Buying and building an infosec giant

February 16 2021
by Brenon Daly

Microsoft breaking out the big numbers of its security business stands out not only among the other suppliers in the information security industry, but also among other acquirers. No other company has put together such an enviably accretive acquisition program. Through buying and building, Microsoft has arguably compiled tech's most valuable security business.

The software giant recently indicated that it has generated more than $10bn from sales of its security-related products over the past year, with growth clipping along at 40%. For context, that would be three times larger than Palo Alto Networks and growing twice as fast, according to S&P Global Market Intelligence.

Even leaving aside the fact that 'security' probably gets a rather expansive definition in Redmond, Washington, and that the company's numbers probably wouldn't survive GAAP accounting, Microsoft's division has the size and scale to draw a lot of oxygen out of the infosec market. And, uniquely in an industry that has seen more than its share of unperforming deals, the vendor has done it with the help of a high-returning M&A program:

  • Unlike Symantec, Microsoft has been strategic in its purchases. (The company has just half as many infosec transactions as Big Yellow overall according to 451 Research. Further, Microsoft's Veritas-like M&A missteps have come in other sectors outside infosec.)

  • Unlike Cisco, Microsoft hasn't pursued platform purchases. (The networking giant did billion-dollar deals for intrusion detection and identity, among other big-ticket pickups.)

  • Unlike Palo Alto, Microsoft hasn't reached for the highest-priced startups. The KnowledgeBase shows that Palo Alto has paid an average of nearly 27x trailing sales, or three times its own valuation, in its effort to expand its portfolio inorganically. And it is at it again, announcing the acquisition of Bridgecrew earlier this morning.

  • Instead, Microsoft has added relatively small – but highly valuable – bits of infosec technology into its franchise offerings that already run the digital operations of a lot of organizations. That has proven hugely lucrative, as it has for other platform vendors. Big-name providers such as Salesforce, Workday and ServiceNow all trade at double-digit valuations. Even taking that multiple as a 'floor bid,' a back-of-the-envelope calculation would value Microsoft's faster-growing infosec business at north of $100bn – roughly as much as the industry's next three most valuable companies combined.

    Figure 1

    'In Use' and 'Most Strategic' IT Vendors 451 Research 2020