Cerberus Cyber: Underwhelming Results, Stock Dilution Likely

Introduction

I’ve mentioned in several articles on SA that I work as an M&A analyst covering Latin America, and I’ve written about some companies from the region such as Betterware de Mexico (BWMX) and Industrias Bachoco (IBA). Today, I want to talk about cybersecurity solutions company Cerberus Cyber Sentinel (NASDAQ:CISO) which recently announced the acquisition of Argentinean sector player RAN Security.

Cerberus has made a total of 5 purchases in Latin America over the past 2 years and has thus been popping on my radar. While I like companies hunting for synergies through M&A, I tend to stay away from soaring goodwill and deteriorating financial results. The quarterly operating loss of Cerberus soared to $8.4 million in Q3 2022, while goodwill and intangible assets accounted for over 80% of total assets as of September. There was a working capital deficit at the end of the quarter and I think that opening a small short position seems viable. Let’s review.

Overview of the business and financials

Cerberus specializes in the provision of cybersecurity consulting and managed services, and I think that’s what sets it apart from many competitors is a focus on human risk factors.

The company is currently in the process of rebranding to CISO Global. It was created in March 2019 and in April of that year, it bought an Arizona-based cybersecurity services provider named GenResults. The latter was owned by an entity affiliated with Cerberus’ CEO David Jemmett and over the next few years the group embarked on a strategy of acquiring small to medium-sized engineer-owned firms in the cybersecurity space. Counting RAN Security, it has made a total of 16 acquisitions since the GenResults deal. This allowed Cerberus to establish a global presence with operations across the USA, the EU, Asia, and Latin America as well as achieve impressive revenue growth.

The company continued expanding in 2022, with total revenues soaring by 243.7% year on year to $31.8 million over the first nine months of 2022.

Turning our attention to the Q3 2022 financial results, we can see that almost 90% of revenues came from security managed services which include culture education and enablement, tools and technology provisioning, data and privacy monitoring, regulations and compliance monitoring, remote infrastructure administration, and cybersecurity services. The remainder came from professional services, which include cybersecurity consulting, compliance auditing, vulnerability assessment and penetration testing, and disaster recovery and data backup solutions. Chile accounts for a significant portion of revenue at the moment as Cerberus bought several sector players with exposure to the country since late 2021, namely Arkavia Networks (December 2021), CUATROi (August 2022), and NLT Secure (September 2022).

In my view, the major driver behind the revenue growth this year is likely managed compliance and cybersecurity provider True Digital, which Cerberus acquired in January. Looking through the financial results of Cerberus, this was its largest acquisition to date as the purchase consideration stood at $40.9 million and was paid in cash and stock.

What I find concerning though is that while revenues are growing rapidly, most if not all of the acquired businesses are unprofitable (impossible to tell which ones as there are no pro-forma results in the quarterly report) and there don’t seem to be significant synergies or economies of scale as Cerberus is losing about 75 cents for every dollar of revenues. Compared to Q3 2021, the operating loss has soared by over 160% and I don’t think this is sustainable for much longer.

You see, the losses and acquisitions are putting a significant strain on the balance sheet and there was a working capital deficit of $3.3 million as of September while tangible assets were below the stockholders’ equity. As Cerberus has an asset-light business model, there isn’t much that can be sold to avoid a significant capital increase in the near future. Net cash used in operating activities for the first nine months of 2022 was $7.9 million and unless something changes drastically soon, it seems that Cerberus could need to tap the equity markets in the coming months.

So, how do you play this? Well, short selling seems like a viable idea as data from Fintel shows the short borrow fee rate is 14.4% as of the time of writing. Looking at hedging, call options are cheap, but the volume is low.

The short interest at the moment is just 615,420 shares but I find it concerning that it takes just over 7 days to cover as the daily trading volume rarely surpasses 50,000 shares.

Looking at the risks for the bear case, I think that the major one is that the share prices of microcap companies can sometimes increase for spurious and unknown reasons. It should be noted that it seems that Cerberus briefly became a meme stock in late 2021, just before uplisting to Nasdaq in January 2022. The company was trading on the OTC market at that time.

Investor takeaway

Cerberus has achieved significant revenue growth since its inception but is still a small cybersecurity firm with quarterly revenues of just above $11 million. In addition, the margins are underwhelming, and losses are expanding rapidly, which leads me to conclude that there aren’t significant synergies or economies of scale and that many of the acquired companies are unprofitable. This is a recipe for disaster, and I think that significant stock dilution in the near future is likely. In my view, the business Cerberus is close to worthless in its current state as the company is losing about 75 cents for every dollar of revenues.

Call options are cheap and the short borrow fee rate seems low enough to make opening a small short position viable. However, it takes over 7 days to cover and it’s possible we see a repeat of the late 2021 share price spike. I think it’s best for risk-averse investors to avoid this stock.