F-Secure Company report 7/2019
←
→
Page content transcription
If your browser does not render page correctly, please read the page content below
F-Secure Company report 7/2019 Inderes Corporate customer
F-Secure Company report 22.7.2019
Solid foundation for future growth Analysts
We reiterate F-Secure’s accumulate recommendation and target price of EUR 2.9. To our minds, F-Secure offers a well- Atte Riikola
managed and run combination of investment-phase business seeking strong growth (corporate security) and stable business +358 44 593 4500
built on a solid foundation. During the past 5 years, the company has undergone a significant transformation from a consumer- atte.riikola@inderes.fi
driven endpoint protection company into a corporate cybersecurity company. During the last year, the transformation has now
clearly progressed to a phase of acceleration, with F-Secure finding an acquisition target matching its strategy and the new
Mikael Rautanen
product areas key to the strategy are beginning to be visible in the form of accelerating growth. With the strategy proceeding
+358 50 346 0321
on the current path, we find the risk/reward ratio of the share attractive.
mikael.rautanen@inderes.fi
Information security company turning into a cyber security solution provider
Through its history, F-Secure has developed a strong expertise, reputation and brand in preventing malware and cyber
security threats. The company’s business model focusing on endpoint protection products is very stable, as well as recurring
and scalable by nature, which provides the company with a good base to invest in the growth areas of the cyber security
market. The shift in the market from preventing threats to detecting and reacting to them also creates challenges and change
Recommendation and target price
pressure for an established supplier like F-Secure that has historically focused on the consumer business. Customer demand Accumulate
is shifting from point technology solutions towards acquiring cyber security as a comprehensive process. In order to respond
to the change, F-Secure must continue developing and unifying its product and service portfolio, shift its focus towards (prev. Accumulate)
medium sized and large enterprises and develop its organization.
2,90 EUR Stock price: 2,55 EUR
Value is created through growth in corporate security (prev. 2,90 EUR) Potential: 13,9 %
In the current market situation, F-Secure sees the best value creation potential in strong net sales growth on the corporate
security markets. F-Secure’s current corporate security products and services (2019e 57% of net sales) are, in our view, very
competitive, and the recently expanded portfolio creates cross-selling possibilities but the company must continue investing in
strengthening the product portfolio and in the sales channel. In consumer security (43% of net sales), the company aims at
stable growth and strong profitability. In line with its strategy, F-Secure invests considerably on the corporate side aiming for an Key figures
annual growth of over 15%, while maintaining group level profitability positive with the help of the consumer business.
2018 2019e 2020e 2021e
Excellent growth outlook for the industry but also signs of overheating Revenue 191 221 238 258
Cyber security companies are solving one of the biggest problems of digitizing society, which is why the demand growth-% 12 % 16 % 8% 8%
fundamentals of the market are excellent in a big picture. The size of the global cyber security market is around USD 124 EBIT adj. 10,6 9,2 17,4 27,8
billion and is growing about 10% annually. F-Secure’s business is still somewhat more focused on slowly growing established EBIT-% adj. 5,6 % 4,2 % 7,3 % 10,8 %
product areas than the general market, but the share of very rapidly growing detection and response solutions and rapidly Net Income 0,8 4,5 9,5 17,3
growing cyber security services of the company’s business is continuously increasing as the strategy proceeds. The cyber
EPS (adj.) 0,04 0,04 0,08 0,13
security sector is turning challenging as an investment object despite the growth outlook. We see a risk that the current,
partially extremely high valuation levels of the sector are not sustainable when competitive pressure increases after the
investment wave seen in the industry in recent years.
P/E (adj.) 52,6 72,0 33,0 20,0
Upside in the valuation as the strategy proceeds on the right track P/B 5,5 5,7 5,0 4,3
The valuation of the F-Secure share (2019e EV/Revenue 1.9x) is low in the context of the cyber security sector and considering Dividend yield-% 0,0 % 0,0 % 1,2 % 2,4 %
the historical valuation level of the company. The valuation is largely based on the growth rate in corporate security, with
EV/EBIT (adj.) 35,2 44,9 23,5 14,3
regard to which market confidence has not fully recovered after the disappointing growth last year. The company has shown
accelerating growth in the first half of the year, and we estimate that this will gradually translate into recovering confidence and EV/EBITDA 27,1 13,1 13,7 10,0
in the valuation of the share as the company continues to grow as expected. Also based on our sum of the parts calculation, EV/S 2,0 1,9 1,7 1,5
the share has room for growth as the company’s strategy will proceed as planned in future years. Lähde:Inderes
Source: InderesStock price Revenue and EBIT-% development Valuation (EV/S)
5,0 14,0 %
258 3,1
238 12,0 % 2,8
4,5 221
191 10,0 %
4,0 170 1,9 2,0 2,0
158 1,9
8,0 % 1,7 2,0
1,5
3,5
6,0 %
3,0
4,0 %
2,5
2,0 %
2,0 2014 2015 2016 2017 2018 2019e 2020e 2021e
7/17 7/18 7/19 0,0 %
2016 2017 2018 2019e 2020e 2021e
F-Secure OMXHCAP EV/Sales Median 2014 - 2018
Revenue EBIT-% (adj.)
