Editing Darktrace
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.
| Latest revision | Your text | ||
| Line 1: | Line 1: | ||
[[File:Darktrace logo.jpg|thumb]] | [[File:Darktrace logo.jpg|thumb]] | ||
''' | '''Path to sustainable profitable growth unclear; initiate with UW''' | ||
== Summary == | == Summary == | ||
Darktrace is a provider of AI-led cybersecurity | Darktrace is a provider of AI-led cybersecurity solutions. Today, Darktrace leads the Network Detection and Response market and has seen good early success with its email product; however, against the backdrop of '''1)''' high competition and potential commoditization of security solutions addressing similar use-cases and '''2)''' relatively low platform lock-in and customer stickiness, JP Morgan expects customer acquisition and retention to become more challenging for Darktrace going forward. With ARR growth tied to new customer acquisition, JP Morgan believes that higher customer acquisition and retention costs are likely to challenge the company’s ability to deliver profitable growth. Accordingly, JP Morgan initiates coverage with an Underweight rating and Dec-23 price target of 400p. | ||
* | * Darktrace’s addressable markets are characterized by low barriers to entry and high competition. With relatively low barriers to entry and increased competition, JP Morgan sees a risk of commoditization of solutions targeting the use-cases addressed by Darktrace. A growing list of vendors that seek to combine different point security solution offerings into an eXtended Detection and Response (XDR) fabric will only increase the competitive intensity for Darktrace, whose offerings are a complement (rather than a replacement) for other point security tools. In addition, there is risk from public cloud vendors such as Microsoft, Google and Amazon making a big push in the areas of cloud traffic and email security. | ||
* | * Shifting the focus to profitability. High competition and low customer stickiness will likely translate to higher customer acquisition costs and prompt Darktrace to increase investments in existing and new product development – both of which will limit margin leverage going forward, in JP Morgan's view. JP Morgan expects the sum of revenue growth and FCF margin (‘Rule of 40’) to dip and remain below 40% over the next couple of years. Eventually, this is likely to reflect in Darktrace’s valuation compared to other cybersecurity peers that consistently beat this 40% benchmark. With ARR growth tied to new customer acquisition, JP Morgan believes that higher customer acquisition costs and lower customer retention are likely to challenge the company’s ability to deliver profitable growth. JP Morgan's adj. EBITDA estimates are 22%/4% below consensus for FY23/24, respectively. | ||
* | * Initiating at UW. JP Morgan initiates coverage on Darktrace with an Underweight rating and Dec-23 price target of 400p (~10% downside vs. current spot). JP Morgan's price target is based on 5.5x ’23E EV/sales (calendarized), ~35% discount to the peer group median (comprising a targeted list of product-led threat detection and response and cyber exposure management/user behavior analytics vendors). | ||
== Executive Summary == | == Executive Summary == | ||
Founded in Cambridge (UK) in 2013, Darktrace is a provider of AI-led threat detection and response security | Founded in Cambridge (UK) in 2013, Darktrace is a provider of AI-led threat detection and response security solutions covering on-premises network, cloud, SaaS, email, endpoints and OT (Operational Technology) environments. Further, Darktrace will roll out solutions tackling preventative security and remediation post attacks as part of its continuous AI security loop. According to Darktrace, its cyber AI platform does not rely on a historical signatures-based detection / rules-based response playbook; instead, its technology aims to learn the ‘patterns of life’ for an enterprise, creating a constantly evolving baseline for ‘normal’ behavior, and detects and responds to deviations from the normal. | ||
Darktrace competes in market segments characterized by relatively low barriers to entry and high competition. Today, Darktrace leads the Network Detection and Response (NDR) market and has seen good early success with its email product; however, against the backdrop of '''1)''' high competition and potential commoditization of security solutions addressing similar use-cases, '''2)''' relatively low platform lock-in and '''3)''' growing enterprise awareness of competing vendors, JP Morgan expects customer acquisition and retention to become more challenging for Darktrace, going forward. With ARR (annualized recurring revenue) growth tied to new customer acquisition, JP Morgan believes that higher customer acquisition and retention costs are likely to challenge the company’s ability