F5 Networks Acquires Shape Security for Online Fraud Protection Services
F5 Networks, an application performance and security specialist, has ponied up $1 billion in cash to buy privately-held Shape Security, a Santa Clara, California-based company that sells an online fraud protection platform to enterprise organizations.
The deal will accelerate F5’s software revenue growth, speed up its transition to a software- and software-as-a-service (SaaS)-driven business model and boost its software subscriptions count, the company said. In the short term, the strategic move will give F5’s application protection services a jolt and expand its ability to protect customers in a multi-cloud market. In the long-term, Shape’s artificial intelligence and machine learning capabilities will enable F5 to execute its plans to offer AI-enhanced services to its customers and scale and extend its overall portfolio.
The Seattle-based F5 will pay for deal, which is its second buyout this year, with cash on hand and $400 million in financing. The transaction is subject to regulatory approval and is expected to close in Q1 2020. Earlier this year, F5 paid $670 million to land NGINX, an open source application delivery provider.
Shape plans to retain its existing headquarters with co-founder and chief executive Derek Smith and the company’s 375-person team joining F5, which has about 5,300 employees.
“When you combine F5 and NGINX’s expertise powering over half of the world’s applications across all types of environments, with Shape’s insight from mitigating 1 billion application attacks per day, you have a company that knows how to secure more applications – and more value – than any company in the industry. We believe that makes F5-NGINX-Shape absolutely essential to every digital organization in the world,” F5 President and chief executive François Locoh-Donou wrote in a posted letter to employees.
Shape claims it mitigates more than 1 billion fake transactions daily and protects 150 million legitimate, human transactions a day. In particular, its platform defends against credential stuffing attacks, where cyber criminals use stolen passwords from third-party data breaches to take over other online accounts. Its enterprise-heavy customer lineup includes nine Fortune 50 customers, eight of the top 12 U.S. banks, five of the top 10 global airlines, and five of the top 10 credit card issuers. Shape recently reached a $1 billion valuation after raising $51 million in a Series F round in September.
“Since Shape’s inception, we observed a consistent pattern in customer after customer: the use of F5 technology to deliver and enable their applications,” Smith said in a statement. “Now, we look forward to the opportunity to deeply integrate into F5’s platform for application delivery and security — F5 provides the optimum traffic flow insertion point for Shape’s industry-leading online fraud and abuse prevention solutions.”
The deal is the biggest in F5’s 23-year history but represents more than a complementary acquisition, Locoh-Donou said. “By laying out our vision to become the leader in multi-cloud application services back in 2017, we have been taking deliberate and disciplined steps to realize our future identity. We know what it will take to win; and make no mistake, we are playing offense.”
Another questionable acquisition from F5 in a significantly over paid price, $1B for a small company with just around $70 million of revenues. Price-to-Sales (P/S) multiple of 14.3x for the target company (which is nearly 4 times F5’s estimated FY’20 P/S multiple of 3.6x). F5 is expected to fund $400 million of the transaction in debt of unsecured term loan, which will result in additional costs!
Additional Expenses of ~$115 Million Are Expected To Be Incurred Due To Shape Integration.
In addition the TAM of Shape seems to be capped to the high-end players and it is uncertain how much future growth it can scale to.
Maybe more importantly, there is an overlap with F5 existing products, the Versafe acquisition F5 made several years ago in the Anti-Fraud market, but more significantly the leading Anti-Bot product of F5 which was also offered as part of F5 WAF.
Seems F5 is again doing more of the same instead of thinking outside the box (more Load-balancing with Nginx, more Bot/Fraud they already have).
BTW: Nginx acquisition was also very questionable, most of the value is free open-source while the open-source community trend is migrating to open-source Envoy.
Hi John: Thanks for sharing the math. I often don’t worry or focus too much on total addressable market, since products can be repositioned and industries always shift. But I certainly keep multiples and valuations in mind… …. That said, we’ll be sure to track F5’s performance, particularly as it relates to the Shape acquisition.
PS: I’m traveling and haven’t had a chance to independently confirm the figures you’ve shared.