Dell Sells RSA to Private Equity Firm for $2B

https://www.darkreading.com/risk/dell-sells-rsa-to-private-equity-firm-for-$21b/d/d-id/1337078

by susam • 6 years ago

132 67 6 years ago

142• 6 years ago

Last time information is available, RSA generated about $1 billion in revenue. Very hard to believe that RSA is worth 50% of annual revenue - that's a great ROI.

For comparison, Imperva, with revenue of ~$300 million annually in 2018 was bought by Thoma Bravo for $2 billion. I have a hard time believing Imperva is worth the same as RSA.

redwood• 6 years ago

Must be consulting revenue vs subscription (or similar)

throw0101a• 6 years ago

Has "private equity firm" in a sentence ever been followed by good news? Why do they seem to mess things up so badly?

kencausey• 6 years ago

I suspect this is a case of when it all goes well or at least not badly that it is simply normal and a case of 'not newsworthy'.

Yes, a lot of bad things happen in the world, but don't forget that a lot of good or just OK happens and never gets reported because it is just normal.

chungus_khan• 6 years ago

The issue is that the overwhelming incentive for these sorts of buyouts is towards very short-term decisions leading up to a sale. If things line up correctly, this can have good results, but usually it involves compromising the product, long-term business, cutting corners, etc. People on places like HN are especially wary of this sort of thing because a lot of us are tech professionals who end up in the trenches first hand when those corners get cut. This is especially dangerous in the realm of security.

tyingq2• 6 years ago

They buy with the expectation that there is a relatively quick turn to "expose value". So lots of cut-throat, short term, etc, decisions post purchase.

prepend• 6 years ago

I worked for a small nasdaq company about 15 years ago. A private equity firm bought them and two other related companies. They’ve kept them running and private all this time. I presume profitably.

I usually assume PE buyouts will result in a teardown situation, but in this case it was positive for customers and employees. I left for unrelated reasons before the sale completed but friends there say they are happy.

I’ve also worked for firms that got bought by PE and were stripped down to just a few bodies doing bare minimum maintenance and only collecting maintenance fees from existing customers. I’m not sure what this is called, but it seems “coasting” can be very profitable for enterprise software with an install base that has high switchover costs.

driverdan• 6 years ago

Let's hope that's the case here, that they strip RSA of all its value and put it out of business.

dublinben• 6 years ago

Canada Goose was taken over by Bain Capital in 2013 at a $250m valuation. It later went public in 2016 and is currently worth $3.4b. The ubiquity of these overprices parkas is largely due to their "private equity firm" restructuring.

paulddraper• 6 years ago

good news

Good news for who? The owners? The employees? The customers? The private equity firm?

Answers are yes, no, no, yes.

Why do they seem to mess things up so badly?

They don't, but they probably aren't optimizing for what you are considering.

pge• 6 years ago

2.1B is the same price EMC paid to take RSA private in 2006. Zero increase in value in 13 years...

https://corporate.delltechnologies.com/en-us/newsroom/announ...

Traster• 6 years ago

Reminds me of Intel doing exactly the same thing, took McAfee from a $7.6Bn valuation in 2010 to a $4.2Bn valuation in 2017.

NullPrefix• 6 years ago

It's not zero. 2.1B was in 2006 dollars. 14 years of cumulative inflation would add up to almost 2.7B in 2020 dollars.

vorpalhex• 6 years ago

They could have literally put 2.1B in a savings account in 2006 and made more money.

Spooky23• 6 years ago

RSA is a declining platform. They are getting their clock cleaned by many competitors in all segments.

vijayr02• 6 years ago

I'm not blind to the flaws of private equity, but just wanted to make a point here: there's very little likelihood that the business sold in 2020 is the same that was acquired in 2006. Companies change and the private equity sponsor may have:

1. Spun off businesses that made a profit 2. Paid out dividends that reduced their cost basis

Again, I don't know the specifics of the EMC deal and maybe very well they destroyed value, my point is that this is not as simple as comparing numbers at two points in time.

threedots• 6 years ago

Change in EV is not an appropriate metric to measure PE returns, you need to take into account recaps, dividends, loan interest and whatever other weird stuff took place.

ausbah• 6 years ago

"Private equity firms increasingly are setting their sights on the security industry due to its rapid and steady growth."