Source: Thomson Reuters
Value Drivers Risk factors Valuation
• Strong growth in corporate • Transformation process into a • Valuation levels in sector are
MCAP EV
security comprehensive cyber security high, F-Secure’s EV/S-multiple
401 413 • Strategic fit of the MWR
acquisition •
company partly in progress
Tight competition and rapid •
is low compared to the sector
F-Secure’s conscious growth
MEUR MEUR
• Strong demand outlook in market change in consumer investments burden the profit
corporate security security • Growth speed is the most
• F-Secure has good • Success in corporate security important value driver for the
preconditions to invest in growth investments and the share
growth integration of the MWR • We see upside potential in the
EV/S EV/S • Consumer security creates acquisition share as the strategy proceeds
1,9x 1,7x •
stable cash flow
Scalable and continuous
• Cyber security market
potentially over-invested at the
as planned
2019e 2020e business model by nature momentContents
Company description and business model 5-13
Investment profile 14-16
Industry 17-22
Competition 23-24
Strategy 25-27
Historical development 28-30
Estimates and valuation 31-36
Tables 37-40
Disclaimer and recommendation history 41
4F-Secure in brief
F-Secure is a company that offers cyber security
• Cloud storage
products and services, whose solutions help
business sold in
thousands of companies and millions of consumers 2015
to protect themselves from security threats. • MWR-
• Transformation into
• Endpoint protection a more versatile acquisition
focused antivirus provider of cyber accelerates
1988 company security products growth in
Year of establishment • Focus on consumer and services corporate cyber
customers security
• Focus on growing
1999 corporate security
IPO • Expansion into markets
250
cloud storage
markets
EUR 190.7 million (+12 % vs. 2017)
Revenue 2018
200
+20 % 2015-2018
Corporate security revenue CAGR
Revenue (MEUR)
150
95
17.4 MEUR (9.1 % margin) 98
Adj. EBITDA 2018 96
100 96
86 94 92 92
74 78
1666 66
Personnel at the end of 2018
50 96
49,7 % / 50,3 % 63
72
Share of consumer/corporate security in net sales 2018 47 50 49 47 47 45 46 52
0
2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018
Corporate
Yritystietoturva Consumer
Kuluttajatietoturva Pilvitallennus (lopetetut toiminnot)
Cloud storage business
Source: F-Secure / Inderes Security Security 5Company description and business model 1/6
Company description security and responding to them. The corporate
Market change
security market is, therefore, growing strongly. In
Software company focusing on cyber security consumer security, the market is extremely mature
F-Secure is a cyber security software company and growth is slow.
Previosly
established in 1988. The company’s roots are F-Secure has reacted to the market change. In
deep in antivirus software, where the company has • Mass viruses
2015, the company started transforming from an
operated since it was founded and, in practice, for antivirus company towards a company that offers • Prevention
as long as computer viruses have existed. Through more versatile cyber security services and • Cyber security is technology
its history, the company has developed a strong products and focused its growth investments on
• Point solutions
reputation and brand in preventing malware and the growing corporate security markets. This
cyber security threats and in how malware transition has required a change in the company’s Now
develop and how their industrial logic works. F- organization, mindset, product offering and • Intelligent, targeted attacks
Secure’s antivirus software for endpoints have strategy. The MWR acquisition in 2018 accelerated
• Detection and response
won numerous awards in international information the transformation of the company, and today,
security tests and the company’s endpoint corporate security accounts for more than one half • Cyber security is a process
protection products have been sold to millions of of F-Secure’s net sales. • Complex wholes
consumer and hundreds of thousands of
companies worldwide. The change process required by the market
disruption is still ongoing at F-Secure. Thanks to its
Historically, F-Secure’s business has focused on history, the company’s clear strength is its stable
strong antivirus know-how, where the basis is the and profitable consumer business, as well as
prevention of attacks and threats. However, a established position and well-known brand on the
paradigm shift is ongoing on the information security markets. In corporate security, many
security markets, where the assumption that all competitors are clearly unprofitable and
attacks could be prevented has become dependent on external financing when investing F-Secure’s transition
impossible. With the development of technology, aggressively in growth, while F-Secure can make
malware and hacking have also become clearly similar investments in this area with cash flow. • Focus from consumer security to corporate security
smarter and constantly evolving, which is why it is
practically impossible to prevent all modern In light of current market trends, the shift in F- • New product areas (detection and response)
attacks in advance with security software. Thus the Secure’s strategic focus to the growing corporate • Uniform products and services
market is shifting from attack prevention business could have started earlier as the
• Services next to products
increasingly towards detecting and responding to company was still in the early 2010s investing
threats, a mindset where cyber security is seen heavily in the consumer business, for example, in
more as processes than products. This has been cloud storage. Expansion into the cloud storage
an important change for the market and F-Secure. business and selling of this business in 2015 did,
however, create clear shareholder value and
Especially on the corporate security markets focus provided the company with capital to invest in
has shifted from preventive blocking of threats to growth in corporate security.
quick detection of threats that have passedCompany description and business model 2/6
Sales, marketing and distribution channels Distribution of revenue (MEUR)
Business model 200
F-Secure is currently investing heavily in increasing
Two business areas the net sales from corporate security and the
150 95
F-Secure’s business currently comprises developing, company has clearly increased its resources in terms
98
offering and selling of corporate security products of sales and marketing in recent years. Sales and 100 96
96
marketing expenses amounted to EUR 95 million in 92 92
and services, as well as consumer security products.
