Matasano Security acquired for £8.4m ($13m) - Congrats tptacek

http://www.nccgroup.com/en/news-events/news/acquisition-of-a-leading-us-security-testing-business-for-%C2%A384m/

by ontoillogical • 14 years ago

439 111 14 years ago

nccgroup.com

tptacek16• 14 years ago

If you thought I was insufferable before...

vld• 14 years ago

Congratulations! Will you still be directly involved?

tptacek16• 14 years ago

We're continuing as an independent business; the two biggest changes are (1) we're hiring more people than our original plan, and (2) we get to work directly with our friends and rivals at iSEC, who were bought by NCC 2 years ago.

(2) is a big deal --- there are so many smart people doing what we do at NCC companies that we expect research time to get way more productive; also, iSEC and NGS/NCC (the UK "us") have different research focuses, like Android and 3G to our crypto and trading protocols. Black Hat next year should be fun. (there are crypto people at iSEC; I'm sleep deprived and on an airplane)

ta12121• 14 years ago

Especially when you're wrong :-)

aortega2• 14 years ago

Unlike most startups out there, I believe Matasano is a purely consulting business with no product, IOS app or social site, and it got bought anyway.

As the founder of a "cyber-startup" with no product and no social site, this is very encouraging :)

Congrats!

jonknee2• 14 years ago

So where are you eating your celebratory meal?

tptacek16• 14 years ago

My flight out got cancelled, so my celebratory meal was "Marriott room service Caesar salad".

Apropos nothing: I do not understand why anyone in 2012 flies United. And while I understand why someone might order a Marriott room service Caesar salad, I do not recommend it.

rubyrescue2• 14 years ago

Congrats, though we've not interacted much here, you feel like a neighbor... so it feels great to see... and i've learned a LOT from your posts, like never typing the letters, A, E, S in consecutive order, for starters. : )

rafaelferreira• 14 years ago

Do you have a link for the HN discussion? My google-fu failed me.

mindcrime• 14 years ago

If you thought I was insufferable before...

You are, but congrats nonetheless! :-)

_pius• 14 years ago

Congratulations Thomas!

comatose_kid• 14 years ago

Nicely done! Congrats!!

Sukotto• 14 years ago

Congratulations on the big win Thomas. Hope it just keeps getting better for you guys.

larrys• 14 years ago

"If you thought I was insufferable before..."

First, congratulations. I did notice though a change in your comment tone from some time ago. (Unfortunately I can't recall exactly when and there is no easy way to draw up comments on HN from "x" days ago you have to go through page by page.) I'm wondering though if it coincides with this (or maybe another deal) going down. Meaning either the stress or elation of this or another potential transaction altered your writing.

tptacek16• 14 years ago

You actually can do this using HNSearch and the by: keyword. If you ever do find some inflection point at which I become/became even more annoying, shoot me an email.

georgespencer• 14 years ago

Congratulations!

unreal37• 14 years ago

Congrats! That's great news. Btw, I feel you bring a lot of value to HN (and me) through your comments, so I hope that doesn't change.

stox2• 14 years ago

Congrats!! It has been a long time coming.

jayliew• 14 years ago

Congrats, Thomas!

citricsquid• 14 years ago

Congratulations, good luck with the new opportunities!

sown• 14 years ago

Neat.

Does this mean the nature of working there is going to be different? I've been through an acquisition before and everything changes afterwards.

tptacek16• 14 years ago

Not in our case; we're a wholly-owned subsidiary, but not integrated with our parent company. Our sibling company on the west coast, iSEC Partners, has been operating independently under NCC for several years.

We work a little bit like small record labels.

The changes that will happen include "we're hiring more people" and "we get to share research with sibling companies".

angersock• 14 years ago

"If you thought I was insufferable before..." :)

At any rate, congratulations and great work!

scott_s• 14 years ago

Congrats, Thomas. I'm glad to you have you around.

SatvikBeri• 14 years ago

High five and well-done! You and your team earned it :)

brianlash• 14 years ago

Really fantastic news. Congrats!!

mhartl• 14 years ago

Bravo! Keep up the great work.

bane• 14 years ago

Ha! Congrats anyways!

anigbrowl• 14 years ago

Well done!

rbanffy• 14 years ago

We can agree on something. Congratulations, nevertheless. I suspect you worked very hard for this and it seems well deserved.

Nrsolis• 14 years ago

Congrats man. Be sure to send the announcement URL to your old friends at Arbor.

jgrahamc• 14 years ago

I'm happy for tptacek. He's a great member of this community and deserves every success.

tptacek16• 14 years ago

mechanical_fish• 14 years ago

May I also sign that greeting card?

