"Cyber startups are too expensive for sane companies to buy"

Tufin founders Reuven Harrison and Ruvi Kitov  credit: PR

Tufin CEO Ruvi Kitov talks to "Globes" about share price ups and downs, the company's new strategy, and what it won't be doing with its cash.

In April 2019, Tufin Software Technologies, which deals in network security policy software, was floated on the New York Stock Exchange at a $480 million valuation. The start looked promising and the share soon climbed to a high of about $30.5 (an almost $1 billion market cap), which compares with $14 in the IPO. But after that, something went wrong.

Over the last two years, returns on the share have been lackluster, relative to the Nasdaq index and other tech and cyber shares; the company is currently traded at a $309 million market cap, its share price now 42% lower than in its IPO.

A year ago, it even seemed like an internal battle among activist shareholders was about to develop. Two Israeli funds - veteran Tufin investors Catalyst Investments and Marker - announced they would cooperate to maximize shareholder value and even went as far as engaging a bank to procure offers to buy the company. But after a few months, and without any other dramatic events, both funds reduced their holdings and distributed Tufin shares to their investors.

Ruvi Kitov, chairman and CEO, who founded the company along with CTO Reuven Harrison, believes the funds' departure could have a positive effect on the trend in Tufin shares. Speaking to "Globes", he explains the circumstances that led to Tufin being traded below its IPO price. "In 2019, we missed in the fourth quarter [the company issued a profit warning - S.H.W.], which was very painful and some investors didn't like it, to say the least. Our company does very big deals, which is why many close in the last two weeks of the quarter. Covid-19 emerged in first quarter of 2020, and many deals were frozen.

"In general, 2020 was a rough year, because on the whole, data security budgets shifted to working from home and laptop security, for example. This was a bonanza for some security companies, but we're in a different area, and budgets that were earmarked for Tufin were transferred to other solutions. It was only in the fourth quarter of 2020, that we began to see our way out of Covid-19. Not that the coronavirus is over, but enterprises have finished reorganizing and are now in a sort of 'new normal.'"

During 2020, the company began planning a change in its business model (more below) and says Kitov, "Since we announced the change last February, we've shown growth every quarter and are performing well, but the fact that there was no sales growth in 2020 did affect the market cap."

Something else that he believes affected the stock was the fact that Catalyst and Marker held a cumulative 20% share which they did not sell (after reducing their holdings in a secondary offering in 2019). A few months ago, Catalyst distributed Tufin shares to its investors, and Marker recently did the same.

"This has to be taken in proportion; Catalyst has been with us for 14 years, these specific funds have long been inactive and their investors wanted to see the money," Kitov says. "We were below the issue price and it was probably not appropriate for them to make a secondary issue for the sale of the shares, so they were distributed to investors. Overall, the funds came out with a very high profit, they invested in the company even before the IPO."

As he sees it, "The share was under pressure for a long time, and investors who were considering buying in, sat on the fence because they didn't want to enter when there was a wave of sell-offs. Currently, there's a wave of sell-offs, probably from those investors who received the shares. I hope that that will pass; then there won't be constant pressure on the share"

About a year ago the funds assessed that the share was traded at a loss and tried to generate value in what was perceived as an activist move.

"I'm not responsible for their actions, but I guess they probably wanted to signal to the market that they wanted to sell the shares, and if anyone wanted to buy - all the better. It wasn’t a real activist move, but more to signal, 'Hey, we're here.' They still sit on our board, which supports and backs the new strategy we’ve presented. They’re supportive and give good advice. This isn’t a hostile investor, it’s someone who has been with us from the start."

"We bootstrapped for four years"

Kitov and Harrison founded Tufin in 2005. "We were both at Check Point during the late '90s glory years. At a certain point, we decided to set up something ourselves. We didn’t have any ideas yet, but we wanted to be entrepreneurs," says Kitov.

"We bootstrapped for four years. I cashed in an advanced training savings fund and Reuven signed up for unemployment benefit. After consulting, we released our first product, recruited two developers and sold the product to three companies for $80,000. It was a great achievement. A year later we have already had $250,000 in sales, after that $1 million, $3 million - we grew nicely. "

On the division of labor between the entrepreneurs Kitov says, "I’ve always been the CEO. Reuben is more talented technically and I’m more interested in business and management. Our relationship is excellent. Many companies break up because of tensions between partners - we’ve never had any."