The company’s basis is the stable and healthy 2018 or some 50% of net sales. 50 96
63 72
antivirus products business on top of which it is 45 46 52
F-Secure sells its corporate security products
building its current growth strategy. 0
through an extensive retailer network, which globally 2013 2014 2015 2016 2017 2018
In 2018, the company’s net sales were EUR 191 consists of over 6,000 IT service partners. The task
million and adjusted EBITDA was EUR 17,4 million. of the company’s own sales organization is to Yritystietoturva
Corporate Kuluttajatietoturva
Consumer
The share of corporate security in the company’s net support and provide services for the retailers, as well
sales was 50% and that of consumer security was as develop and grow this network in order to
Number of employees
50%. On the corporate side, company growth has accelerate the growth in corporate security products.
been strong and on the consumer side stable. Net Critical in terms of success is that selling of F- 1600 184
sales is by nature very continuous and is based on Secure’s products and related services is good
1200 437
annual licenses of various durations and, business for the retailers. The current clientele of F-
108
Secure’s cyber security products consists mainly of 131
increasingly, on monthly SaaS fees. Geographically 800 136 127 147 360
small companies but the company is shifting its focus 325
the company focuses on Europe. The share of the 366 325 279
towards medium sized and large companies with its 1045
Nordic countries in the company’s net sales was 35% 400
570 636
new security products, which requires development 437 469 500
and that of the rest of Europe was 44% in 2018. The
of the existing retailer channel. The company 0
remainder of net sales came from North America
primarily offers cyber security consultation as direct 2013 2014 2015 2016 2017 2018
(9%) and elsewhere in the world (11%). At the end of
2018, the company had 1,666 employees of whom sales through its own sales organization. S&M, ja
Myynti consultants,
markkinointi Tuotekehitys Administration
Hallinto
R&D
customer support
1045 worked in sales and marketing (includes In consumer security, a majority of net sales is
consultants and customer support), 437 in product created globally through a network that covers Geographic distribution of revenue (MEUR)
development, and 184 in administrative tasks. approximately 200 operators, which is one of the 200
The company's strategic focus in terms of growth lies company’s key strengths and competitive
in corporate security, where the market is growing advantages. F-Secure started building a sales 150
rapidly. Consumer security is, however, an important channel through operators already at the beginning
of the 2000s and its operator network is clearly the 100
pillar for F-Secure, where the company is aiming for
moderate growth in line with the market and good largest compared to other cyber security companies. 50
profitability and cash flow, which in part can be used Consumer products are also sold through many
to finance the growth investments in corporate partners operating online and retailer partners, and 0
security. The synergy between the consumer and also in the company’s own online store. 2013 2014 2015 2016 2017 2018
Nordics
Pohjoismaat Muu Eurooppa
Other Europe
corporate business derive primarily from shared
Pohjois-Amerikka
North America Muu Maailma
Other Countries
technologies.
Source: Inderes 7Partners Operations Business idea Customer segments
F-Secure offers a comprehensive
selection of cyber security solutions and
R&D Large companies Small and medium Consumers
services to both corporates and
and governments sized companies
consumers.
Sales and Products
IT service partners marketing
Prevention solutions (EPP)
• Protection Service for Business Significant product
• Business Suite area, stable growth
F-Secure Labs
research center • Cloud protection for Salesforce
➢ Solid expertise in virus prevention
➢ New products for detection and Prediction solutions
response • Radar and phishd Small product area
Resources ➢ Ability to deliver comprehensive
Telecom operators
product and service packages Detection and response
Long-term cyber solutions
➢ High value-added services
security expertise • Rapid Detection & Response (EDR) Rapidly growing,
complement the products
• Rapid Detection & Response Service important product
Cyber security (MDR) area
technology and • Countercept (MDR)
software
Go-to-market Cyber security services Significant business
Retailers Extensive retailer • Premium consultancy services for all area, strong growth
Corporate security Consumer security
network areas of cyber security
IT service partners: +200 operators
Strong brand, +6000 partners Retailers Consumer Security
Significant product
especially in Europe • Safe, Freedome, Key and Sense area, stable growth
Own online store
Cost structure (2018) 1666 employees (2018) Revenue stream (2018) Net sales 190.7 m€
Total costs -188,4 m€ (2018) Adj. EBITDA 17.4 m€ (2018)
Corporate security
Yritystietoturva 11% Pohjoismaat
Nordics
products
(tuotteet)
33% 9% 35% Muu Eurooppa
Other Europe
50% Yritystietoturva
Corporate security
(konsultointi)
services Pohjois-Amerikka
North America
Materials and Sales and Research and Administration
services marketing development 17% Kuluttajatietoturva
Consumer security 44% Muu Maailma
Other Countries
(20,6 %)* (49,8 %)* (18,7 %)* (9,6 %)*
Source: Inderes, *% of net salesCompany description and business model 3/6
Product development products that are in use produce, the more and as continuous subscriptions valid until further
efficiently it can find vulnerabilities and the better notice (SaaS). Traditionally, a majority of the total
In 2018, product development costs (EUR 36
existing products become. This is particularly true volume is fixed-term licenses whose renewal rates
million) corresponded with some 19% of net sales.
for endpoint protection products where the are a key indicator for the company. Our view is
In its product development, the company focuses
economies of scale are considerable. that the renewal rates have constantly been on a
in particular on developing the features of existing
good level. The market is, however, strongly
corporate security detection and response Corporate Security shifting towards deliveries based on continuous
products (MDR and EDR). Another key
F-Secure’s corporate security business is monthly licenses.
development target is better harmonization of the
product portfolio in order to be able to offer more comprised of product business, managed services The customer target segment for these products
comprehensive cyber security solutions to in which product and service are combined, as are small and medium sized companies and F-
customers. In consumer security, there is low well as pure service business. In 2018, product Secure’s endpoint protection products are used
pressure to increase product development business accounted for 67 % of corporate security by over 100,000 companies globally. The size
investments in endpoint protection products but net sales and consulting for 33 %. Thanks to category of annual contracts vary from hundreds
the company also invests in certain product areas replicability, the product business is highly of euros to some tens of thousands of euros.
