French multinational company Thales will acquire cybersecurity firm Imperva from Thoma Bravo for $3.6 billion, giving Thales a significant presence in the application security market both in North America and Europe.
Growing Cybersecurity Portfolio
Thales — which operates in multiple technology domains including aerospace, defense, and transportation — already has a formidable portfolio of cybersecurity acquisitions under its belt. These include Gemalto for $5.3 billion in 2019; Voremetric for about $420 million in 2016; and, more recently, European startups S21sec and Excellium for a total of $125 million in 2022. The company also acquired Tesserent for $118 million this year.
With Imperva, Thales will acquire a 1,400-person company whose most recent revenue of $500 million derived from its application security, API, and data security products. Many of Imperva’s customers are large organizations in sectors such as financial services, healthcare, education, technology, and retail. The company claims 35% of Fortune 100 companies as customers.
Thales projects the Imperva purchase will push cybersecurity revenue to more than $2.6 billion. The deal is expected to close in 2024.
In a statement announcing the transaction, Thales chairman and CEO Patrice Caine described the acquisition as marking a major milestone in Thales’ cybersecurity strategy. “With this acquisition, we are seizing a unique opportunity to accelerate our cybersecurity capabilities,” Caine said.
Solid Return on Investment
Thoma Bravo acquired Imperva for $2.1 billion in 2018. After that transaction closed, the private equity firm took Imperva private by paying shareholders $55.75 per share in cash. In its four years under Thoma Bravo, Imperva completed several acquisitions to reinforce capabilities in its core markets, including CloudVector, Distil Networks, and Prevoty.
Imperva is one of numerous security acquisitions by Thoma Bravo in recent years. The PE firm’s other major purchases in the space include Proofpoint (2021), McAfee (2021), Sophos (2019), LogRhythmin (2018), and Veracode (2018). The company’s cybersecurity portfolio currently includes 13 vendors across various market segments.
The $3.6 billion that Thales has agreed to pay for Imperva is a sevenfold multiple of Imperva’s 2022 revenue and represents a tidy return on investment for Thoma Bravo.
Rik Turner, an analyst with Omdia, says the valuation is a little high and likely reflects Thales’ desire to expand into the markets where Imperva currently operates. In particular, Imperva gives Thales an opportunity to compete in the application security and API security markets, which are hot right now because of enterprise cloud adoption trends, Turner says.
Booming Market Space
Earlier this year, market analysis firm Vantage Market Research pegged the application security market value at approximately $7 billion in 2022 and projected it to grow to over $26 billion by 2030. The API security market represents a smaller — but rapidly growingly — subset of the application security market with projected revenue expected to top $3 billion in 2028.
Turner says that Thales, as a French company, currently sells mostly to the French government and likely has a large potential market there for its Imperva products. “I wonder whether it wants Imperva to expand significantly its presence in North America, or conversely whether it wants to become a European powerhouse in AppSec and API security,” Turner says.
The Imperva purchase comes at a time when Thales has been attempting to change its marketing focus from an identity technology provider to a more broadly focused data security and encryption provider, says Richard Stiennon, chief research analyst at IT-Harvest. “Thales grows by acquisition,” Stiennon says. “Like many giant companies, I am sure they hope to sell through Imperva solutions to their existing global customers.”