to deliver profitable growth. This will reflect in Darktrace’s valuation compared to its peer group, in JP Morgan's view. '''Accordingly, JP Morgan initiates coverage on Darktrace with | Darktrace competes in market segments characterized by relatively low barriers to entry and high competition. Today, Darktrace leads the Network Detection and Response (NDR) market and has seen good early success with its email product; however, against the backdrop of '''1)''' high competition and potential commoditization of security solutions addressing similar use-cases, '''2)''' relatively low platform lock-in and '''3)''' growing enterprise awareness of competing vendors, JP Morgan expects customer acquisition and retention to become more challenging for Darktrace, going forward. With ARR (annualized recurring revenue) growth tied to new customer acquisition, JP Morgan believes that higher customer acquisition and retention costs are likely to challenge the company’s ability to deliver profitable growth. This will reflect in Darktrace’s valuation compared to its peer group, in JP Morgan's view. '''Accordingly, JP Morgan initiates coverage on Darktrace with an Underweight rating and Dec-23 price target of 400p (~10% downside vs. current spot).''' JP Morgan's price target is based on 5.5x ’23E EV/sales (calendarized), ~35% discount to the peer group (comprising a targeted list of product-led threat detection and response and cyber exposure management/user behavior analytics vendors). | ||
=== Shifting the focus to profitability === | === Shifting the focus to profitability === | ||
Darktrace has delivered ‘beat and raise’ results in its short reporting history since IPO in Apr-21. In the near term, JP Morgan expects demand for AI-led detection and response | Darktrace has delivered ‘beat and raise’ results in its short reporting history since IPO in Apr-21. In the near term, JP Morgan expects demand for AI-led detection and response solutions to remain high – this coupled with Darktrace’s brand awareness (a function of its high marketing spend), investment in additional salesforce hiring and the roll- out of the new ‘Prevent’ product offering should translate to healthy new customer acquisition and thus ARR growth, in JP Morgan's view. That said, unless the quality and stickiness of the customer base acquired is high, focus on new customer acquisition will not translate to sustainable profitable growth, in JP Morgan's view, even though the company may deliver healthy growth in the near term. JP Morgan also notes the overhang from pre IPO shareholders who may dispose of shares, with the next lock-up expiry on 25th April, as per Bloomberg. | ||
In JP Morgan's view, Darktrace needs to demonstrate a decoupling between ARR growth and new customer acquisition & investment in sales headcount – this will be a function of a sustained increase in average contract ARR per new customer and continued improvement in net ARR retention rate (a function of lower churn and higher upsell/cross-sell). Sustained improvement in these metrics would allow the market to be more convinced of the company’s competitive positioning and moat. | In JP Morgan's view, Darktrace needs to demonstrate a decoupling between ARR growth and new customer acquisition & investment in sales headcount – this will be a function of a sustained increase in average contract ARR per new customer and continued improvement in net ARR retention rate (a function of lower churn and higher upsell/cross-sell). Sustained improvement in these metrics would allow the market to be more convinced of the company’s competitive positioning and moat. | ||
| Line 74: | Line 74: | ||
|} | |} | ||
=== Market for AI-led threat detection and response security | === Market for AI-led threat detection and response security solutions marked by low barriers to entry and high competition === | ||
Today, Darktrace leads the Network Detection and Response (NDR) market and has seen good early success with its email product. However, with relatively low barriers to entry and increased competition, JP Morgan sees a risk of commoditization of solutions targeting the use-cases addressed by Darktrace. A growing list of vendors that seek to combine different point security solution offerings into an eXtended Detection and Response (XDR) fabric will only increase the competitive intensity for vendors such as Darktrace, whose offerings are a complement (rather than a replacement) for other point security tools such as Endpoint Detection and Response (EDR), in JP Morgan's view. In addition, JP Morgan believes that there is a real competitive threat from public cloud vendors such as Microsoft, Amazon and Google making a big push into proactive threat detection and response solutions for cloud traffic and email as enterprise workloads transition to the cloud. | Today, Darktrace leads the