Guillaume Letourneur retweetledi
🐐 Are Palo Alto and Nikesh Arora the GOAT acquirers in cybersecurity? What can we learn from their M&A strategy?
June 2018, I remember sitting in the audience as Nikesh Arora was introduced to investors as Palo Alto’s next CEO. Palo Alto’s market cap was $19B, modestly bigger than firewall competitor Check Point at $16B.
Since then, Palo Alto has made 18 acquisitions and spent over $4B on M&A. In the last 5 years, acquisitions have become more frequent, larger, and cover more strategic areas beyond network security (including the $325M acquisition of @felicis company @dig_security for data security). Palo Alto recently crossed $100B in market cap and expects to hit $8B revenue this year - milestones that few software companies have achieved.
All while Check Point $CHKP remains at a $19B market cap, having spent ~$1B on 9 acquisitions (half of that $1B was the recent Perimeter 81 deal).
Sound M&A and Arora’s foresight solidified @PaloAltoNtwks leadership in its core network security market while also expanding to lead new categories like Cloud, SecOps and more.
It will go down as a great case study, and there is a lot for VCs and investors to learn from closely tracking Palo Alto’s M&A strategy:
💰 Lesson 1: Cybersecurity M&A is rarely over $1B: Palo Alto is the biggest acquirer (ex Cisco) and has never spent over $1B. Over the last 15 years, peers like Crowdstrike $CRWD Fortinet $FTNT Check Point, Proofpoint have never spent over $500mn on a deal.
📈 Lesson 2: Their M&A forecasted big new markets: Palo Alto made three of its largest acquisitions in 2018-19—Redlock, Evident, and Twistlock—all in Cloud Security. Wiz wasn’t founded until 2020. The deal activity showed potential for Cloud as a new standalone category.
🏆 Lesson 3: Arora’s fearless M&A and conviction won: In a market like cybersecurity, where innovation moves particularly fast, organic development only takes you so far. It’s clear Arora identified where the market was going and made acquisitions for quality assets without fear.
🌱 Lesson 4: M&A as a source for new startups: Across the 14 largest acquisitions, 6 teams are still at Palo Alto. The other 8 had at least 1 founder go on to start a new cybersecurity company.
🧩 Lesson 5: Identifying targets is half the battle: The next challenge is integration. Investors are clearly supporting Arora’s strategy, and discussion now shifts to enhanced integration as the next act. Any big acquirer has to avoid becoming a “Frankenstein” product.
❓ What’s Next? In cybersecurity, you’re either expanding your platform or losing the market, so there’s more to come. Bigger swings in new markets like Identity, DevOps, and Email may come when the time is right. Near-term, priorities are likely AI Security and Data Ingestion/SIEM (similar to $ZS acquiring Avalor) for $PANW to better aggregate the signals across the portfolio and improve its XDR position.
🎉 Cheers to @nikesharora @danbenjamin_il @jakestorm_ on the Dig deal and to the next $100B in market cap.
English
