Perfect storm for cybersecurity leads to rising M&A activity

Perfect storm for cybersecurity leads to rising M&A activity

Cybersecurity is a driver for the impressive technology, media, and telecoms (TMT) mid-market deal activity in the first quarter of 2022. Much points to continued high activity levels in both mid-market and cybersecurity.

In March, Google acquired the cybersecurity company Madiant for US$5.4 billion. It was the search giant’s second-largest ever acquisition. Cloud security and developing Google’s cloud services were core to the move as Google continues to lock horns with Amazon and Microsoft for customers.

The move is far from the only one. Cybersecurity M&A has rarely, if ever, been this red-hot.

Similarly, the broader mid-market TMT-sectors’ recent M&A performance is seeing much activity. It is especially impressive considering the backdrop of slowing deal activity across most other industries.

While cybersecurity megadeals stole many headlines, activity and deal multiples are on the up across the space, as companies garner interest from all sides.

It is, in many ways, the coming together of a perfect M&A storm for cybersecurity.

Mid-market TMT shows resilience

Mergermarket data for Q1 2022 shows a marked drop in mid-market M&A activity levels across many industries. The slow-down may be partially due to recent macroeconomic trends, such as increased inflation and interest rate hikes and uncertainties created by Russia’s invasion of Ukraine.

Against this backdrop, TMT has performed remarkably well. TMT recorded 720 deals, up from 608 the previous quarter. The total deal value was US$70.5 billion, down US$500 million compared to last quarter.

Data: Mergermarket. Graph: BDO Global

Private equity firms continue to show strong interest in TMT. Their deal market share has gradually increased over the last couple of years.

Data: Mergermarket. Graph: BDO Global

In 2022 Q1, PE firms were involved in 398 TMT mid-market deals worth a combined US$36.8 billion. That equals 55.3% of deal volume and 52.2% of combined deal value. Both are record highs for the 2020 to 2022 period. Vast troves of dry powder and PE investors viewing TMT as (comparatively) safe investments with massive earning potential speak for the trend continuing.

Software continues strong performance

Within TMT, technology is the most active space. Deal volumes for telecoms remain steady, while the recent dip in M&A deals within Digital Media and E-commerce has continued into 2022.

Data: Mergermarket. Graph: BDO Global

Software companies remain the prime deal driver within technology, accounting for 79% of all TMT deals in 2022 Q1.

Geographically, TMT deal activity was stable or up across almost all regions. The North American market was particularly active, logging a 45% increase in deal volume compared to the previous quarter.

Overall, the results illustrate TMT companies’ ability to continue performing and remain attractive to investors under changing market conditions that currently include increasing inflation, interest rate hikes, geopolitical consequences of Russia’s invasion of Ukraine, and stretched supply chains.

One reason is that digital transformation remains top-of-mind for companies and organisations. TMT companies are providing much of the necessary infrastructure and solutions.

Simultaneously, market and geopolitical unrest, and supply chain stresses, encourage further investments in digital solutions to build out resilience.

Cybersecurity in a perfect storm

Increased digitisation also means broader attack surfaces for cyberattacks. The work from home initiatives, growing cloud infrastructures and diverse digital solution ecosystems that define our work life in 2022 all increase cyber risks.

Cyberattacks are also becoming more common. Analysis from Check Point showed that 2021 Q4 set a new record with over 900 attacks per organization- a week.

Data: Check Point. Graph: BDO Global.

Rising geopolitical tensions are amongst the drivers of increased frequency and severity of attacks and loss of confidential and competitively sensitive data (between companies and countries).

Simultaneously, attacks are becoming more sophisticated – and costly. 2021 set a seven-year high for average total data breach costs, according to an IBM study. Cybersecurity Ventures estimates set global cybercrime costs in 2021 at US$6 trillion – a figure that will rise to US$10.5 trillion by 2025.

Governments, regulatory bodies, and industries themselves are introducing new / stricter data governance and compliance requirements to protect sensitive data.

As a result, companies and organisations have more demand for cybersecurity software and services. It acts as an industry tailwind, attracting capital to companies addressing these areas and bolstering the already strong performance of cybersecurity.

According to Gartner, global cybersecurity spending exceeded US$150 billion in 2021. It is projected to reach U$346 billion by 2027, according to a study by Astute Analytica.

Funding is also on the rise. Last year saw a record US$21.8 billion in venture capital injected into cybersecurity companies, according to Crunchbase data.

Deal activity increases

Deals mirror market and funding activity. 2021 registered almost 300 cybersecurity deals.

Analysis from Momentum Cyber shows that the average cybersecurity M&A size increased to US$271 million, more than doubling 2020’s average of US$110 million. Total deal value reached US$77.5 billion, representing a (294.6% YoY increase).

Data: Momentum Cyber. Graph: BDO Global

The results are somewhat influenced by the number of megadeals signed in 2021. However, it also indicates how valuations and deal multiples in the space have increased.

As the market continues to grow, vendors look to solidify positions and expand offerings through M&A. Examples include Wipro Limited’s acquisition of cybersecurity consulting provider Edgile for US$230 million and Integrity360's acquisition of Caretower.


Data: 451 Research. Graph: BDO Global *:2022 deals concluded by March 18th are included.

Increased activity from private equity and strategic investors is also contributing. In 2021, they acquired 129 venture-backed companies, far outpacing 2020’s record 79 deals. Examples include  STG’s takeover of McAfee, Thomas Bravo’s acquisition of Proofpoint, Apax Partners buying Herjavec Group, and a string of mid-market deals such as Intermediate Capital Group’s minority investment in 6Point6.

AI among likely next steps

Cybersecurity is often a race between defenders and attackers. As new attack vectors appear, advanced technologies like AI are being deployed. Its strengths include rapidly sifting through and making sense of vast data troves and developing new ways to counter potential threats.

Cybersecurity companies are leveraging these abilities to build automated security systems, natural language processing, and automatic threat detection.

However, attackers also use AI to develop smart malware and upgrade attacks to bypass the latest security protocols. Microsoft data indicates how hackers are targeting all industries with malware attacks.

Data: Microsoft. Graph: BDO Global.

By 2025, there will be 30.9 billion IoT devices connected to the internet. They provide companies with many new avenues for expanding and improving their business, but also provide cybercriminals with new attack vectors.

The two examples of IoT and Ai illustrate that the arms race between attackers and defenders is set to continue. Simultaneously, companies and organisations will continue to build out their digital setups, increasing exposure to the potential costs of cyber threats, leading to a need for increased cybersecurity investments.

As a result, much speaks for cybersecurity companies maintaining their M&A momentum.