Congratulations!

nanijoe• 14 years ago

It almost feels like a personal win here(not in SV, "more experienced guy", networking background etc)...also shows you can be obnoxious and right at the same time

tptacek16• 14 years ago

There is a nonzero risk that my partners may frame your comment.

dfc• 14 years ago

What is SV?

joezydeco2• 14 years ago

Local boy done good. Congrats from all the hackers left in Chicago.

tptacek16• 14 years ago

LEFT in Chicago? Are we being hunted?

casca2• 14 years ago

This is an interesting purchase as Matasano is a services company that has some of the smartest people in infosec. For those not in the field, Thomas, Dave and Jeremy are well known and highly respected.

Many acquisitions are to get the talent but I can't remember another one where it's so apparent. The problem is that talent is mobile and $13m for a few super-smart people who leave after a year is expensive.

tptacek16• 14 years ago

There is no such thing as a non-talent acquisition in consulting. We're not going anywhere; like iSEC before us, we continue to run independently as Matasano.

masklinn• 14 years ago

So you're acquired in a "becomes a subsidiary" sense rather than "be assimilated in the borg" sense?

ontoillogical2• 14 years ago

I've actually worked with iSEC people last year, and only realized they were part of NCC Group today. Totally independent shop.

nomore• 14 years ago

Are you sure about that?

I used to work for a company NCC Group bought a few years ago and I heard Rob Cotton say the same thing...

Things got interesting really fast after our friends in Manchester bought us - changing what computers we use (on the desktop and server), changing email, etc, etc.

alecco• 14 years ago

That's very nice. Congrats.

thomc• 14 years ago

It was apparent with NGS too, who were (are) one of the most highly regarded pen testing companies here in the UK. Having worked with many of the leading ones I can say NGS was always at the top of the list, helped not only by their talent but also small size which made them flexible and adaptable. After the acquisition I noticed this changed and a number of the guys I'd worked with left. So it is probably good that Matasano is staying Matasano but with the ability to draw on the collective resources of all the other teams.

_b8r02• 14 years ago

I wouldn't say that NGS were the most highly regarded by anyone but themselves. They had a lot of technical expertise in various areas but terrible account and product lifecycle management. Still, there were some extremely smart people there (and I'm sure there still are, you just don't hear from them as NGS).

obtu• 14 years ago

Two years at least:

> Consideration of £8.4m - initially £4.2m, then two further payments up to £4.2m in total over next 24 months against performance related targets

revorad• 14 years ago

Congrats tptacek!! Thanks for all your amazing comments over the years and now that you are set for life, I expect more higher quality commentary. :-P

fasouto2• 14 years ago

Congrats for the adquisition tptacek! :)

[Off topic] I really like the name "matasano", it means bad doctor in informal Spanish. Matasano = matar(kill) + sano(healthy) literally means the doctor who kills the healthy patients.

aortega2• 14 years ago

Here in Argentina is a slang term for doctor, not particularly bad or good.

tptacek16• 14 years ago

We like the name too! We picked it after giving up on naming the company (we had chosen "Aperture Security" only to find a week later that it had already been taken) and consulting a "list of plant names" for cool-sounding plants.

We hired a (very smart) Argentine national friend of ours who immediately made us aware of the connotation. We were somewhat unhappy for about 500 milliseconds, and then immediately very very happy.

fasouto2• 14 years ago

Your new logo :D http://foros.androidvenezuela.com/Dr-Nick-Simpsons.png

zfran• 14 years ago

> We hired a (very smart) Argentine national friend

Any chance we could know who that was? I'm argentinian too and I'm curious.

smountcastle2• 14 years ago

How come only ~1.3x annualized revenue (the press release said: Year to 30 June 2012, Matasano revenue was $5.0m)? That seems like a very low multiplier -- are consulting companies treated differently from product companies in this regard?

rubyrescue2• 14 years ago

1.3 is good for a consulting company. 1x-1.25x is normal

patio11• 14 years ago

Services companies, of which consulting companies are a subset, typically receive 1.5x to 2x multiples. [n.b. Your math does not match my math.] Why is this less than product companies get? That's less because consulting companies are a bad place to be and more because successful products are an awesome place to be.

It is totally reasonable to have a product company do $7 million of revenue on, say, $2 million of costs. (Let's see: four devs, two sales guys, one marketing, two founders... throw in overhead and we're there.) An acquiring company might have an easy, obvious path to turning that into $70 million of revenue on $5 million of costs. (For example: "We change essentially nothing about your company. We hawk your product to our customer base, using our sales guys, who 6 weeks ago only uttered your name if a customer brought it up, to disparage you. This makes us a mountain of money.")

A services company, on the other hand, might have $7 million revenue on $4 million in costs (16 consultants, 1 business manager, 2 founders). The most straightforward pathway to take this business from $7 million to $70 million is to add 144 consultants. They cost ~$40 million a year. This would be a radically less attractive proposition if it were even possible, but if hiring 144 consultants was easy, you wouldn't have to buy a company to find only 16 of them.

Also, with a dev company you're buying some capital (software) plus renting access to brains. With a consulting company, you're renting access to brains. In all circumstances, brains can move. Software rarely decides to do that spontaneously.

