F5 Networks will pay approximately $1 billion to acquire Shape Security, a Santa Clara, Calif.-based company that sells a fraud prevention platform to banks, airlines, retailers, government agencies, and more.
The acquisition, announced Thursday, will help F5 bolster its application protection services. It’s the largest acquisition to date for Seattle-based F5, which paid $670 million to buy popular web server technology NGINX earlier this year.
“Beyond opening a fast-growing $4 billion adjacent market, Shape’s machine learning and AI-powered capabilities will scale and extend F5’s broad portfolio of application services and expand our ability to optimize and protect customers’ applications in an increasingly complex multi-cloud world,” F5 President and CEO François Locoh-Donou said in a statement.
Shape recently reached a $1 billion valuation after raising a $51 million Series F round in September. The 8-year-old company raised $183 million from backers including C5 Capital, Kleiner Perkins, GV, HPE Growth, Norwest Venture Partners, Wing Venture Partners, and others.
Shape says it mitigates more than 1 billion fake transactions daily. It has $70 million in annual recurring revenue. Customers include nine Fortune 50 customers; eight of the top 12 U.S. banks; five of the top 10 global airlines; and five of the top 10 credit card issuers.
“When you combine F5 and NGINX’s expertise powering over half of the world’s applications across all types of environments, with Shape’s insight from mitigating 1 billion application attacks per day, you have a company that knows how to secure more applications – and more value – than any company in the industry,” Locoh-Donou wrote in an email to employees today. “We believe that makes F5-NGINX-Shape absolutely essential to every digital organization in the world.”
F5 estimates that the acquisition will boost its software revenue growth from 35-to-40 percent to 60-to-70 percent next year. It expects to achieve breakeven non-GAAP EPS within 24 months of closing the acquisition. The company is using cash and a $400 million loan to fund the purchase.
The deal is subject to regulatory approval and is expected to close in the first quarter of 2020.
“Since Shape’s inception, we observed a consistent pattern in customer after customer: the use of F5 technology to deliver and enable their applications,” Derek Smith, co-founder and CEO of Shape, said in a statement. “Now, we look forward to the opportunity to deeply integrate into F5’s platform for application delivery and security — F5 provides the optimum traffic flow insertion point for Shape’s industry-leading online fraud and abuse prevention solutions.”
Shape plans to retain its Silicon Valley headquarters as Smith and its 375-person team will join F5, which had 5,325 employees as of Sept. 30.
Smith previously started iEngineer, which was acquired by Oracle, and Oakley Networks, which was acquired by Raytheon. He was a senior advisory for cyber policy at the Department of Defense before launching Shape Security with co-founders Sumit Agarwal and Justin Call.
Founded in Seattle more than 23 years ago, F5 is valued at nearly $9 billion and is one of the region’s major employers but flies under the radar thanks in part to the behind-the-scenes technical nature of its work.
The company is in the midst of years-long transition from making hardware to serve customers running data centers to focusing on software for customers running on public cloud infrastructure from providers like Amazon, Microsoft and Google.
“By laying out our vision to become the leader in Multi-Cloud Application Services back in 2017, we have been taking deliberate and disciplined steps to realize our future identity,” Locoh-Donou wrote in the email. “We know what it will take to win; and make no mistake, we are playing offense.”
Earlier this week F5 said it had taken steps to ensure the security of the master software builds for NGINX after Russian law enforcement officials visited the Moscow offices of NGINX on Dec. 12 with a warrant in connection with an intellectual property dispute.
F5 recently moved into a new 48-story office tower in downtown Seattle. The company’s stock is down slightly this year, trading at $143.69/share on Thursday.
Read Locoh-Donou’s full email to staff below.
From: François Locoh-Donou
To: F5 Staff
Date: December 19, 2019
Subject: F5 to Acquire Shape SecurityI could not be more pleased to announce that we have signed an agreement today to acquire Shape Security, a leader in providing application security against fraud and abuse.
Our long-standing belief that applications are the most valuable assets of any organization in the digital age has been the foundation of our strategy to become the leader in Multi-Cloud Application Services. When you combine F5 and NGINX’s expertise powering over half of the world’s applications across all types of environments, with Shape’s insight from mitigating 1 billion application attacks per day, you have a company that knows how to secure more applications – and more value – than any company in the industry. We believe that makes F5-NGINX-Shape absolutely essential to every digital organization in the world.
This defiant stance was borne out of F5’s pioneering approach to application security. The work we have done to protect the world’s largest enterprises, service providers, governments, and consumer brands from application-layer attacks is unparalleled. We are trusted by our customers the world over to deliver the most high-performing and secure digital experiences. And, unlike other companies, we protect their valuable applications across any environment – not tied to a single cloud, not tied to a single vendor’s stack, and not tied to hardware.
But as automation has increased, so too have the application-layer attacks on our customers. Cybercriminals are weaponizing attacks on an unprecedented scale, using automation in everything from cheap, global ‘botnets’ to launching highly sophisticated, targeted strikes. These exploits defraud organizations of billions of dollars with fake accounts, unauthorized fund transfers or chargebacks, credit application fraud, and stolen loyalty points or gift cards. Shape is currently protecting the top Global 2000 banks, retailers and travel companies from 1 billion of such automated attacks against applications a day, as well as protecting 150 million legitimate, human transactions a day with the applications that these companies rely on most to deliver their best customer experience. Shape’s code base includes some of the most sophisticated Artificial Intelligence (AI) and cloud-based analytics intellectual property in the business to detect, flag and mitigate unwanted and malicious online traffic, learn from previous attacks and prevent the next ones.
Bringing together F5 and NGINX’s application expertise across multi-cloud environments with Shape’s anti-fraud capabilities for web, mobile and APIs reinforces our ‘code to customer’ promise with a comprehensive, end-to-end application security offer. This has the potential to save customers billions of dollars lost to fraud, reputational damage and costly disruptions to digital transformations.
Over the longer term, through integrating our products with Shape’s large-scale telemetry and analytics capabilities, this acquisition also significantly advances our plans to offer AI-enhanced services to customers for better visibility, management and orchestration across their applications.
Equally important, Shape represents a major bet on expanding our capabilities. By bringing on board over 370 Shape employees led by Shape CEO Derek Smith, we are significantly expanding our expertise in the fields most critical to our next phase of growth: cloud, software and AI/Machine Learning competencies; as well as boosting our collective agility by learning from the customer-obsessed culture Shape has built over the last eight years.
And last, but by no means least, this approximately $1B transaction represents the biggest in our company history, and the second in under a year. That is no accident. By laying out our vision to become the leader in Multi-Cloud Application Services back in 2017, we have been taking deliberate and disciplined steps to realize our future identity. We know what it will take to win; and make no mistake, we are playing offense.
But an acquisition of this magnitude would simply not be possible without the dedicated teamwork and relentless pace you have set to drive F5’s transformation to date. We know from experience that acquisitions are not simple exercises in integration, but rather a belief system and a commitment – to do the work it takes to help unlock more value for a company like NGINX, and now Shape, than they could on their own. I count on this team to rise to the occasion again to make F5-NGINX-Shape the uniquely powerful combination I know it can be.
[Additional information pertaining to an F5 Company Meeting removed, along with minor edits]
Thank you,
François Locoh-Donou
CEO
