Increased threat of cyber attacks drives market for cybersecurity businesses

In the face of the growing threat of cyber attacks, it is no longer the sole responsibility of a small, proprietary IT team to protect a business from a breach. Attitudes to information security are changing, attacks are becoming more advanced and specialist cybersecurity firms dealing in both prevention and rescue are flourishing. It’s no surprise, therefore, that cybersecurity firms are fast becoming hugely attractive investment or acquisition prospects.

For the moment, it’s larger firms that are most at risk from a cybersecurity attack, with 90 per cent of large UK businesses reporting a breach last year alone. This is according to the UK government’s Security Breaches Survey, which also found that the problem is spreading to smaller firms with three quarters of them reporting an attack in 2015.

Small and medium sized enterprises are learning quickly that the threat of a security breach is a reality for them, and that a successful attack could, at its worst, put them out of business. The Department for Business, Innovation and Skills found that the average cost of such an attack on an SME last year was a staggering £310,800, twice that of a year earlier.

So what does this growing threat mean for those looking to buy and sell businesses? Demand is rising and that the appetite for cybersecurity firms is at an all-time high.

Cyber security drives tech deal explosion
Private equity firms are lining up to invest in businesses that provide cybersecurity protection to firms of all sizes. In the first half of 2016, tech companies led the global mergers and acquisitions market for the first time ever, according to Dealogic. The overall value of these deals was $294.8 billion, with cybersecurity seen as one of the main drivers of this growth.

High profile breaches such as that on the Target Group in the US, and household names Yahoo, eBay, Sony and TalkTalk, has ensured the issue is at the front of the business agenda. And, as a result, the cybersecurity industry is thought to be set for massive growth.

Jason Kaufman, the head of M&A at the Chertoff Group, which specialises in cybersecurity deals, explained: “Cybersecurity is a fragmented industry with lots of growth. This is enticing to dealmakers. There are always new threats companies need to defend against.”

A change in attitudes
As well as a general feeling among business owners that the threat from cybercriminals represents clear and present danger, there has been a shift in attitudes to how the threat is dealt with within businesses. While investing in security used to be seen as a “grudge buy,” more and more executives are now viewing cybersecurity investment as a way to help protect business reputation and facilitate growth.

Cisco’s 2015 Security Capabilities Benchmark Study found that, as opposed to viewing investment in cybersecurity as a cost of doing business, some 44 per cent viewed it as a source of competitive advantage, while 31 per cent said its primary purpose was enabling growth.

Larger businesses in particular are learning the hard way that being hacked can lead to reputational damage that lasts for years. F5 Networks recently surveyed the public on this topic and found that 50 per cent of British consumers said they would not purchase products from or share their data with a firm that had been hacked in the past.

In a world where consumers are increasingly aware of the value of their personal data, cybersecurity has become a primary concern, even at a C-Suite level.

Indeed, there is now a greater understanding that everyone - and that includes board level executives - need to understand the risk and be involved in its mitigation. Scott Mills, chief executive at security firm CyberadAPT, explains: “the weakest link is always going to be the uneducated layer - typically the board.”


A fragmented industry in need of consolidation
Many of the big deals involving cybersecurity firms involve big businesses attempting to consolidate smaller firms to simplify the security process for customers. Currently, firms may need to recruit several smaller cybersecurity businesses to fully secure their organisation, as a result of the highly fragmented nature of the industry. This fragmentation is driving the rise in deals.

Between 2017 and 2021 the amount spent by companies, governments and individuals on cybersecurity is expected to rise to over $1 trillion, according to figures from the Cybersecurity Market Report. It currently stands at around $74 billion a year.

The Chertoff Group’s Jason Kaufman also explained how low stock prices and a slow initial public offering market is driving mergers and acquisitions in the sector. He explained: “there’s been a 25 percent pull- back in valuations.”

“This has made it more attractive for cyber companies to pursue an M&A transaction and it’s made it more attractive for public cybersecurity companies to go private.”
An ever-evolving threat

The simple fact that cybercrime is evolving all the time and that attacks are never predictable makes the cybersecurity industry all but future-proof. The advice for businesses from experts such as the City of London Police Commissioner, and industry insiders like Cisco’s Martin Lee and CGI UK’s Andrew Rogoyski, is to seek expert help to deal with the evolving threat.

The message is clear - the threat of cyber crime isn’t going away and firms offering protection and security are valued more and more by business leaders. Cyber attacks will continue to take place and companies will continue to invest in protection. In light of these clear trends, buying a cybersecurity firm could be a lucrative move at this stage in the evolution of the threat.

Find a business for sale

Share this article

Latest Businesses for Sale

View more businesses for sale