on the consumer side (like the Sense security scalable. Managed services (MDR) are also well
scalable in the long run. Competition is tight in endpoint protection
router). F-Secure’s core technologies, especially in
products and the field is quite established. F-
detecting malware, are basically very similar both In its consulting business, the company focuses Secure’s competitors are numerous companies
in consumer and corporate security products, mainly on delivering services requiring the highest that offer antivirus software, like Symantec,
which creates a lot of synergy in product level of expertise, where the price levels for the Kaspersky, McAfee, Sophos and Trend Micro. F-
development. F-Secure’s consulting business also consultants can be really high compared to Secure’s customer base in this product group
enriches product development as F-Secure’s conventional IT service operations. The transition focuses heavily on small companies, where the
consultants can investigate security breaches that from “cyber security as a technology” towards role of the retailer is emphasized in the customer’s
have never been seen before at large companies “cyber security as a process” will in future also purchase decision. Customers’ know-how in cyber
and transfer the knowledge they gained to blur the line between products and services in F- security issues is typically low and the purchase
product development. Secure. decision is often made based on the price or the
F-Secure’s business model includes considerable Endpoint protection products (EPP) retailer partner’s recommendation. Comparisons
economies of scale and network effects on made by research institutes that test security
product development. The company’s products A majority of F-Secure’s corporate security net software also affect customers’ purchase decision
daily collect vast amounts of data from customers’ sales currently comes from selling of endpoint in this product group. F-Secure’s endpoint
online traffic that are processed with the help of AI protection products (EPP), the demand of which is protection products have performed very well in
and machine learning in order to detect malware stable and the market is growing moderately. security tests within the industry (AV-Test, AV-LAB
and security threats. With the help of processed These products represent F-Secure's core PL, V3) over the years and their ability to detect
information from this constant data stream, F- competence, virus prevention, and are an integral malware are of world class compared with the
Secure can refine its existing products and part of the company’s product portfolio. Products competition.
develop new products. The more data the are sold with annual licenses of various lengths
9Company description and business model 4/6
Rapid Detection & Response service (RDS) already managed to attract customers to RDS, e.g. requirements. The integration is a demanding and
from banking, media, energy and IT. The biggest time-consuming process, and it will not be ready
RDS is F-Secure’s first product launched in 2016
challenge in our view is that the target group for until the end of 2019 at the earliest. Countercept
to respond to the paradigm shift on the security
RDS is in the size category of large companies and RDS are currently still sold as independent
markets, where mere prevention of malware and
where F-Secure does not yet have a strong products. When the integration is complete, F-
malicious hacking is evolving into quick detection
partner and distribution network. Secure’s MDR product offering should be very
of threats that have passed the security and
competitive.
responding to them. RDS is a managed service by F-Secure’s competitors in this product category
nature (MDR, Managed Detection & Response), come mainly from USA and the main competitors F-Secure has high expectations of the MDR
where technology plays a big role. include Crowdstrike, Carbon Black, Cybereason products (RDS and Countercept), and the success
and Rapid7. According to F-Secure, it of their sales will have a significant impact on the
Sensors are installed in the customer’s IT
distinguishes itself from its competitors with its growth in corporate security due to the large scale
networks and endpoints, which collect and stream
strong technological expertise in antivirus, which of the agreements. F-Secure sees growth
data to F-Secure’s data center, where AI and
means that RDS’ detection ability of cyber-attacks opportunities in this product area for several
machine learning are used to find anomalies in the
is very good. In addition, in Europe the company years, and the company will invest significantly in
company’s data communications that could
has competitive advantage against its competitors sales in the years to come, which will burden
indicate security threats that have passed into the
in that geopolitical factors may affect the decision profitability. After the growth phase, the products
system. F-Secure’s data center monitors
making of some customers. have potential for an excellent level of profitability,
customers’ data environments 24/7 and when it
with high customer retention adding continuity to
detects a possible threat it notifies its service Countercept
revenue and the service component scaling up
partners whose job it is to react to the customer’s
Countercept became part of the F-Secure product with growth in revenue.
security alert. RDS’ sensors collect a huge amount
portfolio with the MWR acquisition, and in terms of
of data daily and the overall picture of the Radar and phishd
operating logic, it is an RDS-like targeted solution
customer’s data communications becomes clearer
for detecting and responding to threats, offered as F-Secure has two products for predicting threats;
over time. Through machine learning, the product
a managed service. In particular, Countercept’s our view is that their share of the revenue from
increasingly becomes better tailored to the
technology stands out in responding to identified corporate security is rather minor. The Radar
customer's environment and thus the customer’s
threats and in the fight against on-going targeted vulnerability management solution can help
threshold to switch to another product grows over
cyber attacks. identify vulnerabilities in the firm’s IT-environment.
time.
Radar became part of F-Secure’s offering with the
Countercept is intended for the upper end of
RDS is suitable for companies whose security nSense acquisition in 2015. Having joined the
medium-sized corporations and large customers,
requirements are high and the target customers company’s product portfolio in the MWR
and the deals are in the range of hundreds of
are companies with more than 1,000 employees. acquisition, phishd is a behaviour management
thousands of euros annually. The competitive field
The size category of the contracts is around EUR platform that can be used to prevent phishing. In
for the product is largely the same as for the RDS
one hundred thousand and for the largest the big picture, F-Secure faces large competitors
product.
customers clearly higher. RDS still has a small focusing primarily on these segments in both of
weight in the company’s business as it is a F-Secure is currently integrating RDS and these products, and the company’s main focus is
relatively new product but thanks to the large size Countercept into a single uniform MDR overall not to start competing directly against them.
of the contracts its importance in the growth of solution from which the customer can pick the 10
corporate security is considerable. F-Secure has modules they need based on their cyber securityCompany description and business model 5/6
In fact, F-Secure considers the potential of Radar about the detected anomaly to F-Secure’s MDR companies increasingly wanting more extensive
and phishd to lie in integrating these service centre where F-Secure specialists help turnkey solutions in cyber security services. The
functionalities into the company’s endpoint resolve the matter. Even though EDR is a pure scope of the consulting business also grew
protection (EPP) products. This could provide the software product per se, it also provides F-Secure significantly with the MWR acquisition, and F-
company with a competitive advantage over other with service revenue through this feature. Secure already employs more than 300
antivirus-based competitors that lack similar specialists in consulting.
