Matasano Security acquired for £8.4m ($13m) - Congrats tptacek
nccgroup.com
nccgroup.com
(2) is a big deal --- there are so many smart people doing what we do at NCC companies that we expect research time to get way more productive; also, iSEC and NGS/NCC (the UK "us") have different research focuses, like Android and 3G to our crypto and trading protocols. Black Hat next year should be fun. (there are crypto people at iSEC; I'm sleep deprived and on an airplane)
Almost makes me regret being a freelancer.
As the founder of a "cyber-startup" with no product and no social site, this is very encouraging :)
Congrats!
Apropos nothing: I do not understand why anyone in 2012 flies United. And while I understand why someone might order a Marriott room service Caesar salad, I do not recommend it.
They also have a monopoly on direct flights to the US from Edinburgh, which is another reason someone might end up on a United flight.
You are, but congrats nonetheless! :-)
First, congratulations. I did notice though a change in your comment tone from some time ago. (Unfortunately I can't recall exactly when and there is no easy way to draw up comments on HN from "x" days ago you have to go through page by page.) I'm wondering though if it coincides with this (or maybe another deal) going down. Meaning either the stress or elation of this or another potential transaction altered your writing.
Now all we need is some guys from Stanford to demonstrate an algorithm that finds this.
Does this mean the nature of working there is going to be different? I've been through an acquisition before and everything changes afterwards.
We work a little bit like small record labels.
The changes that will happen include "we're hiring more people" and "we get to share research with sibling companies".
At any rate, congratulations and great work!
Many acquisitions are to get the talent but I can't remember another one where it's so apparent. The problem is that talent is mobile and $13m for a few super-smart people who leave after a year is expensive.
I used to work for a company NCC Group bought a few years ago and I heard Rob Cotton say the same thing...
Things got interesting really fast after our friends in Manchester bought us - changing what computers we use (on the desktop and server), changing email, etc, etc.
Also SecureTest and NGS were very different creatures. The phrase 'herding cats' was never so much an understatement as it was from what I've been told about life at NGS.
It's also a bit more difficult to bring that level of control into a company outside of the UK. I'm sure there'll be an eventual absorption into the NCC cube (more likely co-absorption of iSEC and Matasano into one entity if previous activities are considered) but I imagine there'll be a fair level of autonomy as long as the founders stick around.
Also I still chuckle about the SAP implementation. We offered to test it years back but for some reason NCC weren't up for it.
> Consideration of £8.4m - initially £4.2m, then two further payments up to £4.2m in total over next 24 months against performance related targets
Congratulations!
The infosec (specifically, appsec) space seems very very interesting.
[Off topic] I really like the name "matasano", it means bad doctor in informal Spanish. Matasano = matar(kill) + sano(healthy) literally means the doctor who kills the healthy patients.
We hired a (very smart) Argentine national friend of ours who immediately made us aware of the connotation. We were somewhat unhappy for about 500 milliseconds, and then immediately very very happy.
Any chance we could know who that was? I'm argentinian too and I'm curious.
It is totally reasonable to have a product company do $7 million of revenue on, say, $2 million of costs. (Let's see: four devs, two sales guys, one marketing, two founders... throw in overhead and we're there.) An acquiring company might have an easy, obvious path to turning that into $70 million of revenue on $5 million of costs. (For example: "We change essentially nothing about your company. We hawk your product to our customer base, using our sales guys, who 6 weeks ago only uttered your name if a customer brought it up, to disparage you. This makes us a mountain of money.")
A services company, on the other hand, might have $7 million revenue on $4 million in costs (16 consultants, 1 business manager, 2 founders). The most straightforward pathway to take this business from $7 million to $70 million is to add 144 consultants. They cost ~$40 million a year. This would be a radically less attractive proposition if it were even possible, but if hiring 144 consultants was easy, you wouldn't have to buy a company to find only 16 of them.
Also, with a dev company you're buying some capital (software) plus renting access to brains. With a consulting company, you're renting access to brains. In all circumstances, brains can move. Software rarely decides to do that spontaneously.
Edit to elaborate: The above is not a strike against doing consulting, by the way. Thomas, for example, has frequently mentioned on HN two true, salient facts: a) almost all products fail miserably and b) the principals at a consulting company beat BigCo salaries approximately the second they call themselves "principals at a consulting company", which is very much not the case at most product companies.
"For the year ended 30 June 2012, Matasano reported revenue of $5.0m", so that is a year's worth of revenue.
That would be a 2.6 multiple, which is quite good for a consulting company.
I wonder how many times EBITDA and how many times EBIT it was? tptacek, is that something you can disclose?
How did you do your company valuation? Independant auditors? Maybe that's material for a future blog post? :)
It's weird, just today I was thinking about what it would be like to work at a company like Matasano instead of being the paranoid security guy on every web app project I'm hired for.
Congratulations!
Besides being very happy for you, I'm now very happy for myself, for listening to your advice during the last half-year of starting my own consulting business.
Your very generous and open comments about everything to do with running a consulting business were, and are, a constant source of help and encouragement.
So congratulations, and I hope you have a lot of fun with your new friends at sibling companies! Much deserved!
Congrats, though, Thomas.
But it looks like this is a quite different kind of acquisition, where they'll basically be doing the same job as before, just under a new umbrella, so it's not really cashing out and shutting down the old business at all.