The acquisition of Duo Security by Cisco (CSCO) fits into the Cisco transformation strategy. The company is expanding its presence into the cloud with a subscription-based software solution.
It is a typical playbook acquisition Cisco will bring to scale. Moreover, the Duo solution enhances Cisco’s portfolio.
In this article, I describe how the acquisition makes sense for Cisco. Then, I determine if the company does not overpay for it.
Some technical background
Duo offers a cloud-based zero trust security solution. Zero trust means users are not trusted anymore. Authentication is always performed, anywhere, for any application.
In the pre-cloud area, users were trusted inside the enterprise. The Duo technology marks the shift of the authentication of mobile users using cloud applications. This new paradigm ignores the traditional perimeter of the enterprise.
The solution utilizes a two factors authentication: a password and a code sent to a smartphone. There are some variations, but we don’t need to know more in the context of the Cisco acquisition.
The Duo solution goes beyond the cloud-based two factors authentication. It extends to agent-less endpoint security (a Duo certificate is still needed).
Duo competes with Zscaler (ZS) and Symantec (SYMC), amongst others.
What is the strategy?
Now we have some understanding of the solution, let’s see if it fits into the Cisco strategy.
On the high level, Duo is a cloud-based, subscription-based security software solution. It is exactly the kind of business that Cisco is turning to. And it complements the Cisco umbrella framework.
Let’s now see how Duo makes sense on the technical level.
Cisco already has an identity and access solution for the enterprise with Cisco ICE. But this solution does not cover the cloud environment. Duo is the first entry to the cloud identity and access segment for Cisco.
On the medium term, Duo with Cisco will allow Cisco to provide an end to end zero trust architecture.
Beyond acquiring a complementary company in a growing market, Cisco also acquired a solution to bring to scale. And as Duo is a cloud-based solution, Cisco can easily scale it up. Duo’s channel partners account for only 30% of the sales. Cisco will use its massive channel partners network to grow the top line.
During the conference call, the management indicated the Duo solution would still be independent.
On the medium term, Cisco will integrate the solution. Duo is already compatible with the Cisco ASA firewall. But Cisco will expand the solution to many more devices and applications. SD-Wan is one of the possibilities.
Besides, Cisco can propose a simplified security policy by integrating Duo with many devices.
I see one potential issue, though. With this acquisition, Duo is losing its neutrality towards the other security vendors. Will Juniper and Palo Alto keep their solution compatible with Cisco/Duo products?
In any case, with the experience of Cisco to integrate companies, the integration risk is low. Especially with the fit of the Duo solution into the Cisco portfolio.
Thus, this acquisition makes a lot of sense as it enhances the Cisco portfolio, and Cisco will bring the Duo solution to scale.
Cisco gave very little financial information about Duo Security. The management mentioned a strong top-line growth and a healthy gross margin. Reading between the lines, it means that Duo is growing and losing money. The management will give more information when the deal closes by Q1 2019.
In the meantime, we know Cisco will pay $2.3 billion in cash. Duo employs 700 people and has more than 12,000 customers.
We can compare with Zscaler. The company, according to LinkedIn, employs 1,162 people. Its revenue is growing at about 50% per year, and the TTM sales amount to $167 million.
With the growing market and the potential to scale, the growth possibilities for Duo are huge. I estimate that the growth potential is comparable with Zscaler.
With $287 million in cash, the market values Zscaler at $4.3 billion. It represents 14x revenue or $3.45 million per employee.
Applying this multiple to the 700 Duo employees gives a valuation of $2.4 billion, which is very close to the price Cisco will pay.
We could argue that the market overvalues Zscaler, but we must consider the growth. At least, when comparing with the valuation of Zscaler, Cisco does not overpay.
The acquisition of Duo Security makes a lot of sense. It confirms the shift of Cisco to cloud-based software solutions.
Besides, the Duo solution expands the Cisco security portfolio. And Cisco can integrate Duo to its portfolio while bringing it to scale.
With the limited information we have, the price paid per employee is high. But the growth potential is enormous. Compared to the market valuation of Zscaler, Cisco did not overpay.
Disclosure: I am/we are long CSCO.
I wrote this article myself, and it expresses my own opinions. I am not receiving compensation for it (other than from Seeking Alpha). I have no business relationship with any company whose stock is mentioned in this article.