Network Detection and Response (NDR) market and has seen good early success with its email product. However, with relatively low barriers to entry and increased competition, JP Morgan sees a risk of commoditization of solutions targeting the use-cases addressed by Darktrace. A growing list of vendors that seek to combine different point security solution offerings into an eXtended Detection and Response (XDR) fabric will only increase the competitive intensity for vendors such as Darktrace, whose offerings are a complement (rather than a replacement) for other point security tools such as Endpoint Detection and Response (EDR), in JP Morgan's view. In addition, JP Morgan believes that there is a real competitive threat from public cloud vendors such as Microsoft, Amazon and Google making a big push into proactive threat detection and response solutions for cloud traffic and email as enterprise workloads transition to the cloud. | ||
| Line 268: | Line 268: | ||
== Valuation == | == Valuation == | ||
JP Morgan initiates coverage on Darktrace with | JP Morgan initiates coverage on Darktrace with an Underweight rating and Dec-23 price target of 400p. JP Morgan's price target is based on 5.5x ’23E EV/sales (calendarized), ~35% discount to the peer group median (comprising a targeted list of product-led threat detection and response and cyber exposure management/user behavior analytics vendors). Darktrace is likely to report healthy near-term momentum – a function of strong demand for AI-led threat detection and response solutions, brand awareness (driven by its high marketing spend), investments in adding salesforce capacity and roll-out of the new ‘Prevent’ product suite. However, the stickiness of Darktrace’s customer base may be challenged by commoditization of offerings targeting similar security use-cases, low switching costs and as enterprise awareness of competing vendor offerings increases. This could eventually translate to higher customer churn, in JP Morgan's view. With ARR growth tied to new customer acquisition, JP Morgan believes that higher customer acquisition costs and lower customer retention are likely to challenge the company’s ability to deliver profitable growth. This is likely to reflect in Darktrace’s valuation compared to its peer group, in JP Morgan's view. | ||
Rather than looking at a blanket list of all listed cybersecurity companies, JP Morgan includes a targeted list of product-led detection and response, threat/user-behavior analytics and cyber exposure/vulnerability management vendors as part of Darktrace’s peer group. JP Morgan excludes from JP Morgan's peer group services-led companies such as Mandiant and SecureWorks, network equipment companies such as Arista and Cisco and managed security service providers (see Table 3 for details). | Rather than looking at a blanket list of all listed cybersecurity companies, JP Morgan includes a targeted list of product-led detection and response, threat/user-behavior analytics and cyber exposure/vulnerability management vendors as part of Darktrace’s peer group. JP Morgan excludes from JP Morgan's peer group services-led companies such as Mandiant and SecureWorks, network equipment companies such as Arista and Cisco and managed security service providers (see Table 3 for details). | ||
| Line 284: | Line 284: | ||
JP Morgan acknowledges that this may take some time to play out, especially in the current environment, where demand for proactive security solutions is likely to remain high. JP Morgan does not see Darktrace’s discount to its peer group narrowing unless the company is able to demonstrate a sustained decoupling between ARR growth and new customer acquisition (which will be a function of a sustained increase in average contract ARR per customer, lower churn and continued improvement in net ARR retention rate). | JP Morgan acknowledges that this may take some time to play out, especially in the current environment, where demand for proactive security solutions is likely to remain high. JP Morgan does not see Darktrace’s discount to its peer group narrowing unless the company is able to demonstrate a sustained decoupling between ARR growth and new customer acquisition (which will be a function of a sustained increase in average contract ARR per customer, lower churn and continued improvement in net ARR retention rate). | ||
Accordingly, JP Morgan initiates coverage on the stock with | Accordingly, JP Morgan initiates coverage on the stock with an Underweight rating and set JP Morgan's Dec-23 price target at 400p, based on 5.5x ’23E EV/sales (calendarized), ~35% discount to its peer group median (vs. YTD average of ~25% discount). JP Morgan's choice of a higher discount vs. peer median reflects JP Morgan's view of increased competition and limited visibility on the path to achieve sustained profitable growth. On a relative basis, JP Morgan believes that there are better opportunities elsewhere to play the proactive cybersecurity theme – such as CrowdStrike (leading disruptor in endpoint security), CyberArk (Privileged Access Management leader), Tenable (leader in vulnerability management) and Varonis (user and entity behaviour analytics). | ||
