Analysis

April 26, 2021

Darktrace deep dive: a risky IPO?

Darktrace have filed to IPO. Sifted's innovation editor and product analyst look at the risks investors should be weighing up.


Geoff Pugh

When investors consider whether to buy into Darktrace’s planned listing on the London Stock Exchange — at an expected valuation of up to £2.7bn — they should be weighing up two potential risk factors for the company: Mike Lynch and unit economics.

Despite filing to IPO only last week, Darktrace has already chopped and changed its expected floatation price, according to reports. Its first rumoured valuation was up to £3.6bn, which has since been cut by more than 25% to between £2.4-£2.7bn.

Ties to Mike Lynch

The first risk has so far attracted most of the attention. The close relationship between Darktrace and tech billionaire Mike Lynch became apparent in the listing documents released by the company earlier this month. Invoke Capital, Lynch’s VC fund, financed Darktrace in its first two years of existence and shared office space with Darktrace, and Lynch was a board director until 2018 — he remains a member of Darktrace’s scientific board. CEO Poppy Gustafsson and several other Darktrace senior managers are former employees of Autonomy, the tech company founded by Lynch.  

Advertisement

Lynch, who is fighting extradition to the US over fraud charges that Autonomy’s revenues were inflated by $700m before its 2011 acquisition by Hewlett Packard, owns 18.55% of Darktrace together with his wife, according to company filings. At the time, the £7.4bn purchase of Autonomy was the largest AI exit ever.

Darktrace warned last week in its IPO prospectus that it might face both reputational damage from the association with Lynch, and that it could also face money laundering charges because of its initial funding by Invoke, as Invoke was set up with money that Lynch received from the sale of Autonomy. However, the company said it considered this risk to be low.

Lynch has vigorously denied any charges of wrongdoing over the sale of Autonomy. But with the verdict expected next month in his extradition case — just as the IPO goes ahead — the association is bound to be distracting.

Unit economics

The other warning potential investors should consider is whether the strength of the underlying business justifies the potential £2.7bn price tag.

Darktrace has yet to make a profit, warning in its prospectus that: “The Group has incurred losses each year since inception.... and may never achieve or maintain profitability.” 

Even as revenues have increased from $79.4m in 2018 to $199m in the year to June 2020, net losses have widened from $28.7m in 2018 to $42.5m in 2020. Of course, making a loss is no rarity for a fast-growing tech company; listing registration documents are often studded with these kinds of caveats on never making a profit — and there are some one-off costs in there for 2020 related to a change in the shareholding structure of Darktrace. 

Sales at any cost?

One ongoing issue for Darktrace being flagged by some, however, is the high costs of sales and marketing. Sales and marketing costs for the year to June 2020 were $163m — around 81% of sales.  Darktrace has a reputation in some areas for aggressive sales — IT managers on a Reddit group discussing Darktrace, for example, reported being offered 30-40% discounts in order to seal the deal. 

Compared to peers such as Crowdstrike, the sales and marketing spend is relatively high. In the year to January 31, 2021, Crowdstrike had sales of $874.4m and sales and marketing costs of $401.3m — 46% of sales. Palo Alto Network’s sales and marketing costs are around 42% of sales. 

Darktrace’s PR company told Sifted the company was focusing on growing aggressively to make the most of a leading position in the market. Such costs might come down over time. 

It is also true that all revenue is not created equal, and one factor in Darktrace’s favour is that it monetises through subscriptions. Subscription revenue is sticky — if your product does what it says on the tin, there is little reason for a customer to churn — and is accordingly venerated by investors. 

Advertisement

Flogging upgrades and cross-selling additional products helps to recoup marketing and sales costs. According to Darktrace's filing, "81% of customers in the six months ended 31 December 2020” purchased two or more products, “up from 27% in the financial year ended 30 June 2018". 

The dream is to achieve net revenue retention (NRR) of more than 100%, meaning that a subscription company can grow revenues even without acquiring new customers. Put simply, upsells and renewals outweigh any customer churn.

To put the power of this into perspective, at 110% NRR your revenue doubles in eight years even without any new customers; at 120% it doubles in five years; and at 150%, like US software company Snowflake, it doubles in only three years. 

But Darktrace's net retention rate has dipped from 101% in 2019 to 98% in 2020. Compared to SaaS companies which listed in 2020, that puts Darktrace at the bottom of the pack — according to data from Meritech Capital.

Analysts at Numis also raised questions about the company’s churn rate. Darktrace reported a churn rate of 7-8% but Will Wallis, head of research at Numis, questioned the metrics and estimated the underlying gross annual churn to be double that at 14-15%. Darktrace told Sifted via its PR company that it questioned some of the assumptions on which Numis was basing its calculations. In any case, the company said, churn was a “rather narrow issue” to focus on.

Darktrace has some 4.7k customers globally — so clearly it must be doing something right. Still, competing AI-backed cybersecurity products are coming onto the market from companies like CrowdStrike, Vectra.ai, ExtraHop, IronNet and Deep Instinct. 

Can Darktrace keep up with the security market?

“It isn’t quite the plain sailing it was for Darktrace in the beginning. It is a busier market,” says Rik Turner, principal analyst of the cybersecurity team at research group Omdia.

Darktrace faces increasing pressure to make sure it keeps up with changing trends in cybersecurity. When Darktrace launched in 2013 it was a pioneer in the field of AI-assisted attack detection, and when it launched Antigena, a partially automated defence against attackers in 2017, it was ahead of the rest of the market. 

But Darktrace’s sweet spot is in network defence — monitoring a company’s in-house computer systems against incursions. Now, however, with companies moving much of their information onto the cloud and employees working from home, there is a need for tools that detect attacks on endpoints like laptops, and tools that monitor for cloud attacks. 

Competitors such as CrowdStrike specialise in endpoint security, and VMWare, the cloud computing company which is being spun out of Dell, bought Carbon Black and more recently Mesh7 to build up both cloud and endpoint cybersecurity capabilities. 

Younger competitors like Israeli-based Deep Instinct are also now applying more sophisticated, deep learning techniques to cybersecurity. Deep Instinct can detect and defend against attacks in milliseconds, rather than in minutes, it says.

“The degree to which Darktrace can move into endpoint and cloud security will determine how they go in the market. They have built quite a slick sales and marketing operation in one area, but they may be running out of road there and will need to develop into other areas in order to be relevant going forward,” says Turner. “It is to be hoped that they will plough some of the money from the IPO into this.”    

The trouble is that Darktrace has a relatively small R&D team. Of its 1,440 employees, nearly 1k are in sales, and only 205 are in research and development, according to its filing. Darktrace spent $12m — or around 6% of revenues — on R&D in the year to June 2020. 

The London stock market is in desperate need of a successful tech IPO after the recent disappointment of Deliveroo. All the more reason for would-be investors to do their homework well on Darktrace.

Who’s set to cash in?

American growth equity firm Summit Partners is set to be the biggest winner from Darktrace's listing, with a 21.99% stake valued at £593.7m. 

Michael Lynch and his wife Angela Bacares, who we expect to be acting in concert, are due the second biggest payday at £500.8m, followed by private equity firms KKR (£319.9m) and Vitruvian Partners (£143.3m).

Despite being a spinout from Cambridge University, there is no evidence that they currently own any shares in Darktrace. 

Maija Palmer is Sifted’s innovation editor. She covers deeptech and corporate innovation, and tweets from @maijapalmer

 Bill Leaver is Sifted’s analyst. He tweets from @billeaver_