Cybersecurity firm Rapid7 goes public amid a crowded field (updated)
Update on July 17: Underwriters priced Rapid7's shares at $16, above the expected range of $13 to $15, on Thursday night. Trading opened on Friday at $26.75, a hefty 67% gain and setting the company's market valuation at over $1 billion (including unexercised options).
----
Many small tech companies are pushing off going public until they're worth more than $1 billion -- but not all. Rapid7, a leading cybersecurity services provider based in Boston, is set to price Thursday and will begin trading Friday, just below the $1 billion value threshold.
Like the more than 700 cybersecurity firms that have also received venture capital in the past two years, Rapid7 promises to help companies detect hacker threats, bolster systems to resist them and respond when an actual intrusion occurs. Their marketing line is that they help companies move from “block and protect,” a passive approach, to an “actively managed” strategy that uses data to uncover risks before they get out of control ("recognize behavior patterns associated with breaches, even if the attack vector is completely novel.”)
While there is lots of talk about the $1 billion companies staying private — the unicorns not going public anymore — Rapid7 is still pretty small. Revenue last year was just $77 million, up 28% from 2013. In the first quarter of 2015, revenue hit $24 million, up 41%. Rapid7 has almost 4,000 customers, including 30% of the Fortune 1000, the company says.
Rapid7 has never been profitable and lost $33 million last year. They’re mostly trying to sign customers to three-year contracts and claimed an 85% contract renewal rate last year.
At the high end of their IPO range, $15 a share, the company’s market value would be about $700 million on a fully diluted basis, or about eight times the last 12 months of revenue. Already public security firms sell at much higher multiples -- CyberArk Software (CYBR) is valued at 14 times its sales and FireEye (FEYE) at 16 times, according to Yahoo Finance data. That gives Rapid7's new shares quite a bit of running room, so expect a heady first-day closing price.
Why go public now? Cyber security stocks are on a huge run, as every new hacking incident sends the whole group skyward, as if corporate IT budgets will magically increase 50 times a year. And while corporate spending on cybersecurity is projected to hit almost $77 billion this year, all of the small firms will be competing for those dollars along with units of larger tech companies including Intel (INTC), Cisco Systems (CSCO) and IBM (IBM).
CyberArk, which went public last September, has gained 260% (including an eye popping 87% pop on its first day of trading), making it the best-performing technology IPO of the past two years, according to Renaissance Capital. Among some larger players, FireEye, which owns Mandiant -- the company that gets the call after most of these public episodes to clean up the mess -- is up 57% this year. Palo Alto Networks (PANW), which has one of the most popular firewall products, is up 48%.
But the sector doesn't seem to have quite reached bubble territory yet. Cybersecurity stocks are off highs they recently notched after the U.S. government disclosed a massive breach of employee data. And the PureFunds ISE Cyber Security ETF (HACK), which contains 32 stocks, is up only 18% this year.
Another ETF that tracks the sector, First Trust Nasdaq CEA Cybersecurity (CIBR), launched last week. The two funds share many of the same companies but First Trust charges a fee of 0.60% versus 0.75% for the older fund.
A burst of ETF launches in a sector can be a warning signal for investors. But it may take a few more funds -- and IPOs -- before that happens.
