Thales-Imperva: Cyber sale

The cybersecurity industry is one of the most dynamic and important markets in the modern global economy. The United Nations puts revenue from cyber-crime at $5.2 trillion, around a trillion more than the GDP of the world’s third biggest economy, Germany.

In order to satisfy demand from companies and institutions for effective cybersecurity solutions, the industry is consolidating at an ever-greater pace. France’s Thales made a big splash in 2023, with the $3.6 billion capture of Imperva. The deal for the San Mateo, California-headquartered company, announced in July, is expected to close in the first quarter of 2024.

In the era of integrated information and control systems, Thales’ cybersecurity activity has taken on increased importance to all its business lines, not least aerospace, for which the company is best known.

Rare pearl
If you want to guage the health of a market, sometimes all it takes is tracing the arrow on an old-fashioned graph which, in the case of Inventa, has rarely not pointed up. Created in 2002 in Tel Aviv, Imperva offers a state-of-the-art web application firewall, while its data security platform helps prevent data-breaches and avoid compliance issues. The company’s large and diversified customer base includes a third of all Fortune 100 companies and some of the largest groups in financial services, telecoms, energy, healthcare, retail and e-commerce.

Imperva was purchased by American Investment Fund Thoma Bravo in October 2018 for $2.1 billion. Thomas Bravo shareholders must have been over the moon to see the private equity company’s asset sold for $1.5 billion more than the price-tag four years earlier.

In the era of integrated information and control systems, Thales’ cybersecurity activity has taken on increased importance

That Thales happily coughed up the cash (its biggest outlay since paying €4.8 billion for Gemalto in 2019) is due to the French company’s sky-high valuation of Inventa: 17 times its ebitda and six times its turnover.

Another factor is this is just the going rate for a cutting-edge cybersecurity company these days. In the spring of 2022, MSP company Kaseya paid $6.2 billion to get its hands on data-security specialist Datto, while later that year Google closed a $5.4 billion deal for Virginia-headquartered cybersecurity firm Mandiant.

All systems go
In most sectors, buying one leading company would be enough for a multinational to keep up with the Jonses. Not so in the cybersecurity sector, where integrating the products and knowledge of multiple companies is needed to be in a position to offer industry leading cybersecurity services.

Thales has carried out no less than nine acquisitions of cybersecurity firms over the past decade, with Imperva one of a trio of captures in the last 18 months alone. In October, it finalized the €107 purchase of Australian cybersecurity specialist Tesserent, while in July 2022 identity and access management outfit OneWelcome joined the Thales family.  

In January 2024 Thales will regroup all its civilian cybersecurity activities under the Digital Identity and Security (DIS) banner, a move that “will allow us to position DIS as a major cybersecurity and products player, and generate new synergies with our entire range of cyber activities,” stated the group. Once its latest purchase has been confirmed, the cybersecurity business will account for 44% of DSI’s turnover in 2024.  

Thales has not neglected its bread-and-butter activity in the aerospace sector in the dash to become one of the world’s leading providers of cybersecurity services. In 2023, the Paris headquartered firm announced its intention to take over Cobham Aerospace Communications and finalize the purchase of Swiss flight simulator and virtual training company Ruag S&T.

Despite its recent spending spree, Thales remains poised to announce further major acquisitions in 2024, and with turnover of around €2 billion, and the defense sector enjoying a period of high growth, who can blame it.