'''Figure 2: 1-yr forward EV/sales (calendarized): Darktrace vs. peer group median: Jul-21-present<ref name=":1" />''' | '''Figure 1: 1-yr forward EV/sales (calendarized): Darktrace vs. peer group median: 2017-present<ref name=":1">Source: Bloomberg Finance L.P.</ref>''' | ||
'''Figure 2: 1-yr forward EV/sales (calendarized): Darktrace vs. peer group median: Jul-21-present<ref name=":1" />''' | |||
{| class="wikitable" | {| class="wikitable" | ||
| Line 480: | Line 483: | ||
|375 | |375 | ||
|} | |} | ||
'''Figure 3: Valuation comparison: Darktrace vs. peer group: 2023 revenue growth + FCF margin vs. 2023 EV/sales (calendarized)'''<ref>Source: Bloomberg Finance L.P.; priced intraday as of 4th April.</ref> | '''Figure 3: Valuation comparison: Darktrace vs. peer group: 2023 revenue growth + FCF margin vs. 2023 EV/sales (calendarized)'''<ref>Source: Bloomberg Finance L.P.; priced intraday as of 4th April.</ref> | ||
== Company Overview == | == Company Overview == | ||
Darktrace is a provider of proactive, AI-led threat detection and response security solutions covering on-premises network, cloud, SaaS, email, endpoints and Industrial IoT/OT environments. Darktrace’s threat detection and response approach assumes that cyber threats will succeed in breaching the organization (unlike perimeter defence technologies that seek to prevent threats from entering the organization’s digital estate) and detects and responds to these threats from within the enterprise. | Darktrace is a provider of proactive, AI-led threat detection and response security solutions covering on-premises network, cloud, SaaS, email, endpoints and Industrial IoT/OT environments. Darktrace’s threat detection and response approach assumes that cyber threats will succeed in breaching the organization (unlike perimeter defence technologies that seek to prevent threats from entering the organization’s digital estate) and detects and responds to these threats from within the enterprise. | ||
| Line 505: | Line 510: | ||
'''Figure 4: Customer split % (by volume) by industry vertical (as of Feb-21)'''<ref name=":2">Source: Company data.</ref> | '''Figure 4: Customer split % (by volume) by industry vertical (as of Feb-21)'''<ref name=":2">Source: Company data.</ref> | ||
'''Figure 5: Period-end number of customers<ref>Source: Company data; FY ends in Jun.</ref>''' | '''Figure 5: Period-end number of customers<ref>Source: Company data; FY ends in Jun.</ref>''' | ||
'''Figure 6: Revenue split by geography (%)<ref>Source: Company data; revenue from customers has been attributed to the geographic market based on contractual location; FY ends in Jun.</ref>''' | '''Figure 6: Revenue split by geography (%)<ref>Source: Company data; revenue from customers has been attributed to the geographic market based on contractual location; FY ends in Jun.</ref>''' | ||
==== Churn ==== | ==== Churn ==== | ||
| Line 523: | Line 522: | ||
'''Figure 7: Customer split by contract ARR size<ref>Source: Company data; FY ends in Jun.</ref>''' | '''Figure 7: Customer split by contract ARR size<ref>Source: Company data; FY ends in Jun.</ref>''' | ||
'''Figure 8: % of customers using more than one Darktrace product<ref>Source: Company data; FY ends in Jun.</ref>''' | '''Figure 8: % of customers using more than one Darktrace product<ref>Source: Company data; FY ends in Jun.</ref>''' | ||
Darktrace reported 1-year gross ARR churn of 6.4% as of end-1H22 (six-month period ending in Dec-21) vs. 7.6% exiting Jun-21. As expected, Darktrace sees higher churn among customers with contract size less than $100k in ARR. Darktrace’s 1-yr gross ARR churn is higher compared to other cybersecurity vendors (such as Crowdstrike, which reported 1-yr gross ARR churn of ~2% in FY21) given its SMB/mid-market heavy customer base. Darktrace reported net ARR retention rate of 105.1% in 1H22 (increasing from 99.1% in 2020 and 102.9% in 2021) – the increase in net ARR retention rate is a function of higher product upsell/cross-sell and stabilizing churn. Darktrace is investing in its customer success function, which should help stabilize churn and drive higher upsells/cross-sells at the point of renewal. That said, given the SMB/mid-market heavy customer base (which is characterized by higher churn compared to larger enterprise customers) and multiple products purchased at the initial point of sale (which limits the scope of cross-sells), Darktrace does not expect to see a significant improvement in net ARR retention rate going forward (the improvement, if any, is