Technology Investment Banking (M&A) Q&A

Think my last comment failed to post, but I'll repost: It depends which letter of "TMT" your bank focuses on, as each one is very different from the others. I only focus on the first "T", so my knowledge of media and telecom is very limited.

Assuming your group focuses on the first "T" (technology), I think the most helpful prep involves: 

(1) getting a basic grasp of the various metrics and KPIs important in the tech world: ARR, ACV, TCV, gross/net retention, net dollar expansion, LTV/CAC, RPO, deferred revenue, deferred contract acquisition costs, etc. 

(2) understanding the broad sub-sectors of technology and where your group focuses. Enterprise software (Salesforce, Workday) is very different from infrastructure software (Datadog, Oracle, etc.) which is very different from infrastructure hardware (Cisco, HPE, etc.) which is very different from chipmakers (Nvidia, AMD, etc.), etc. 

Business models and terminology differ a lot between these sectors, so understanding your group's area of expertise can be pretty critical. I have some time on my hands later today waiting for comments so I can make a separate post on this. Stay tuned :)

Edit: See my reply below for more detail on (2). Replied here instead of making a separate post.

Edit 2: Mods, why do my replies keep getting removed...

Edit 3: Back up, thanks mods

Likewise, I will focus on technology as media and telecom differ significantly, in particular telecom.

To add to the below, as an intern a lot of the work will be powerpoint and excel based, so being proficient, accurate and fast is extremely important. As an intern your contribution will be less on the technical side, so being able to quickly deliver and accurately will help you analyst and associate significantly.

Secondly, it is important to understand valuation and be able to produce comps, LBO models fairly quickly, whether you use FactSet or CapitalIQ, and then understanding what to produce in terms of outputs. I'd make sure you understand how regressions work, rule of 40 metrics, and the basic valuation multiples.

Understanding the various subsectors and players in each subsectors will be important as well as metrics/KPIs however I do think you will grasp this over time and on the job.

Don't want to hijack the thread, but may I ask how would you prepare for the technical + modelling? Have been hearging stuff like tmtbanking.com, marginofalpha, and peak frameworks. Do you think it would be better to buy such stuffs rather than WSP/BIWS/WSO? Many thanks!

I am US-based so can't comment on the London IB scene, but I am a smaller tech boutique doing buyside M&A advisory mostly, and we encounter Qatalyst non-stop (haven't encountered the others you mentioned. 

Seems like they are always on the other side of our deals. They churn out high-profile tech sell-sides like they're handing out candy. 

Quite mind-boggling but I imagine with that much experience, they probably have a very smooth process at this point. 

I see them more frequently in tech than pretty much any other BB/EB other than maybe JPM/MS. Again, just my experience, which may differ from others. 

I am in the London IB scene - so I can help here for sure. I work for a TMT specialised boutique, and we encounter the BBs in most of our sell-side pitches (GS, MS, JP, as well as some of the elite boutiques such as Evercore, Moelis who are reasonably strong too). The BBs are all very strong in tech as well, with GS and MS being the strongest, however the top boutiques do regularly compete with them, particularly for private M&A deals and P2Ps.

Qatalyst focus on one or two very large deal per year and they have a very small team but are very strong. Torch are slightly weaker i.e. would not compete with the EBs or BBs but good at the MM M&A scene.

I've done 3 deals in the cybersecurity space, but a few years ago, so my knowledge may be a bit dated, but here's the way I think about it. I may also be misremembering some things, as it's been a while. Welcome any further insight from others. 

There has absolutely been a trend of platformization in cybersecurity. Part of this is driven by the competitiveness of the sector, as companies are competing against other cybersecurity companies as well as giants like Microsoft, Cisco, etc. With vendor sprawl, a platform that consolidates multiple security functions can be a competitive advantage.

However, the bigger driver is the rise of cloud and the distributed workforce. In the old days of cybersecurity, it was sufficient to defend a specific area of the infrastructure since the "perimeter" was well-defined (i.e., the office and on-premise data center since very few people worked from home and most infrastructure was on-prem still). 

