ForgeRock: Thoma Bravo Continues Roll-Up In IAM Space (FORG)

There is an intriguing setup in the digital identity and access management space. Enterprise software provider ForgeRock (NYSE:FORG) is getting acquired by a large investment firm, Thoma Bravo. The consideration is $23.25/share in cash. The spread currently stands at 8%. Shareholder approval is guaranteed, with 83% of shareholders already in support of the merger. The only remaining hurdle is regulatory approval. Closing is expected in H1’23. The downside to pre-announcement is pretty steep at 30%.

The buyout is part of Thoma Bravo’s roll-up strategy in the rapidly consolidating identity and access management industry. In fact, just this year Thoma Bravo acquired two of ForgeRock’s competitors in the space, SailPoint ($6.9bn) in June and Ping Identity ($2.8bn) this October. Both acquisitions closed without any regulatory concerns within 3-4 months. However, unlike SailPoint, which specializes in identity governance, ForgeRock and Ping have overlapping functionalities in customer identity and access management which seems to be perceived by the market as a potential regulatory risk here.

The merger spread has recently widened as reports appeared that Thoma Bravo plans to pull and refile its merger notice to give the DOJ more time to review the merger. Reportedly, the 30-day waiting period of initial review under HSR expired on November 24. The companies have not provided any updates since. Even though both parties are legally eligible to close the merger after the waiting period, the transaction might afterwards be challenged by the DOJ absent a go-ahead from the regulator. Recent spread widening seems to suggest that the market is expecting a somewhat prolonged antitrust scrutiny, with the possibility of a so-called second request from the DOJ.

Despite the concerns, the overall risk of a merger termination seems low:

• The identity and access management industry, despite high fragmentation and competition, is dominated by large players, including Google and Microsoft. FORG, Ping and SailPoint have an insignificant combined market share compared to these competitors. While the presence of FORG, Ping and SailPoint is more material in the large customer segment, the closest competitor OKTA holds a much more sizeable market share in terms of both revenues and number of customers than these three companies combined.
• Numerous industry transactions have closed successfully since 2021, including a large acquisition by the closest and larger competitor, OKTA.
• The transaction is a highly strategic roll-up for the buyer Thoma Bravo. Given Thoma Bravo’s track record of acquisitions in the field, the buyer is highly likely aware of the regulatory environment and would not have pursued the acquisition if significant antitrust pushback was expected.

Having said that, after Thoma Bravo’s two consecutive acquisitions of the leading players in the same industry, it is not unimaginable that it might take longer than three months for the merger to close, particularly given how aggressive the current FTC has been towards mergers across the board.

IAM Industry

The identity and access management industry (valued at around $13bn in 2022) is highly competitive with many large, medium-sized, and small companies in the space. The broader industry is dominated by players such as Microsoft and Google, with by far the largest market shares. Another large competitor OKTA controls 10% of the IAM space. This contrasts with much smaller market shares of FORG, Ping, and SailPoint – a combined market share of only 7% based on revenue. FORG and Ping, the closest competitors, have a combined market share of just 3.5%.

Notably, however, Google, Microsoft, and IBM largely provide services to small and mid-sized enterprises. The choice for larger companies requiring more specialized and custom-built solutions is largely limited to a small subset of companies. ForgeRock, Ping, and OKTA are usually the go-to choice for these larger corporations (largely Fortune 500 enterprises). Therefore, the concern is that acquiring FORG right after Ping Identity will further limit the subset of choices for these multinational corporations.

However, even looking at the large company sub-segment of IAM space, the combination of FORG and Ping still does not come close to the market share held by OKTA. The breakdown of the market shares in this sub-segment is very limited, but there are a couple of data points to look at. Currently, OKTA serves 50% of Fortune 500 and 30% of Global 2000 companies. It is not clear how much of this sub-market is in the hands of FORG and Ping. However, based on the combined revenues of FORG and Ping ($477m in 2021) it is clear that their market share is much smaller than that of OKTA ($1300m). Another way to look at market share dynamics is through the number of customers between all these players. Currently, OKTA has a much larger customer base with 16k clients compared to 1.9k customers for Ping and ForgeRock (400 coming from FORG).

On a broad market basis, the acquisition of FORG will not distort the competition in any way. When it comes to concentration in the Fortune 500, the concentration of one sub-market from the whole universe of customers served by Ping and FORG is unlikely to be sufficient to block the merger.

Industry Transactions

Given the accelerated consolidation in the IAM market over the last two years, there is a decent sample size of large acquisitions that have closed relatively recently. None of those acquisitions faced any regulatory scrutiny. Below is the list of mergers closed in 2021:

• OKTA acquired a huge player in the customer identity space, Auth0, for $6.8bn, almost doubling their customer base at the time. OKTA was already a dominant player in the space, in fact, larger than Ping and FORG combined when they were given a green light to acquire one of the largest peers.
• Also, last year, TPG Capital acquired Centrify, a privileged access management market leader, from Thoma Bravo for about $900m.
• After that TPG acquired Centrify’s one of closest peers Thycotic for $1.4bn and merged the companies by the end of the year, no regulatory concerns were raised this time either.
• In October 2021, One Identity acquired one of the largest players in the IAM space OneLogin to expand its platform’s unified identity security capabilities.

Thoma Bravo

Thoma Bravo is a large ($100bn AUM) highly experienced investment firm in the software space. Importantly, Thoma Bravo has been in the identity and access management space since the 2018 majority stake acquisition in Centrify, sold just last year. Given their expertise as well as their knowledge of the IAM space, it seems unlikely that they would have started the current roll-up strategy on which they have already spent almost $10bn without understanding the regulatory environment of the market.

Business Background

ForgeRock is a recently IPOed digital identity and access management platform in the US. It provides a broad array of services within the IMA space including for all identity types: consumers, workforce, and IoT. The platform is deployable on a variety of configurations including self-managed public and private cloud infrastructures as well as through ForgeRock Identity Cloud. A full list of services provided by ForgeRock is in the table below.

ForgeRock revenues primarily come from subscriptions. In 2021, about half of the revenue came from term licenses with customers that use their own private IT infrastructure or cloud infrastructure and the other half comes from the SaaS-based subscription model, which includes customers that run FORG IAM services on ForgeRock Identity Cloud. The company is actively transitioning towards a SaaS-based subscription revenue model, with 60% of revenue YTD coming from SaaS.

Since going public in September 2021, the company has experienced some slowdown in revenue growth, especially in 2022, largely associated with the slowing sales cycles as a result of a slowing economy. However, the company continues to grow ARR by 30%+ YoY, with more of the revenue coming from SaaS every quarter. Moreover, the company boasts a high 112% historical net revenue retention with gross margins consistently above 80%. Just a couple of days ago, the company reported outstanding Q3 results with revenue YoY growing by 32% vs. 8% in the last quarter with ARR continuing to grow at 30%+. It seems that the company is returning to its growth trajectory right before the acquisition by Thoma Bravo.

Conclusion

The risk of regulators breaking the merger seems overblown. The combined market share of Ping and ForgeRock in the broad IAM space, as well as within the sub-market serving large multinational firms, is much smaller than that of its peers. The presence of a highly strategic buyer as well as the multitude of mergers and acquisitions within the last two years add a degree of confidence in the successful outcome of the merger. The risk of a prolonged regulatory review is more than compensated by an attractive 8% spread.