likely to be more gradual). | Darktrace reported 1-year gross ARR churn of 6.4% as of end-1H22 (six-month period ending in Dec-21) vs. 7.6% exiting Jun-21. As expected, Darktrace sees higher churn among customers with contract size less than $100k in ARR. Darktrace’s 1-yr gross ARR churn is higher compared to other cybersecurity vendors (such as Crowdstrike, which reported 1-yr gross ARR churn of ~2% in FY21) given its SMB/mid-market heavy customer base. Darktrace reported net ARR retention rate of 105.1% in 1H22 (increasing from 99.1% in 2020 and 102.9% in 2021) – the increase in net ARR retention rate is a function of higher product upsell/cross-sell and stabilizing churn. Darktrace is investing in its customer success function, which should help stabilize churn and drive higher upsells/cross-sells at the point of renewal. That said, given the SMB/mid-market heavy customer base (which is characterized by higher churn compared to larger enterprise customers) and multiple products purchased at the initial point of sale (which limits the scope of cross-sells), Darktrace does not expect to see a significant improvement in net ARR retention rate going forward (the improvement, if any, is likely to be more gradual). | ||
| Line 533: | Line 531: | ||
'''Figure 9: Period-end 1-year gross ARR churn (%)<ref>Source: Company data; one-year gross ARR churn rate is defined as the ARR value of customers lost from the existing customer cohort one year prior to the measurement date, divided by the total ARR value of that existing customer cohort (this metric reflects only customer losses and does not reflect expansions or contractions); FY ends in Jun.</ref>''' | '''Figure 9: Period-end 1-year gross ARR churn (%)<ref>Source: Company data; one-year gross ARR churn rate is defined as the ARR value of customers lost from the existing customer cohort one year prior to the measurement date, divided by the total ARR value of that existing customer cohort (this metric reflects only customer losses and does not reflect expansions or contractions); FY ends in Jun.</ref>''' | ||
'''Figure 10: Period-end net ARR retention rate (%)<ref>Source: Company data; net ARR retention rate is defined as the current ARR value for all customers that were customers one year prior to the measurement date, divided by their ARR one year prior to the measurement date (this metric reflects customer losses, expansions and contractions); FY ends in Jun.</ref>''' | '''Figure 10: Period-end net ARR retention rate (%)<ref>Source: Company data; net ARR retention rate is defined as the current ARR value for all customers that were customers one year prior to the measurement date, divided by their ARR one year prior to the measurement date (this metric reflects customer losses, expansions and contractions); FY ends in Jun.</ref>''' | ||
=== Go-to-market === | === Go-to-market === | ||
Darktrace sees its offerings as complementary to an enterprise’s existing security investments. The company sees a large greenfield opportunity for its products (a potential addressable customer base of >150k across industries) – accordingly, Darktrace remains focused on acquiring new customers and driving high platform adoption at the initial point of purchase. | Darktrace sees its offerings as complementary to an enterprise’s existing security investments. The company sees a large greenfield opportunity for its products (a potential addressable customer base of >150k across industries) – accordingly, Darktrace remains focused on acquiring new customers and driving high platform adoption at the initial point of purchase. | ||
| Line 553: | Line 551: | ||
Given Darktrace’s strategic focus on acquiring new customers, its ARR growth is dependent on the scaling of its POV trials. This in turn is dependent on hiring of new account executives (AEs). Darktrace has indicated that ~24% of its POVs were generated exclusively by its inside sales team. The inside sales teams are incentivized based on the number of qualified meetings booked as % of closed deals. Around 28% of Darktrace’s POVs come from the partner channel. | Given Darktrace’s strategic focus on acquiring new customers, its ARR growth is dependent on the scaling of its POV trials. This in turn is dependent on hiring of new account executives (AEs). Darktrace has indicated that ~24% of its POVs were generated exclusively by its inside sales team. The inside sales teams are incentivized based on the number of qualified meetings booked as % of closed deals. Around 28% of Darktrace’s POVs come from the partner channel. | ||
'''Figure 11: Snapshot of Darktrace's POV-led sales cycle'''<ref name=":2" />'''<br />''' | '''Figure 11: Snapshot of Darktrace's POV-led sales cycle'''<ref name=":2" />'''<br />''' | ||