On the endpoint side, you had the OG antivirus companies like McAfee and Symantec defending your PC endpoint, Trend Micro defending your email inbox (identity security), Fortinet defending your networking infrastructure, etc. 

In addition to these solutions focused on defending a specific part of the infra, there was also a subset that focused on scanning and monitoring logs across the infrastructure for any security weaknesses or threats, called vulnerability management, which gave rise to security incident and event management (SIEM) systems like Tenable and Rapid7. 

Endpoint security saw the antivirus part gradually became more distinct as a less-attractive consumer-focused segment (as opposed to enterprise). This led to the eventual separation of Symantec into enterprise vs. consumer security companies, i.e., NortonLifeLock, which subsequently consolidated with Avast to form Gen Digital. 

In the enterprise world, endpoint security and vulnerability management go hand-in-hand, and as focus shifted towards real-time detection of threats, we began seeing the rise of automation capabilities like SOAR (security orchestration & automated response), eventually giving rise to endpoint detection and response (EDR), the predecessors to the modern XDR platforms like Crowdstrike.

That was on the endpoint side. At the perimeter, you had a hodgepodge of company types that all began to compete in the network security space. In the hardware arena, traditional networking hardware providers (routers, switches, etc.) like Fortinet and Cisco naturally began to develop or acquire complementary cybersecurity capabilities like firewall, DDoS protection, etc. Application delivery controller/load balancer-type companies such as Cloudflare, F5, A10, etc. have also entered this space over time. 

On the software side, this led to the rise of network security-focused companies like Check Point and Palo Alto Networks, who began developing more powerful next-generation firewalls (NGFW), secure web gateways, etc. Infrastructure monitoring and observability companies that were originally focused on performance rather than security also began to develop real security capabilities (e.g., Dynatrace, Datadog, etc.)

The real catalyst for the convergence though was the rise of cloud infrastructure, which broke the traditional model of security. It was no longer sufficient to protect just the office perimeter or to just protect the "endpoint". It became clear that threats could enter through multiple different openings and permeate throughout the infrastructure. 

For a brief period of time, the cloud security industry seemed to try and segment themselves into different buckets...cloud workload protection platforms (CWPP), cloud security posture management (CSPM), etc. These would soon converge to form CNAPP (cloud-native application protection platform), within which, Wiz is a leader. 

Endpoint and network security providers began taking note of this as well and started expanding into each other's spaces, resulting in the rise of XDR (extended detection and response) which effectively combines all of the above into one platform, covering both cloud and on-prem infrastructure (as opposed to companies like Wiz who focus on cloud specifically). 

Today, these are the dominant players in the space. For example, from the endpoint security world, you have Crowdstrike, Microsoft, SentinelOne emerging as leaders in XDR. From the network security world, you have Palo Alto Networks emerging as the XDR leader.

We often looks at valuations relative to growth (the sector trades on a mix of revenue and FCF multiples). Cybersecurity has one of the tightest correlations among enterprise software, which indicates that differentiation is blurring such that growth is ultimately what investors focus on when thinking about valuation in the sector, not sub-sector focus. 

Some companies have carved out a niche for themselves and trade in line with (or at a slight discount) vs. what their growth profile would indicate they should trade at. For example, players like Okta have carved out their niche in modern identity security. You have companies like N-able and Kaseya that focus on managed service providers serving SMB customers. 

Network security still exists as its own thing given the existence of companies like Cisco, Juniper, etc. where it is a natural adjacency. Endpoint security is gradually being absorbed by Microsoft and XDR giants. For endpoint, I should note the existance also of IT asset management companies originally focused on remote monitoring of employee devices, patch management, etc. like Ivanti or Tanium. 

These companies haven't done so hot, as much of their capabilities have been made redundant by all the other security tools out there. Along with them (mostly private), there are a few other laggards that are focused on niche areas (e.g., Jamf for Mac endpoint security) or legacy functions/SMB customers (Rapid7 and Tenable still provide VM/SIEM for SMBs). These trade at a noticeable discount to the others.