F-Secure’s EDR is at the core of the company’s
capabilities in their EPP products.
corporate security growth strategy besides RDS The demand for consulting services is strong, and
Rapid Detection & Response (EDR) and Countercept. Being a new product, EDR still the growth is continuously restricted by the
accounts for a very minor share of F-Secure’s net availability of experts. F-Secure already has
In the end of 2018, F-Secure launched an
sales. If successful, the product has significant hundreds of large corporate customers covered
automated tool for detecting and responding to
growth potential, as the market for the product is by its consulting services. Consulting net sales
malicious hacking (Endpoint Detection and
still in its early stages, and the market research amounted to EUR 32 million in 2018, accounting
Response, EDR). The product is largely based on
company Gartner, for example, has estimated the for 33% of corporate security net sales. Consulting
the same technology as RDS but it does not
number of endpoints with detection and response net sales for H1/19, when the MWR acquisition was
include the service component and is scalable to
capabilities to increase many-fold in future years. fully reflected in the figures, amounted to EUR
smaller companies as well through automation.
The EDR deals start from a few thousand euros, so 23.7 million, accounting for 40% of corporate
EDR acts as an additional ability on top of there will need to be a significant number of deals security net sales. Consulting continues to be a
endpoint protection products (EPP) and on the made for this to become visible in the company’s largely project-driven business, but the company
markets this product area is integrating with figures. continuously aims to sign continuing consulting
endpoint protection products. F-Secure has agreements with its customers.
Also in this product category, F-Secure faces
designed its EDR product so that it is also
competition on a wide front, as nearly all In the company’s largest market areas in the
compatible with the endpoint protection products
competitors that offer endpoint protection consulting business (United Kingdom and the
of its competitors. This distinguishes F-Secure in
products have EDR capability, in addition to which, Nordic countries), operations are already
the competition and makes it easier to sell the
the developing and rapidly growing market developed partially with a focus on profitability,
product to parties that are not using F-Secure’s
constantly attracts new players. The weakness we but in smaller markets, operations are still clearly
endpoint protection software.
see is that the company is only entering the EDR in a pure phase of growth, which burdens
The operating principle of EDR is very similar to competition this year with a slight handicap to its profitability.
that of RDS, but when the product detects an competitors.
The focus of F-Secure’s consulting lies in the most
anomaly in a company’s network, the company’s
Cyber security services demanding security problems and the strategic
head of IT is automatically informed of it. The
goal is not to expand its service business to
product also provides the head of IT with F-Secure provides large corporations and other
compete with regular IT service companies, even
operating instructions for responding to the cyber parties with critical IT systems with cyber security
if the company’s service offering is sometimes
security threat. The product is suitable for consulting in all areas of cyber security. The focus
overlapping with these. More extensive cyber
companies of all sizes, but SMEs are the main of F-Secure’s consulting business is on the most
security service packages are offered by
target group. The product also allows the end demanding cyber security issues, but the service
consultancy companies (like KPMG), IT generalists
customer or resale partner to send information range has expanded in recent years, with 11
(like CGI) and specialized players (like Nixu).Company description and business model 6/6
The services offered by the company include growing but we estimate that their effect on the operators already at the beginning of the 2000s
cyber security audits, cyber security stress tests net sales of consumer security is still low and its operator network is clearly the largest
(Red Teaming), strategic risk and cyber security compared to Safe. An increasing number of compared to other security companies. In
management, cyber security in software customer are, however, switching to the consumer security, operators sell F-Secure’s
development and responding to hacking and data combination solution Total that includes both Safe products as part of their own continuous cyber
leaks. F-Secure’s ability to offer consulting and Freedome when renewing their order. This security packages. Through the operator channel,
services offers the company a competitive product bundling is a key growth driver for F-Secure receives extensive distribution and
advantage against players who only offer cyber consumer security sales. volume for its products, and, thus, the replicability
security products. In addition, consulting offers and scalability of the products enable good
Launched in June 2017, Sense has not had a
cross-selling possibilities with the products. profitability even though the operators take a
significant impact on consumer security net sales
Consulting also polishes F-Secure’s brand rather large share of the gross sales of the
for 2017-2018; however, the company sees
towards a more comprehensive cyber security products as they are responsible for the lion’s
growing interest in the product, with smart devices
company. share of product marketing. For operators, co-
becoming increasingly common in homes.
operation with F-Secure is also fruitful as by
Consumer security Nevertheless, the expectations for the product are
offering cyber security packages in connection
still very cautious, because the market for the
Products with broadband subscriptions operators have, in
product is in its early stages. The most potential
addition to profitable additional sales, been able
F-Secure offers cyber security products for route for more extensive commercial distribution
to improve the customer loyalty and satisfaction of
consumers through a network of more than 200 of Sense is offering Sense as a software that can
their subscriptions. In our opinion, the success of
operators. Consumer products are also sold be installed in third-party routers. In late 2018, the
F-Secure’s product among operators is based on
through many partners operating online and company signed the first agreements with
the fact that it solves two of the core problems of
retailer partners, and also in the company’s own operators in this area. However, Sense is not going
the operator business (average price and
online store. The company’s products are used by to be a driver of net sales growth in the short term,
customer churn).
millions of consumer customers across the world. but if it succeeds, it will offer obvious growth
The main products in the company’s current potential in the consumer security segment in the Direct sales channel
product portfolio are: long term.