Darktrace sells its platform both directly to customers and through its channel partners (including resellers and managed security service providers). A majority of Darktrace’s sales (~65%) are generated via its direct sales personnel. | Darktrace sells its platform both directly to customers and through its channel partners (including resellers and managed security service providers). A majority of Darktrace’s sales (~65%) are generated via its direct sales personnel. | ||
| Line 583: | Line 581: | ||
'''Figure 12: Network Detection & Response (NDR) market ($. m): CY19-25'''<ref name=":3">Source: Gartner.</ref> | '''Figure 12: Network Detection & Response (NDR) market ($. m): CY19-25'''<ref name=":3">Source: Gartner.</ref> | ||
'''Figure 13: Network Detection & Response: CY21 Market share<ref name=":3" />''' | '''Figure 13: Network Detection & Response: CY21 Market share<ref name=":3" />''' | ||
Demand for NDR solutions will likely remain high as enterprises introduce an added layer of network traffic visibility to their layered security stack; however, competition in this space remains intense. There are more than 20 vendors offering NDR solutions ranging from early-/mid-stage start-ups to large, established cybersecurity companies. NDR vendor offerings have also matured with basic capabilities and on-premises/cloud/SaaS coverage provided by most vendors. | |||
Further, as enterprises increasingly incorporate NDR as part of their security stack, enterprise awareness of different vendor offerings in this space is likely to increase. | Further, as enterprises increasingly incorporate NDR as part of their security stack, enterprise awareness of different vendor offerings in this space is likely to increase. | ||
| Line 738: | Line 737: | ||
'''Figure 14: Alternatives considered in the evaluation of Darktrace products (number of mentions)<ref>Source: J.P. Morgan; based on survey responses from 30 current/past Darktrace customers.</ref>''' | '''Figure 14: Alternatives considered in the evaluation of Darktrace products (number of mentions)<ref>Source: J.P. Morgan; based on survey responses from 30 current/past Darktrace customers.</ref>''' | ||
Another striking point from the survey is the lack of broader awareness of vendors providing similar solutions targeting use-cases such as network traffic monitoring, autonomous response or integrated cloud email security solutions. As an example, several survey respondents that highlighted ‘APT/internal threats’ and ‘network traffic visibility’ as key business problems were unaware of NDR vendors beyond Darktrace and instead cited endpoint security platforms or managed SIEMs as alternatives in the evaluation process. Similarly, none of the survey respondents highlighted integrated cloud email security competitors to Darktrace in evaluation of Darktrace’s email product. This clearly demonstrates the value of Darktrace’s marketing efforts; however, JP Morgan does not see this as a sustainable differentiator going forward. With growing vendor awareness, the security vendor selection criteria are likely to shift from “the business problems addressed” to “product experience and price”. | |||
=== Experience with using Darktrace products === | === Experience with using Darktrace products === | ||
| Line 757: | Line 758: | ||
'''Figure 15: Darktrace: Weighted-average rating across key dimensions (aggregate)<ref>Source: J.P. Morgan; average values based on survey conducted across 30 current/past Darktrace customers; 1=extremely dissatisfied, 2=somewhat dissatisfied, 3=neither satisfied nor dissatisfied, 4=somewhat satisfied, 5=extremely satisfied.</ref>''' | '''Figure 15: Darktrace: Weighted-average rating across key dimensions (aggregate)<ref>Source: J.P. Morgan; average values based on survey conducted across 30 current/past Darktrace customers; 1=extremely dissatisfied, 2=somewhat dissatisfied, 3=neither satisfied nor dissatisfied, 4=somewhat satisfied, 5=extremely satisfied.</ref>''' | ||
'''<br />Figure 16: Darktrace: Weighted-average rating across key dimensions (past customers)<ref>Source: J.P. Morgan; average values based on inputs from 17 past Darktrace customers (out of a total of 30).</ref>''' | |||
'''<br />Figure 17: Darktrace: Weighted-average rating across key dimensions (current customers)<ref>Source: J.P. Morgan; average values based on inputs from 13 current Darktrace customers (out of a total of 30).</ref>''' | |||
{| class="wikitable" | {| class="wikitable" | ||
|+Table 6: Responses to the question "What do you most like/dislike about Darktrace products?" by current Darktrace customers (n=13)<ref>Source: J.P. Morgan. Survey comments have been reproduced in their original form and have not been edited except as indicated. Survey comments should not be attributed to J.P. Morgan and are not representative of its views.</ref> | |+Table 6: Responses to the question "What do you most like/dislike about Darktrace products?" by current Darktrace customers (n=13)<ref>Source: J.P. Morgan. Survey comments have been reproduced in their original form and have not been edited except as indicated. Survey comments should not be attributed to J.P. Morgan and are not representative of its views.</ref> | ||
