskope and Wiz have said they would list, having grown too large to be likely acquisition targets.
As for which types of cybersecurity providers are likely to do well in 2025, the answer is less clear. Sectors such as cloud, incident response, firewalls or endpoint protection are getting about the same amount of investment, while AI in any area attracts money, according to DataTribe.
“I can tell you, at all the deals that we’re working on, that’s always a question,” Houlihan Lokey’s Skirbe said.
Write to James Rundle at james.rundle@wsj.com
This article was downloaded by calibre from https://www.wsj.com/articles/cyber-investors-expect-more-mergers-in-2025-28c4485a
Leave a Reply