With Imperva, Thales enters the global Top-5 in cybersecurity

The affair was carried out smoothly. Thales announced this Monday morning that it had completed the acquisition of the Californian gem Imperva, one of the American champions of cybersecurity. Just five months after announcing that it had reached an agreement with its owner, the Thoma Bravo investment fund. The transaction, worth $3.4 billion, is being paid 50% in cash and 50% via a bond issue. It was signed this weekend.

The French defense and high-tech group has obtained all the green lights from the competition authorities as well as from Cifus, the Committee on Foreign Investment in the United States. The latter did not require Imperva to be placed “under proxy”, that is to say under American control, notably with administrators chosen by Washington. “The transaction, which is a 100% takeover of Imperva, was completed quickly, without a proxy, which shows that Thales’ reputation is well established. Our company is known and respected in the United States where it has long participated in confidential defense programs but also delivers, for example, identity documents to 18 American states,” underlines Patrice Caine, CEO of Thales, in an interview at Figaro.

With this acquisition, Thales takes on a new dimension in the field of cybersecurity. It becomes a “world-class” leader, integrating the Top 5 international cyber sector, with 2.4 billion turnover and 8,000 employees, including 5,600 cyber experts. Created in 2002, the Californian company is a “rare and quality” asset, in a very fragmented market, valued at 136 billion in 2022 and 267 billion in 2026 by Accenture and the Gartner Group. Imperva has double-digit growth potential and generates strong profitability (Ebit) of around 20%.

The company, whose name derives from the Latin "impervius", meaning "impenetrable", is a leader in data security, security of critical applications (firewalls) and APIs (the software building blocks used to create applications), with solutions to protect them from denial of service attacks and malicious “bots”, these programs which carry out attacks on the internet. So many specialties complementary to those of Thales in software and encryption, encryption keys and security modules. Imperva also brings its engineering centers in the United States (58% of its sales), Canada, India and Israel and a portfolio of 6,000 large customers in 180 countries. A complementarity which should generate $110 million in recurring synergies from 2028.

Imperva will be integrated into Thales' identity and security division (DIS), which will oversee all of the group's civil cyber activities. DIS must also integrate the Australian cyber gem Tesserent, the acquisition of which was announced in mid-June. From the start of 2024, Thales will simplify the organization of its cyber activity. It plans to transfer to DIS its 11 cyber supervision centers (active monitoring, identification of hacker signatures, security tests and solutions to counter cyberattacks, etc.), currently housed in its defense and security division. On the other hand, military cyber activities will remain in the defense branch.

In just under ten years, Thales has become a global player in cyber, an activity which was worth around 350 million in 2014. This is done by playing the dual card of organic growth and targeted acquisitions. Before Imperva, the most structuring strategic move since the acquisition of the former Gemalto (renamed DIS) for 4.8 billion euros in 2019, the group bought eight cyber nuggets, including Vormetric in the United States, S21Sec, Excellium and OneWelcome in Europe and Tesserent in Australia. This strike force offers Thales the opportunity to simplify its offering with integrated products and solutions, with an Artificial Intelligence (AI) component. “Information systems security managers may have to deal with around thirty, or even fifty, cyber service providers and seek to reduce their number thanks to products covering a broader spectrum,” notes Patrice Caine.

This, while the cyber threat is growing exponentially. Since January 2023, the company Imperva alone has blocked 40 billion cyberattacks per month launched against applications on the web. Attacks which also take new forms with the use of AI and generative AI (ChatGPT in particular) by cyber-criminals. The global cost of these cyber attacks will be around $10,000 billion in the coming years, according to a study by McKinsey.

The acquisition of Imperva (500 million sales, 1,400 employees) also strengthens Thales' footprint in the United States, where the group is present in 22 states, and, more broadly in North America, which will generate nearly 4 billion euros in revenue, with 6,200 employees, from 2024. The region becomes Thales' second market, after France. With Imperva, Thales becomes the cybersecurity partner of 35% of the largest American companies, listed in the “Fortune 100” ranking. Whether in the financial sector with JP Morgan in particular, in telecommunications with for example Verizon, services or even health.

In recent years, the group's rise in power across the Atlantic is also reflected in its free float (45.21% of its capital) on the stock market. “American investors know Thales better and better, which has become a sought-after stock. From now on, nearly 50% of our floating capital is held by North American investors,” explains Patrice Caine.

Thales has deployed itself in all its businesses across the Atlantic, from defense to cybersecurity, including identity, aeronautics and space. In this last area, Thales wants to strengthen itself. Certainly, via Thales Alenia Space, its joint subsidiary with the Italian Leonardo, Thales sells satellites to telecoms operators and participates in Artemis, via the European Space Agency's contribution to NASA's return to the Moon program. But Thales has undertaken several space projects in the United States. It notably responded to the call for tenders launched by the telecoms satellite operator Intelsat, for its medium orbit constellation project.