Consumer products are also sold through many
• Endpoint protection product, F-Secure Safe F-Secure’s competitors in consumer EPP products retailers operating physically and online. In
are largely comprised of the same companies as addition, the company is increasingly selling its
• Privacy protection product (VPN), F-Secure in the corporate segment, as the product products through its own online store, which
Freedom technologies are very similar. Competition in means there are no middlemen between F-
• Password management product, F-Secure Key consumer endpoint protection products is made Secure and the end customer. The competition on
tighter by the fact that there are also several free the market is extremely tough and customer
• Cyber security router that protects all smart antivirus software products available to acquisition requires considerable marketing
equipment in the home, F-Secure Sense consumers (e.g. Avast, Avira, Windows Defender). investments, and various free products and
A majority of net sales in consumer security freemium models make the consumer market
Operator channel
comes from selling endpoint protection products challenging to reach through direct sales.
(Safe). The sales of Freedome and Key has been F-Secure started building a sales channel through 12F-Secure’s business model
Shared technology and product development
Analytics and
Threat Research Lab Managed services
monitoring platform
Consumer security Products Corporate security Services
50% of net sales 2018 33 % of net sales 2018 17 % of net sales 2018
Privacy protection (F-Secure Freedome) Endpoint protection (EPP)
Endpoint protection (F-Secure Safe) Endpoint detection and response (EDR)
Password management (F-Secure Key)
Prediction solutions (Radar, phishd)
Cyber security router (F-Secure Sense)
Managed detection and response
(RDS and Countercept)
Threat detection
Retailers and online and sensor data
IT integrators/direct
Operators Retailers IT service partners from millions of
store sales (services)
products in use
Consumers Consumers Small Medium sized Large
businesses (200-5,000) businesses
(25-200) (>5,000)
Product sales Product sales Product and service Product and service
Product sales
(retail sales/revenue sales sales
sharing with operators)
Source: Inderes 13Investment profile
Growth in corporate security creates value Currently, the stock market appreciates growth resources for expanding F-Secure’s core
rate very much and it is considered to be a key competence and technology to new segments
F-Secure is difficult for an investor to perceive in
value driver, as the cyber security market is found and sell new solutions to the existing customer
the company’s current development phase, as the
to be on the threshold of strong growth and it is base.
share combines steady cash flow business
important for the players to lay a foundation for
(consumers) and cash flow-negative business Key risks
the market.
(corporate customers) still strongly in the
• The sector is potentially over-invested, which
investment phase, and the company does not Strengths and drivers
may lead to a significant increase in
report on the segment distribution with regard to
According to our view, the key positive value competition in the next couple of years. A gold
the profitability of these functions. In practice, the
drivers of F-Secure are: rush of new companies may lead to there not
first is priced in the stock market through
being enough bread for all to share, in spite of
earnings-based multiples and profit margin. The • Growth in MDR/EDR products is at the core of
the strongly growing market.
latter is priced based on sales multiple and value creation, as the market for these
revenue growth rate. In addition, corporate products is still in its early stages, it is growing • Decrease of the high valuation levels of the
security is comprised of three businesses different at a very fast rate and market shares are now sector would probably also have a negative
in terms of profile and development phase: EPP being distributed. Companies operating in impact on the market valuation of the F-Secure
products (slow growth, good profitability), these rapidly growing product areas are share.
consulting (good growth, mediocre profitability) occasionally priced using very high valuation
• Threat of competition in consumer security
and MDR/EDR products (very strong growth, loss- multiples.
and poor net sales growth due to free
making). These product/service areas have to be
• A scalable business model with strong antivirus software. In spite of these threats,
priced using very different valuation multiples due
customer retention allows for excellent which have been evident for years, consumer
to the different growth, scalability and profitability
profitability after a successful current security seems to remain a very healthy
profiles. The company is therefore not a pure
investment phase of the company. business.
growth company, but also not a technology
company in the “mature phase”. • Success in unifying the product portfolio • Sales channels in corporate security to the
would facilitate the company’s transition in the SME market are still in the making. Without
F-Secure’s own goal is to continuously balance
value chain towards larger customers and suitable partners, it will be challenging for the
between growth investments and profitability,
accelerate the growth in corporate security. A company to reach its growth goals.
depending on what is optimal in terms of
more unified product portfolio would also
shareholder value. We find the approach • The transformation into a cyber security
provide the company with a competitive
reasonable, but difficult for shareholders to company is still partly in progress. The
advantage.
interpret. The share cannot be priced directly transformation still requires the company to
using an individual method or valuation multiple; • New product areas, such as the consumer develop its product portfolio, integration of the
value creation must be considered as part of a Sense cyber security router, can provide the MWR acquisition, harmonisation and
bigger picture. To our minds, the key drivers of the company with significant scalable growth investments in sales, which will burden
company’s value creation are the growth rate (of potential in the long term. profitability in the short term. Moreover, as a
corporate security) and the entire company’s brand, F-Secure is not yet perceived as a
• A strong and established position in endpoint
operating margin; a strong growth rate corporate security solutions provider. 14
protection provides the company with good
compensates for poor profitability and vice versa.Investment profile
Strong growth focus in corporate Potential
1. security
• In corporate security, strong growth now generates
shareholder value
• Accelerating growth and competitive edge through
2. Hot and growing market
renewal and integration of product portfolio
• Strong demand outlook on the market
• Strong and stable business in consumer security
Scalable and continuous business
3. model
Transformation into a cyber security Risks
4. company still partly ongoing
• The industry is potentially over invested, which can lead
to a clear increase in competition in the next few years
• Failure with growth investments
5. Strong cash flow provides capacity to
• Failure with MWR Infosecurity integration
invest in corporate security growth
• Dissolving of the high valuation levels in the sector could
have a negative effect on the share
• Competitive threat in consumer security and weak
growth
Source: Inderes 15Risk profile of the business model
Estimate of the overall risk level of F-
Secure’s business
ENVIRONMNET
Change rate of Technologies and threats are changing at
OPERATING
1 a rapid rate in the cyber security market.
the industry
1
Development A lot of mature products, the strategy is
phase of the still in the investment phase with regard to
1 the new MDR and EDR products and
company cyber security services.