I do not trust private equity to main the standards necessary for quality and trustworthy security.

tyingq2• 6 years ago

Cybersecurity seems to be growing fast enough that the talent has run out. So lots of under-qualified CISO types running around with money to spend. I think the PE firms are onto something, investment wise.

TomMarius6• 6 years ago

And what alternative do you propose? Public equity? Ever heard of NSA, Australian government, UK, etc, and that's just the "democratic", "free" world?

mech12342• 6 years ago

Are you implying that public equity is some sort of government-owned entity?

My best guess is that you are confused as to what the term "private equity firm" means. Your post is so entwined with implications that I have no idea what you really mean.

admax88q• 6 years ago

To be fair I already don't trust RSA Security before this sale because of Dual_EC_DBRG.

raxxorrax• 6 years ago

I just heard that they allegedly had backdoors for security agencies implemented. Is this refering to that?

kyrra• 6 years ago

As was said in another thread, you only tend to hear about the private equity deals that go bad. Here are some of the big ones both good and bad:

https://www.investopedia.com/articles/markets/111015/10-most...

PetSmart was one success story I heard from this podcast: https://www.wsj.com/podcasts/the-journal/how-petsmart-solved...

satya71• 6 years ago

Yeah, some times it does go well. But the managers make money either ways, since they pay themselves back immediately using leverage.

sailfast• 6 years ago

There is never a bad time to read Barbarians At the Gates to understand how the incentives work in these deals and to help judge for yourself whether they're going to work out or not.

Spoiler / Hot Take: if you're overloading the company up with debt (even cheap, short-term stuff) and taking out cash based on "revenue projections" or "realized synergies" it's probably not gonna work out so hot when the loan comes due.

batmenace• 6 years ago

I do, for the sole reason that at the end of (almost) every private equity deal is an exit, and in order for the company to be sold at a higher price than it was bought, it still has to be good/better at what it is supposed to be doing. Also, from my experience for these sorts of Tech deals, the level of due diligence conducted before an exit by potential buyers can be extensive, so I doubt they'd let the security parts of a security business go bad.

chadlavi• 6 years ago

Does PE do the VC thing where they buy 10 or 20 things expecting 1 or 2 to hit big and the rest to fail? If so, they're placing a bet, but if it's not promising they'll let it die on the vine.

hattar• 6 years ago

in order for the company to be sold at a higher price than it was bought, it still has to be good/better at what it is supposed to be doing

As someone who has worked for PE owned companies I can confidently say that unless you consider the thing they’re “supposed to be doing” to be reflecting profit on the books, you’re wrong.

The PE owners of companies I worked for pushed EBITDA over anything else and as a result our product became a leaning Jenga tower of half finished functionality combined with unfulfilled promises to customers. Foundational systems were completely neglected in favor of whatever kept costs low and increased closed ARR focused deals. We sold for many times our previous valuation and not one person I spoke to in the company itself or our customer base felt the product was better, all agreed it was worse.

staticautomatic• 6 years ago

The "rational actor" approach to reasoning about how corporations make decisions is as seductive as it is wrong.

pm90• 6 years ago

Also, from my experience for these sorts of Tech deals, the level of due diligence conducted before an exit by potential buyers can be extensive, so I doubt they'd let the security parts of a security business go bad.

Due diligence conducted by whom?

If you've worked at any corporation, you will know that most organizations treat "Security" as a "Cover your ass" org. Security teams exist firstly to prevent the company from going under due to incidents; actual protection of production systems is an afterthought. Consequently, you will have corporations touting all kinds of certifications while their production systems continue to e.g. use md5 hashes for user passwords.

I would ask that you reconsider your views. You would think the buyer in these transactions would conduct due diligence, but consider that the people who are technically competent to do a thorough due diligence are few in number. It is in everyone's interest to let the transaction go through; the security due diligence happens after the decision has been made and rarely can break a deal.

rdl• 6 years ago

RSA was already incapable of maintaining those standards.

