TPG Capital acquiring Thycotic in addition to Centrify, but leaving many questions unanswered
Mergers and acquisitions are not uncommon in the tech industry, specifically in software. Even in the specialized area of Privileged Access Management (PAM), currently a $1.4bn market according to the KuppingerCole market sizing data, there have been several acquisitions in recent years. Despite its relatively small size, competition within the PAM market is fierce and it attracts startups and investors who realize that PAM has performed a growth spurt in the last years.
This was due to both the ever-increasing cyber-attacks and the challenges imposed by new work and software delivery models, but also due to regulatory compliance and C-SCRM (Cybersecurity Supply Chain Risk Management) challenges. It is a hot market, and predictions are that it will remain a growth market.
We should welcome investment, but...
Venture Capital and Private Equity are a valuable part of the tech sector. Without them, many innovative companies would not exist. However, on some occasions we must, as analysts, carefully analyze and, sometimes, criticize the rationale behind their investments.
Sometimes investments make perfect sense. Sometimes, however, they leave you scratching your head. The purchase of Thycotic by TPG Capital and its plan to merge the company into its existing property, Centrify, is one of investments that don’t immediately fit into the first category. And, for legal reasons until official approval of the deal, there won’t be many answers. The official line in the announcement is full of words like synergy, cloud-first, identity platform, best-in-class SaaS platform, etc., but lacks concrete facts.
It describes Thycotic as a “next-generation, cloud-first company with innovative identity security solutions” and Centrify as a “trusted PAM market leader”. The description of Centrify is true. They are one of the market leaders, and this statement also is backed up by its performance in KuppingerCole’s PAM-related Leadership Compass reports.
Thycotic and Centrify: Both amongst the PAM leaders
Thycotic is also a leader in PAM, and even outperforms Centrify in some of our report ratings, although the two are closer when measured for DevOps capabilities. However, “next generation” and “cloud-first” are bold claims. Thycotic delivers many services to their customers as SaaS, but most are still based on their established Secret Server product. On the other hand, Thycotic has cloud-native offerings in the portfolio such as their Account Lifecycle Manager (ALM) and DevOps Secret vault. Overall, based on its activity in the last 12 months, Thycotic, despite these claims, seems the more innovative of the two. But “next generation”? Partially yes, without any doubt, but not (yet) in all areas.
Thycotic too, was on the acquisition trail in 2020 when it purchased CASB startup OnionID to add that functionality to its PAM suite, an excellent purchase and one easily integrated. It signed an OEM deal with IBM to provide a white-label version of its PAM platform – a deal that has benefited both parties. Its management and active road map seemed in a good place.
A merger of equals – not a takeover
As aforementioned, TPG Capital is acquiring Thycotic in addition to Centrify, with the intent of merging the two companies in what we would rate as a merger of equals. Centrify, while showing good progress and continuing to be amongst the PAM leaders, may not have shown the same levelheadedness as Thycotic. On the other hand, with the split of the IDaaS (Identity as a Service) business now being Idaptive, Centrify is fully focused on PAM for quite a while now. It has had three ownerships in three years. And three (or, more correctly, two) different CEOs. The latest, industry veteran Art Gilliland is set to take over the reins of the newly merged business. He is #3, but became CEO just at the day of the announcement of the Thycotic acquisition by TPG, now being in charge of leading the integration. This, amongst others, is a clear indicator for a merger of equals, not a take-over of one by the other.
The general question in every merger is whether synergies will be leveraged. Is the approach taken by TPG the right or wrong way around for merging companies? As usual, there is a danger that the innovations that Thycotic displayed will be lost in the familiar process of merging the two companies two sets of PAM technologies with considerable overlap (but also several uniquenesses), and all that entails. There also is a danger that some of the Centrify’s strength will suffer. But the setup chosen by TPG is focused on avoiding these scenarios, despite all the buzzwords used in the official announcement.
Cui bono?
At the end, the bottom line is whether it is good for the customer. The answer is unclear yet, until more concrete plans are announced (which, as mentioned ahead, has to wait until formal approval of the deal). It is arguably good for TPG Capital to effectively neutralize a rival, but it means less choice for the customer – especially at the enterprise level. There always remains a risk for the companies and products if the merger runs into difficulties.
On the other hand, TPG Capital has a reputation for longer-term strategic investments, thus this can turn into leveraging synergies, which we consider being a lot more likely. But we don’t know yet, and as of now, there (for the aforementioned reasons) has been no strategy and roadmap published. In other words: For now, we are in a phase of uncertainty, but with some positive hints when looking at the details, and behind the scenes.
Wait until the dust settles
Our advice for organizations currently in the process of making decisions in the PAM space is to wait until the dust has settled and both transition and integration roadmaps are published. Ask also the other vendors to explain their roadmap and longer-term strategy. While there is yet a lot of uncertainty regarding the future of the mutual products and the strategy, there appears being a plan behind the acquisition.
For existing customers, the same holds true. With two vendors with largely overlapping product portfolios merging, the risk of one of the products disappearing exists. But there are also opportunities, with two strong vendors joining forces. Thus, before making decisions in a hurry: Better wait a little, until Centrify and Thycotic tell us about their plans, and then decide based on that.