Corporate buyers lured by infosec discounts are on the scent for more

Despite a largely stagnant exit environment, there are sparks of activity for information security startups and their investors.

Corporate acquirers have been cashing in and buying startups at smaller valuations, with the median deal size for infosec startups declining about 35% from a 2020 peak of $66 million to $43 million. Infosec acquisitions increased more than 50% from Q1 this year, according to PitchBook’s Q2 2023 Information Security Report, fueling optimism about sustained M&A prospects.

Significant deals this year have included IBM picking up Polar Security in May for a reported $60 million and HPE‘s $500 million buyout of cloud data security startup Axis Security in March.

In the report, PitchBook analyst Brendan Burke writes that he expects the median acquisition price to fall and the number of inked deals to increase through the end of 2023.

Enterprise demand for cybersecurity and infosec solutions is growing. Skimping out on spending can have impacts big and small—recent PR nightmares of compromised customer data for companies including LinkedIn, Microsoft and T-Mobile are prime examples. Survey data from Scale Venture Partners showed that 22% of large companies are planning to spend more on infosec and cybersecurity in 2023 than last year. And 62% of businesses want to see more consolidation in the industry.

According to J. Neely, Accenture senior managing director and global M&A lead, many of his corporate clients have acknowledged that information security is a huge area of growth even as startups looking to sell haven’t adjusted to a harsher regulatory and monetary environment.

He said many of these sellers are operating as they were in the boom following the COVID-19 pandemic peak, expecting to fetch sky-high prices for their startups. In recent years, strategic acquirers have made large purchases like Okta‘s $6.5 billion buyout of Auth0, the $156 million acquisition of Bridgecrew by Palo Alto Networks, and Google’s $500 million deal to buy Siemplify.

One of the most active acquirers, Palo Alto Networks, broke a long hiatus from startup acquisitions in November when it purchased Cider Security for $195 million.

“When deal professionals get time on their hands and they start to look and build momentum for where they want to go next, the logjam breaks,” said Neely.

Featured image by Joey Schaffer/PitchBook News