Cybersecurity Exits Timeline: Activity Remains Strong As Tech Corporates Target AI Startups

Investors backed more private cybersecurity companies in 2016 than any year since at least 2013. Likewise, deals in Q1’17 hit an all-time quarterly high, up 20% from the previous quarterly deal high.

Increased investment activity is occurring at a time when VC-backed cybersecurity startups are also exiting the industry through M&As and IPOs at a near all-time high. In fact, thirty-nine VC-backed cybersecurity startups exited in 2016 via 38 M&A deals and one IPO. In 2015, there were also 38 M&A deals and 2 IPOs for a slightly higher total of 40 exits. So far this year through 5/31/17, 18 VC-backed cybersecurity startups have exited via 17 M&As, and one IPO, of identity management company Okta, which went public this year in April.

Before Okta’s IPO in Q2’17, it was one of a handful of private cybersecurity companies valued at $1B+, all tracked on CB Insights’ unicorn tracker.

Looking at last year’s exit activity, companies across the spectrum snapped up cybersecurity startups. Some relatively large, still private cybersecurity companies acquired other companies in the space, including Lookout (acquired Bluebox Security) and Carbon Black (acquired Confer Technologies). In addition, public cybersecurity companies such as Symantec, Fortinet, and FireEye were also active acquirers in 2016, as were other large corporations, including IBM, Cisco Systems, Ant Financial Services Group, Oracle, and Salesforce.

Using CB Insights database we looked at acquisition activity in cybersecurity over the last six years and created a timeline of acquirers and acquisition targets spanning from Q4’16 through 2017 YTD (5/31/2017).

This year’s corporate acquirers in cybersecurity include Amazon, Hewlett Packard, Huawei, Microsoft, among others. One notable trend among these acquirers is their proclivity toward snatching up cybersecurity startups using artificial intelligence and machine learning algorithms. Continuing the trend, Microsoft just acquired the AI cybersecurity-automation company Hexadite, in May, for $100M.

Annual Exit Activity

Exits for VC-backed cybersecurity startups have been trending upward since 2013. Exit activity peaked in 2015, at 40 total. Last year’s exit numbers came in just short of the peak we saw in 2015.

The two companies that went public in 2015 are the security analytics software company Rapid7 and the cloud security company Mimecast.

In 2016, Indian IT cybersecurity company Quick Heal Technologies went public in February. So far this year we have seen Okta go public in April.

Cybersecurity M&A Timeline: Q4’16 – Q2’17 QTD (5/31/2017) 

Since October of last year, seven cybersecurity startups have been acquired for more than $100M. Six of those deals happened this year. The most valuable cybersecurity startup to get acquired since the start of Q4’16 is the website security company Krux Digital, acquired by Salesforce in October 2016, at a valuation of $750M.

This year’s top acquisitions in cybersecurity include: Veracode (acq. by CA Technologies for $614M), TeleSign (acq. by BICS for $230M), Invincea (acq. by Sophos for $120M), Delta ID (acq. by Fingerprint Cards for $106M), LightCyber (acq. by Palo Alto Networks for $105M), and Hexadite (acq. by Microsoft for $100M).

Notable cybersecurity acquisitions by publicly traded corporations over the time period examined include: Niara (acq. by Hewlett Packard Enterprises in Q1’17), and Harvest.ai (acq. by Amazon in Q1’17). Both of those cybersecurity startups utilize AI and machine learning algorithms to protect against cyber crime.

Interestingly, the investment firms Medina Capital and BC Partners recently merged their portfolio of cybersecurity companies to form a single entity called Cyxtera. Similarly, the corporation BlackBerry recently merged its portfolio of cybersecurity companies to create a new cybersecurity unit within the corporation called BlackBerry Secure.

Top Ten Cybersecurity Exits Since 2012

The IPO of Palo Alto Networks in 2012 remains the most highly valued exit in cybersecurity over the last six years. Rounding out the top three are FireEye, and Okta, respectively. Okta’s IPO this year is one of two top 10 cybersecurity exits to occur since 2016. The other is Krux Digital’s acquisition by Salesforce in 2016, which clocks in as the eighth most valuable exit since 2012.

Want more data on cybersecurity startups? Log in to CB Insights or sign up for free below.