ThisIsTheWay• 6 years ago

I don't trust Dell to do that either...

ska2• 6 years ago

I think you can shorten that statement significantly, wlog.

philjohn• 6 years ago

To be fair, Entrust and RSA tokens are a relic of the past, systems like Duo Mobile are far better and easier to use.

whatsmyusername2• 6 years ago

I’m reading this as RSA is deprecated.

chundicus• 6 years ago

This is referring to RSA the company, not RSA the public key cryptosystem (both created Rivest, Shamir, and Adleman)

whatsmyusername2• 6 years ago

That's what I meant, RSA (the company) is cancelled.

NelsonMinar• 6 years ago

Never forget that RSA is the company that sold out the security of all its customers for a $10M payment from the NSA. https://www.reuters.com/article/us-usa-security-rsa/exclusiv...

sudoaza• 6 years ago

10M Wow, that's cheap AF!

blaser-waffle2• 6 years ago

"Undisclosed until now was that RSA received $10 million in a deal that set the NSA formula as the preferred, or default, method for number generation in the BSafe software, according to two sources familiar with the contract. Although that sum might seem paltry, it represented more than a third of the revenue that the relevant division at RSA had taken in during the entire previous year, securities filings show."

10MM was also 1/3 of the revenue of that division; that's a big chunk. No reason to think they'd stop that cashflow

tptacek• 6 years ago

A reminder that RSA was "Security Dynamics" before they bought "RSA" and renamed themselves. Their main line of business was hardware tokens, which were infamously implicated in a compromise by overseas attackers that coined the term "Advanced Persistent Threat". RSA diversified into multi-factor authentication tools for servers and then a bunch of random enterprise security gadgets.

Companies like Duo and Okta ate RSA's lunch; their original core business is now a commodity. RSA's relevance in the industry is greatly diminished.

tialaramex• 6 years ago

Also the key stupidity that made all this possible is a lesson worth remembering after RSA is forgotten.

The RSA tokens are essentially a random number plus form factor. It isn't necessary for the manufacturer to know what the number inside each token is, let alone to store that after the product ships.

But of course it's tempting to do so as a convenience for your customers. Once you set off down this slippery slope you're a dead man walking.

A FIDO token likewise is a random number plus (somewhat more complicated) form factor. If anybody makes RSA's mistake it has the exact same consequences (big hole in your security for whoever knows the number). Hopefully the decisions in FIDO to eliminate conveniences for knowing the magic number, plus RSA's example has been enough that nobody is dumb enough but we shall see.

jlgaddis• 6 years ago

Apparently Yubico knows the seeds written into their devices, else the OTP auth (against their servers) [0] woulndn't work OOTB, no?

[0] https://demo.yubico.com/otp/verify

gumby2• 6 years ago

Dell has always felt like a financial engineering firm rather than computer firm. Even in the 80s and 90s they made their money through holding the customer’s money, putting unsold product on trucks parked in the street (counts as shipped), having suppliers hold inventory in trucks on their loading docks (supplier has to fund it as Dell hasn’t received it until they take it off the truck) and of course the last couple of decades of back and forth going private - going public

hammock• 6 years ago

Good article where I can read more about this?

gumby2• 6 years ago

I'm talking about 40 years of reading articles about Dell; perhaps some old magazines from the 80s may not be online too, but: likely if you use a useful search engine* to look up things like "dell negative cost of capital" or "dell minus 11 days receivables", "dell just in time inventory supplier trucks" etc you can probably look up some of their much-lauded "innovations". I believe the "put assembled product into trucks and drive them through the gate" was a one-time act to meet one quarter's goals, but don't remember exactly, though surely it would have been after they went public (the first time).

* Google used to be the obvious "useful search engine" when all others were terrible, but these days they emphasize recency and celebrity to the point where their search engine is almost useless in looking up old articles.

protomyth• 6 years ago

I worry with news like this that the PEF has a plan to sue some people after the buy out. I wonder if they have anything that could be used to go after groups?

737min• 6 years ago

The important patents are long-expired.

notlukesky• 6 years ago

For whatever it is worth, I work for an SI that sells SAASPASS IAM that also includes MFA solutions and our only churn customers are those using RSA SecurID. I assume this will accelerate, but I suppose that will be obvious in a year or two from now. Of the MFA vendors out there RSA will have to invest to keep up pace with other vendors. Let’s see if the new owners are willing to do that.

Dell Sells RSA to Private Equity Firm for $2B

Related Stories