In mid-2007, the company decided to raise funds for the first time. "It was a bad time to raise, and investors were not in the business of start-ups." At the end of that year, Edouard Cukierman’s Catalyst Investments participated in the first round, and up until the IPO, Tufin sufficed with having raised just $26 million; "We were pretty efficient," Kitov says.

The company deals with security policy software that controls accessibility to enterprise networks - who can communicate with whom within the network and in the cloud, and the like. "The modern network is a hybrid, and is becoming very complex and heterogeneous - hundreds of firewalls, thousands of routers and switches, two or three clouds for different purposes," Kitov notes.

"There’s segmentation (routing control). A firewall is a type of segmentation. 10-15 years ago, a company would have a firewall for its Internet connections, and the perception was that if someone tried to attack, the firewall would block it, and everything would be fine. The working assumption in today’s modern world is: it’s not a question of whether there will be an attack - only when. The working assumption is that someone will break in through a vulnerable point, and segmentation must be done so that the attacker can’t get everywhere within the enterprise network."

Add to this the fact that the network is everywhere ("Even the refrigerator has an IP address"), requiring layers of defense. "We focus on very large enterprises. When it comes to such massive networks, it’s impossible to manage policy without a centralized management capability," he says. Aided by Tufin, an enterprise can decide whether, for example, its factory should be accessed from data center.

"Once we’re installed it’s hard to pull us out"

Tufin gives a complete picture of everything happening in the network. Policy is defined by the enterprise itself defining, and Tufin's technology is there to implement it. Usually, Kitov says, the first time Tufin connects to the network and shows the customer what’s happening inside, "There’s a momentary panic when they realize that there are hundreds of errors and vulnerabilities to be fixed, because this process is manual and not managed. After all, the network is dynamic and changing constantly. Any change can violate the security policy."

Tufin offers customers two solutions, compliance and control, and automation. The first solution defines the policy and fixes the vulnerabilities that are found. The second solution examines any long-term change in the network, and determines almost immediately whether it can be implemented or not, in accordance with the policy - thus saving time for data security managers.

"What we do is relevant for very large organizations, so it’s also a relatively expensive product. The implementation process is long, but once we’re installed, it’s hard to pull us out." The company has about 1,700 customers, some using only one solution or applying Tufin to only a small part of their network. "It’s taken us a long time to educate the market," Kitov admits. "Even today, this is an area that relatively few people have heard of." He estimates the target market size at about $12 billion.

From permanent license sales to subscription fees

As mentioned, this year the company announced a change in its business model, and, like a good number of technology and cyber companies, decided to pivot from the sale of a permanent license for its solution, to selling subscriptions that will generate recurring revenue. This changeover is expected to take three years. The company estimated at the beginning of 2021 that about one-third of all new annual sales would be subscriptions; it passed this milestone by the third quarter of 2021, and has now reached 46%.

Changing the business model usually hurts results in the short-term, and for Tufin it has meant a multi-million-dollar loss. Kitov, however, emphasizes that despite this, "Compared with 2020, there’s been a very nice improvement in our performance, and we’re very encouraged. Market demand has returned to pre-Covid-19 levels." 2021 is expected to end on a loss, as is 2022, with the third year of the transition closing at break-even, and moving towards profitability later on. "It's a much more profitable model," Kitov points out.

You have $93 million cash. Are you thinking of acquiring companies, or repurchasing shares in the light of the share's weakness?

"We do have cash, but on the other hand, we expect two years of investments and losses, so we need those funds, and I prefer to keep the cash. Acquiring a startup could happen, but the valuations these days for data security companies, especially in the cloud, are insane and have lost all proportion. There are companies without any income with higher valuations than Tufin. I think these successful cyber start-ups are so expensive that the sane companies aren’t trying to buy them at this stage. Should the opportunity come along, we’re reserve the right to make a small, smart acquisition."

Published by Globes, Israel business news - en.globes.co.il - on December 16, 2021.

© Copyright of Globes Publisher Itonut (1983) Ltd., 2021.

Tufin founders Reuven Harrison and Ruvi Kitov  credit: PR
Tufin founders Reuven Harrison and Ruvi Kitov credit: PR
Twitter Facebook Linkedin RSS Newsletters גלובס Israel Business Conference 2018