Edit to elaborate: The above is not a strike against doing consulting, by the way. Thomas, for example, has frequently mentioned on HN two true, salient facts: a) almost all products fail miserably and b) the principals at a consulting company beat BigCo salaries approximately the second they call themselves "principals at a consulting company", which is very much not the case at most product companies.

dugmartin• 14 years ago

What keeps me building product each day after billing 8 hours of consulting time is that consulting profit is a linear function of time * employees but I can't make more time and I don't want to manage a bunch of consultants.

void-star2• 14 years ago

Acquiring a services company also buys you their customer portfolio. And in the case of Matasano, it's really a pretty impressive one.

GFischer• 14 years ago

I understood differently:

"For the year ended 30 June 2012, Matasano reported revenue of $5.0m", so that is a year's worth of revenue.

That would be a 2.6 multiple, which is quite good for a consulting company.

I wonder how many times EBITDA and how many times EBIT it was? tptacek, is that something you can disclose?

How did you do your company valuation? Independant auditors? Maybe that's material for a future blog post? :)

smountcastle2• 14 years ago

Ok, that makes sense. When I saw 'Year to 30 June' I thought January 1, 2012 to June 30, 2012.

alinajaf3• 14 years ago

More congratulations for tptacek, I'm significantly less stupid for his comments and wish him all the best.

It's weird, just today I was thinking about what it would be like to work at a company like Matasano instead of being the paranoid security guy on every web app project I'm hired for.

ontoillogical2• 14 years ago

They're only hiring more people now then before. You should apply.

alinajaf3• 14 years ago

I've had a look at the requirements and I'm not really up to scratch, additionally I've spent the last five years trying to get out of full-time employment. If I were looking for a day job and was able to relocate to the states, I would totally spend a few months training up on the required skills and send my details over.

rdl4• 14 years ago

Congratulations! (and wow, the low multiple for consulting in general is kind of sad, but oh well)

alinajaf3• 14 years ago

£8.4 million sits comfortably in the 'fuck you' category of windfalls as far as I'm concerned.

rdl4• 14 years ago

Split how many ways? (and maybe there is equity split beyond the top 3?) I personally would be quite happy with $5-10mm, but to net that, I presume he'd have to sell the company in the $40mm+ range. Nice that they did it this year before cap gains go up, though.

latortuga• 14 years ago

Congratulations Thomas, I know I'm not the only one who has learned a mountain about security from you! You're an invaluable member of the community.

justjimmy• 14 years ago

tptacek is one of the few names on HN I recognize during my short time here (not to mention he posts alot!), so needless to say it's pretty awesome to see this happened to him/her.

Congratulations!

trevelyan• 14 years ago

What a wonderful thing to read. Upvoting threads doesn't have the weight of leaving a separate note, so congratulations!

grandalf• 14 years ago

Congrats! I've much enjoyed your comments and knowledge on HN over the years.

casca2• 14 years ago

For those who are familiar with tptacek from HN but don't know why he's so respected in the infosec space: http://krebsonsecurity.com/2012/06/how-to-break-into-securit..., http://krebsonsecurity.com/2012/06/how-companies-can-beef-up...

ilconsigliere• 14 years ago

I'm really enjoying the "How to Break into Security" posts you linked to.

The infosec (specifically, appsec) space seems very very interesting.

gruseom• 14 years ago

Extremely many congratulations! Now get some sleep.

tptacek16• 14 years ago

Can't sleep. Clown'll eat me.

rman666• 14 years ago

Congrats tptacek and crew, and NCC, too!

debacle• 14 years ago

Does this mean you're going to be putting some of that $13m towards hiring a few fellow HNers?

tptacek16• 14 years ago

Yes? Very yes?

dhimes• 14 years ago

I'll add yet another "Congratulations, Thomas." Not only have your posts enlightened me with answers about security, more importantly they have taught me to ask questions about security practices. Thank you. This WIN was well-deserved.

staunch• 14 years ago

Congrats!

sabat• 14 years ago

For just a moment, I thought that Monsanto corporation had been acquired, and thought: "oh, nooooo."

ephermata• 14 years ago

Congratulations!

kyro• 14 years ago

Jesus, another no-revenue Silicon Valley social startup acquired. This madness will never end.

Congrats, though, Thomas.

petercooper• 14 years ago

This makes me wonder.. how many of the http://news.ycombinator.com/leaders have had a company/technology acquired? Would be an interesting stat.

feralchimp• 14 years ago

rock on, tptacek! if you're not eating sushi off the top of a rare steak right now, stop what you're doing. :)

kajecounterhack• 14 years ago

Congrats tptacek!

edanm• 14 years ago

Congrats tptacek.

Besides being very happy for you, I'm now very happy for myself, for listening to your advice during the last half-year of starting my own consulting business.

Your very generous and open comments about everything to do with running a consulting business were, and are, a constant source of help and encouragement.

So congratulations, and I hope you have a lot of fun with your new friends at sibling companies! Much deserved!

Matasano Security acquired for £8.4m ($13m) - Congrats tptacek

Related Stories