Thales Agrees to buy Imperva from Thoma Bravo

French multinational Thales will acquire cybersecurity firm Imperva from Thoma Bravo for $3.6 billion.

The deal is expected to close in early 2024 and will give Thales a significant presence in the application security market both in North America and potentially in Europe.

Growing Cybersecurity Portfolio

Thales, which operates in multiple technology domains including aerospace, defense and transportation, already has a formidable portfolio of cybersecurity acquisitions under its belt. These include Gemalto for some $5.3 billion in 2019; Voremetric for about $420 million in 2016; and more recently European startups S21sec and Excellium for a total of $125 million in 2022 and Tesserent for $118 million in 2023.

With Imperva, Thales will acquire a 1,400-person company that in 2022 recorded revenues of around $500 million from its application security, API and data security products and services. Many of Imperva's customers are large organizations in sectors such as financial services, healthcare, education, technology and retail. The company claims 35% of Fortune 100 companies as its customers.

Thales expects the Imperva purchase will help total revenues from its cybersecurity portfolio to top $2.6 billion.

In a statement announcing the transaction, Thales chairman and CEO Patrice Caine described the acquisition as marking a major milestone in Thales' cybersecurity strategy. "With this acquisition, we are seizing a unique opportunity to accelerate our cybersecurity capabilities," Caine said.

Solid Return on Investment

Thoma Bravo acquired Imperva for $2.1 billion in 2018. After the transaction closed, the private equity firm took Imperva private by paying shareholders $55.75 per share in cash. In its four years under Thoma Bravo, Imperva completed several acquisitions to reinforce capabilities in its core markets. Among them were CloudVector, Distil Networks and Prevoty.

Imperva is one of numerous acquisitions by Thoma Bravo in recent years. The PE firm's other major purchases in the space include Proofpoint in 2021, McAfee in 2021, LogRhythm in 2018, Sophos in 2019, and Veracode in 2018. The company's cybersecurity portfolio currently includes 13 vendors across various market segments.

The $3.6 billion that Thales has agreed to pay for Imperva is a seven-fold multiple of Imperva's 2022 revenues and represents a tidy return on investment for Thoma Bravo.

Rok Turner, an analyst with Omdia says the valuation is a little high and likely reflects Thales' desire to expand into the market space in which Imperva currently operates. In particular, Imperva gives Thales an opportunity to compete in the application security and API security markets which are hot right now because of enterprise cloud adoption trends, Turner says.

Booming Market Space

Earlier this year, market analysis firm Vantage Market Research pegged the application security market at just over $7 billion in 2022 and projected it to grow to over $26 billion by 2030. The API security market represents a smaller—but rapidly growingly—subset of the application security market with projected revenues expected to top $3 billion in 2028.

Turner says that Thales, as a French company currently sells heavily to the French government and likely has a potentially big market there for its Imperva products. "I wonder whether it wants Imperva to expand significantly its presence in North America, or conversely whether it wants to become a European powerhouse in appsec and API security," Turner says.

The Imperva purchase comes at a time when Thales has been attempting to change its marketing focus from largely that of an identity technology provider to a more broadly focused data security and encryption provider, says Richard Stiennon, chief research analyst at IT-Harvest. "Thales grows by acquisition," Stiennon says. "Like many giant companies I am sure they hope to sell through Imperva solutions to their existing global customers."

The deal is a pretty good return for Thoma Bravo which took Imperva private in 2019, he says. "I don't think Imperva customers will be ill served by this acquisition. If Thoma Bravo followed the PE playbook, they cut costs to help service debt," he says. "Freed of that, Imperva can get going competing with the new breed of cloud security providers."