IPOs are back, AI jumps the shark, NGFWs have some serious security issues – ESW #391

Our first cyber IPO in FOREVER. After being taken private by Thoma Bravo in 2022 for $6.9B, SailPoint is going public again, and will use the same ticker symbol again (SAIL).

Does it make sense for cybersecurity companies to go public? I don't think so, but it looks like it's going to start happening again anyway.

When did we last see a security company IPO? Back in September 2021 - we were all still wearing masks, though most of us stopped washing our groceries by this time. ForgeRock went public for a hot minute before they were taken private again, only 13 months after going public.

Why am I ignoring Rubrik? They're not cybersecurity - they're a backup company that has dipped into cybersecurity (honestly, I haven't looked at their last 10K/10Q, and I don't know what portion of their revenue comes from data security vs backups, so don't come at me).

You might have noticed some interesting facts. Our last two cybersecurity IPOs are both IAM vendors that were both taken private by Thoma Bravo. Then, in 2023, Thoma Bravo merged ForgeRock and Ping Identity. This PE shop really went all in on identity!

Are we going to see more IPOs in 2025? It's certainly possible, with Wiz and Netskope as the most likely candidates.

This isn't a cybersecurity company, but it's a useful foil for discussing whether or not cybersecurity companies should even consider going public at all.

• going public takes a lot of work and prep - the road to an S-1 filing often takes years!
• the initial capital raised is typically less than $15B. A LOT less
• cybersecurity companies typically need to pivot or reinvent themselves every 5 years - the public market and shareholders don't like that, and it takes control and agility away from the company - then, the company often ends up getting taken private anyway

Another AI-powered SOC startup, though this one is focused on providing an MDR service. I have thoughts and opinions.

It's like Wireshark, but for your cloud!

The tweet text:

DHS has terminated the memberships of everyone on its advisory committees. Includes several cyber committees, like CISA's advisory panel & the Cyber Safety Review Board, which was investigating Salt Typhoon. That review is "dead," person familiar says.

I recall thinking, "DAMN, that's a harsh sentence", but I definitely didn't see this coming.

“This is the largest number of CVEs addressed in any single month since at least 2017 and is more than double the usual amount of CVEs fixed in January,”

I had to reboot my Windows systems a LOT

From Orange Cyberdefense, this report is chock full of useful data points sourced by their engagements with their clients.

Spicy, very on-brand take from my friend Anton Chuvakin!

The amount of AI news in 2024 was a little overwhelming, so this is a nice resource to summarize and remind you of everything that happened. Some particularly interesting insights here, especially around AI agents.

The black box that is NGFWs is opened a bit for all to see...