Market Strong demand drivers on the market
NET SALES
cyclicity 2 but tight competition.
2
Net sales Net sales are continuous by nature, based
continuity 2 on annual licences of varying lengths and
monthly SaaS fees. The customer base is
extensively distributed.
The cost structure is primarily fixed, room for
CAPITAL STRUCTURE PROFITABILITY
Scalability of
3 flexibility in the cost structure by adjusting
costs sales investments
Strategy aims at strong growth at the
Cost structure 3 expense of short-term result.
Capital Operations tie a little capital and
4
4 commitment working capital is negative.
Balance sheet is in good condition and
Financing need 4 the amount of debt is moderate in spite
of the large MWR-acquisition.
Low risk level High risk level
Source: Inderes 16Industry 1/4
Market pyramid model based on the intelligence of new digital businesses and 2) the rising trends on
attacks and technologies. The intelligence of the IT markets (industrial Internet of things, social
Market definition, size and growth attacks and technologies also broadly correlates media, digital commerce) force organizations to
Cyber security companies are solving one of the with the size of the customer organizations as the pay more attention to cyber security. In the
biggest problems of the digitizing society. Big biggest organizations and state administration are segment of targeted attacks (large and medium
problems always also means big business typically the main targets of cyber criminals. For sized organizations), cyber security cannot be
opportunities, which makes the market extremely organizations at the top of the hierarchy, solutions solved only with mass solutions. The information
interesting, dynamic and rapidly growing. that have been created for the masses at the security budgets of companies in this segment are
bottom of the hierarchy do not offer sufficient annually roughly around EUR 1 to 5 million, which
Cyber security refers to processes, technologies, protection levels. Correspondingly, the solutions makes this segment attractive to companies that
solutions and services that protect companies’ focusing on the top levels of the hierarchy are too offer cyber security products and services. F-
and other organizations’ or individual users’ data expensive for organizations whose activities do Secure has expanded into this segment in recent
against criminality that occurs in electronic not require a high protection level. The years through acquisitions (consulting service) and
networks. Cyber threats can be divided into three development of new technology focuses on the a wider product portfolio (e.g. RDS).
categories: 1) criminality that aims at financial more demanding top level segments after which
profit, 2) hacking that aims at disrupting The most important segment for F-Secure at the
the technology is duplicated to the lower levels for
companies’ or governments’ activities, and 3) moment is the lowest level of the triangle that
broader segments.
spying that aims at gaining a competitive business includes small and medium sized companies and
advantage or discovering government security The top of the cyber security market is consumers. For small companies and consumers,
secrets. The number of cyber threats and their represented by state espionage and the defense the main thing is to be protected against mass
intelligence is constantly growing and the market industry. This is a niche market from the viewpoint attacks, which can be done with regular “off the
is, in practice, driven by an endless race between of cyber security companies but it represents the shelf” cyber security products like endpoint
criminals and cyber security technologies and highest technology and level of expertise and is protection products and firewalls. A majority of F-
processes. thus important. The largest volume of the market Secure’s net sales still comes from endpoint
is found in the center part of the pyramid that protection products.
The cyber security market develops quickly and covers targeted attacks. In this case, the primary
the estimates on the total market size and growth Among medium sized companies the need for
target group is in practice all large organizations
vary dramatically. The market research company higher cyber security than mere endpoint
and public administration, and in particular the
Gartner (8/2018) estimates that the global size of protection is growing, but the cyber security
actors whose activities include critical activities in
the cyber security market will be USD 124 billion in budgets (EUR 0.1 to 1.0 million) are clearly lower
terms of security of supply (like energy, banks and
2019 (+9% growth). In general market is expected than in the large company segment, which means
operators). Crucial in this target group is that its
to grow at an average annual rate of 10% in that buying of the best technologies or
size is constantly growing as cyber security
coming years. managed/outsourced cyber security services is
threats expand, which also expands the market
not necessarily possible. Especially the rapid
Market segments for demanding cyber security solutions.
detection and responding to threats that have
The target groups of the cyber security market In the big picture, market growth is the result of 1) passed endpoint protection is now emphasized in
can be roughly divided into three parts in a cyber security issues playing an important role for the segment of medium sized companies.
an increasing number of industries when planning 17Industry
Distribution and operating logic of the cyber security
Market drivers
market
Digitalization Regulation
R&D focus on highest level
technologies
Cyber security State
consulting espionage
Digital commerce
Duplication of technology Industrial Internet of
EU's Data
to larger markets things
Protection
Open systems
Detection and response to Cloud Regulation
evolved attacks (RDS, Mobility
Countercept and EDR)
Targeted attacks
Vulnerability management (Radar Large companies and organizations,
and phishd) public administration
Risk-based Forced
purchasing purchasing
Mass solutions
(endpoint
Mass attacks
protection)
Medium sized companies Complexity and change rate as growth drivers
for cyber security products, expert services and
Small companies and consumers outsourced cyber security
Market size / number of buyers
Source: Inderes 18Industry 2/4
Market sub-segments for F-Secure and response capabilities as a managed service Weights, size and annual growth rate
(such as F-Secure’s RDS), but for smaller of F-Secure’s market segments
F-Secure’s potential market can be examined
companies in particular, a pure product solution is
more closely through the company’s product and
the only reasonable solution in terms of costs.
service selection. According to Gartner, the
Gartner estimates that the share of endpoints with
market for consumer security products was USD $6.6 bn.
