Last year, Seattle-based network security startup ExtraHop was riding high, quickly approaching $100 million in ARR and even making noises about a possible IPO in 2021. But there will be no IPO, at least for now, as the company announced this morning it has been acquired by a pair of private equity firms for $900 million.
The firms, Bain Capital Private Equity and Crosspoint Capital Partners, are buying a security solution that provides controls across a hybrid environment, something that could be useful as more companies find themselves in a position where they have some assets on-site and some in the cloud.
The company is part of the narrower Network Detection and Response (NDR) market. According to Jesse Rothstein, ExtraHop’s chief technology officer and co-founder, it’s a technology that is suited to today’s threat landscape, “I will say that ExtraHop’s north star has always really remained the same, and that has been around extracting intelligence from all of the network traffic in the wire data. This is where I think the network detection and response space is particularly well suited to protecting against advanced threats,” he told TechCrunch.
The company uses analytics and machine learning to figure out if there are threats and where they are coming from, regardless of how customers are deploying infrastructure. Rothstein said he envisions a world where environments have become more distributed with less defined perimeters and more porous networks.
“So the ability to have this high-quality detection and response capability utilizing next generation machine learning technology and behavioral analytics is so very important,” he said.
Max de Groen, managing director at Bain, says his company was attracted to the NDR space, and saw ExtraHop as a key player. “As we looked at the NDR market, ExtraHop, which [ … ] has spent 14 years building the product, really stood out as the best individual technology in the space,” de Groen told us.
Security remains a frothy market with lots of growth potential. We continue to see a mix of startups and established platform players jockeying for position, and private equity firms often try to establish a package of services. Last week, Symphony Technology Group bought FireEye’s product group for $1.2 billion, just a couple of months after snagging McAfee’s enterprise business for $4 billion as it tries to cobble together a comprehensive enterprise security solution.
ExtraHop is not a young company — it was founded in 2007 and raised over $60 million along the way, according to Crunchbase data — but it did show all the signs of making a successful transition from appliance company to cloud service. Its ARR was heading in the direction that points to a public exit, not a private equity deal.
Understanding the numbers
TechCrunch spoke with ExtraHop in January 2020 about its growth profile. At the time, the company said that it had reached $150 million in bookings during 2019, up from $100 million in 2018.
In more concrete revenue terms, ExtraHop said it posted its second year of consecutive 40% growth in 2019, and was “on pace to exceed $100 million ARR in 2020.” The company’s PR team touted a 2021 IPO as a possibility at the time.
Those facts and figures make the company’s $900 million exit price somewhat surprising. Even if we presume that ExtraHop’s growth slowed from 40% in 2019 to 25% in 2020, the company would have reached IPO scale within the year and would therefore be more than large enough to go public today.
Looking at a few market comps, a 25% growth rate would be enough today to lend a rough valuation multiple of 13x its annualized revenue. Given that we expect that ExtraHop crested the $100-million ARR mark in 2020, we can infer that it is larger today as Q2 2021 comes to a close. And to calculate its worth, if we multiply a number greater than $100 million by 13, we get a final figure that is far larger than the $900 million exit price.
So, what’s going on? During TechCrunch’s call with the company this morning, we confirmed that the sale price was $900 million, and that the private equity entities will own a “significant” controlling interest in the company. However, Bain stressed that ExtraHop’s founders will own a minority stake in the business after the transaction completes.
The investing group was clear that ExtraHop is on solid footing today, telling TechCrunch that it will manage 40% growth or better this year. The investors were also bullish on the ability of ExtraHop to continue creating value while competing in the cybersecurity market.
To that end, Rothstein called the deal a “milestone, not a finish line.” de Groen added that his firm would be putting “real cash” into the company to help with its coming growth.
The transaction is a win for the Seattle market itself — any billion-dollar-ish exit is material for any startup scene. But we can’t help but scratch our heads about why a quickly growing cybersecurity company is selling for sub-10x trailing revenues.
There are lots of unknowns in the ExtraHop business, as we never got its S-1 filing.
Regardless, the deal is done, and yet another $100-million ARR club startup has found the exit. Next up from that cohort is Monday.com, which should price its IPO tomorrow and trade Thursday.