EDR products of all endpoints will increase from
6.6 billion in 2017 and it is expected to grow at an Consumer security
10% in 2017 to 35% by 2020. F-Secure launched
average annual rate of 4% in 2016 to 2022. The →Significant product area 4%
its new product for the EDR market in late 2018,
slow growth on the consumer security market is
and the product will play an important role in
explained by the popularity of constantly evolving
terms of the company’s growth in the years to
free antivirus solutions (e.g. Windows Defender) Endpoint protection (EPP) and
come.
but growing product areas can be found, for Endpoint detection and $5.0 bn.
example, in privacy protection (VPN solutions) and The market for managed detection and response response (EDR) products for
companies
in solutions designed to protect smart equipment services (MDR) is also only shaping up, and
→ EPP: Significant product area
6%
in the home. estimates of the size and growth of the market are
→ EDR: New, important product
only indicative. MarketsandMarkets has estimated area
The market growth of corporate endpoint
the size of the MDR market to be approximately
protection (EPP) products is slow but steady. At
USD 0.4 billion, and it is estimated to grow at a
the same time, the EPP market is undergoing a Managed detection and $0.4 bn.
very strong annual rate of some 32% in 2017–
transformation with new automated threat response (MDR)
2022. F-Secure’s RDS and Countercept operate in → New, important product
detection and response products (EDR) unifying 32 %
this rapidly growing market. area
with EPP products. Gartner, for example, already
bundles these products in the same category and The size of the market outsourced cyber security
estimates the value of the entire EPP/EDR market services is, according to Gartner’s estimate,
to be approximately USD 5 billion. We estimate approximately USD 19 billion, and the market is
Vulnerability
$0.9 bn.
that EDR products still account for clearly under expected to grow by approximately 10% annually management
USD 1 billion of this. Thanks to the strong growth in 2016–2022. →Small product area 7%
in EDR products, the overall market for these
Gartner has estimated the size of the vulnerability
products is expected to grow by approximately
management market to be approximately USD
6% annually in 2016–2022. The growth is driven
0.9 billion, and it is estimated to grow by some 7%
by the fact that cyber attacks or data breaches $19.0 bn.
annually in 2016–2022. Cyber security services
against companies are not often detected for
→Important, growing area
months, and this has shifted the focus from merely 10 %
proactively protecting against cyber attacks
towards detecting and responding to them more
quickly. Large companies can purchase detection
Source: Gartner, MarketsandMarkets, Inderes 19Industry 3/4
Market drivers digital service or product. This means that EU's Data Protection Regulation
problems related to cyber security cannot be
In our opinion, the cyber security market is still EU's Data Protection Regulation (GDPR), that
solved simply by acquiring cyber security software
emerging and will develop strongly over the next entered into force in May 2018, has clearly
and equipment off the shelf but solving of cyber
few years, which is why current market estimates increased the demand for cyber security services.
security also requires the use of high-level
are even at best only indicative. Market growth The regulation imposes new obligations on
expertise services. Due to these market drivers, F-
will probably be steady and strong and accelerate organizations that handle personal data. Through
Secure’s business has also been in turmoil in
pushed by digitalization investments. In addition, EU's Data Protection Regulation organizations are,
recent years where the company is transforming
constant news of serious hacking (risk-based for example, obliged to report any breach of
from an endpoint focused antivirus company to a
purchasing) and pressure created by regulations security. The authority that supervises the
more versatile provider of cyber security products
(forced purchasing) will boost market growth. At regulation can impose sanctions if the regulation
and services in the corporate segment.
the top level, growth is, in practice, driven by two is breached. The sanctions can be massive, as for
forces: regulation and threat scenarios. Consumer security changing more serious breaches the fine is EUR 20 million
or 4% of the company's annual net sales, which is
The commonly recognized mega trends in the IT In consumer security, the changing endpoint
intended to make companies take the new
world like mobility, cloud, industrial Internet of portfolio has been visible as a slight drop in
regulation seriously. At the same time, the
things, social media and digital commerce are antivirus software for PCs but, as a whole, the
monetary definition of the sanctions provide cyber
strongly linked with cyber security. In many of number of devices connected to the web is
criminals with a price tag, which they can use to
these areas, the barrier for creating new growing rapidly in consumers’ homes. This
blackmail companies after a successful hacking
applications, products and digital services is provides growth opportunities for new cyber
operation. GDPR also supports F-Secure’s product
information security challenges. These challenges security products that protect smart devices in the
business as the regulation means that companies
are related, for example, to privacy protection, e- home even though PC driven antivirus software
have to build better capabilities to detect realized
commerce or security. One mega trend worth sales is a challenging market. In consumer
security breaches
mentioning is also open systems (like Android) security, the nature of the market is changing
becoming more common. This makes the market rather than the market faltering with PC antivirus.
more attractive from a criminal’s viewpoint than For example, Windows’ own cyber security is
when companies still operated mainly in their own cannibalizing conventional cyber security but this
individual closed environments. does not solve the consumer’s problem of how to
protect several different endpoints. Thus, there is
Building of new digital services requires that
a natural need for F-Secure’s packages for
companies and governments solve the challenges
comprehensive consumer solutions as the array of
related to cyber security in advance. This means
endpoints and operating systems is vast and
that the demand for cyber security related
constantly changing. Gartner estimates that the
products and services is also supported by the
number of consumer devices connected to the
fact that cyber security is increasingly becoming a
web will grow from 5.2 billion in 2017 to 12.8 billion
critical and integral part of any new IT system,
by 2020.
20You can also read