| Line 1,087: | Line 1,086: | ||
'''Figure 18: Top reasons for discontinuing Darktrace products<ref>Source: J.P. Morgan; A total of 17 out of 30 respondents indicated that they discontinued the use of Darktrace products – survey participants were given the option of selecting multiple reasons; *poor product performance includes factors such as high number of false positives, failure to detect serious threats, etc.</ref>''' | '''Figure 18: Top reasons for discontinuing Darktrace products<ref>Source: J.P. Morgan; A total of 17 out of 30 respondents indicated that they discontinued the use of Darktrace products – survey participants were given the option of selecting multiple reasons; *poor product performance includes factors such as high number of false positives, failure to detect serious threats, etc.</ref>''' | ||
== ARR growth tied to new customer acquisition == | == ARR growth tied to new customer acquisition == | ||
A significant portion of Darktrace’s total addressable market opportunity depends on the company’s ability to grow its ARR independent of new customer acquisition. However, despite reporting higher platform adoption stats in the last couple of years, the company has not reported any meaningful uptick in average contract ARR (Dec- 21 level approx. flat vs. Jun-19). This is partly explained by Darktrace’s focus on acquiring new customers, SMB/mid-market skew in customer base and impact from new product launches. It remains to be seen whether Darktrace can decouple ARR growth from new customer acquisition, which JP Morgan believes will only get tougher with high competition and growing enterprise awareness of competing vendors. Unless the quality (in terms of stickiness) of the customer base acquired is high, focus on new customer acquisition will not translate to sustainable profitable growth, in JP Morgan's view, even though the company may deliver healthy growth in the near term. | A significant portion of Darktrace’s total addressable market opportunity depends on the company’s ability to grow its ARR independent of new customer acquisition. However, despite reporting higher platform adoption stats in the last couple of years, the company has not reported any meaningful uptick in average contract ARR (Dec- 21 level approx. flat vs. Jun-19). This is partly explained by Darktrace’s focus on acquiring new customers, SMB/mid-market skew in customer base and impact from new product launches. It remains to be seen whether Darktrace can decouple ARR growth from new customer acquisition, which JP Morgan believes will only get tougher with high competition and growing enterprise awareness of competing vendors. Unless the quality (in terms of stickiness) of the customer base acquired is high, focus on new customer acquisition will not translate to sustainable profitable growth, in JP Morgan's view, even though the company may deliver healthy growth in the near term. | ||
| Line 1,120: | Line 1,121: | ||
'''Figure 19: Evolution of period-end constant currency ARR ($, m)<ref>Source: Company data; rates established at the start of each year; for FY22, constant currency rates were 1.3835 and 1.1878 for GBP and EUR, respectively; FY ends in Jun.</ref>''' | '''Figure 19: Evolution of period-end constant currency ARR ($, m)<ref>Source: Company data; rates established at the start of each year; for FY22, constant currency rates were 1.3835 and 1.1878 for GBP and EUR, respectively; FY ends in Jun.</ref>''' | ||
'''Figure 20: Period-end cc average contract ARR ($, '000s)<ref>Source: Based on company data; calculated as period-end cc ARR divided by period-end number of customers; FY ends in Jun.</ref>''' | '''Figure 20: Period-end cc average contract ARR ($, '000s)<ref>Source: Based on company data; calculated as period-end cc ARR divided by period-end number of customers; FY ends in Jun.</ref>''' | ||
'''Figure 21: One-year gross cc ARR churn (%)<ref>Source: Company data; FY ends in Jun.</ref>''' | |||
'''Figure | '''Figure 22: Net ARR retention rate (%)<ref>Source: Company data; FY ends in Jun.</ref><br />''' | ||
While weJP Morgan acknowledges the skew in Darktrace’s customer base towards SMB/mid- market enterprises, the above factors do not entirely explain why the company has not delivered any significant uplift in average contract ARR. | |||
Darktrace operates in a highly competitive market with broadly similar offerings available from competing vendors. This likely limits the company’s ability to price its products at a premium and increases retention costs. This could partly explain why the company has not seen a meaningful contract ARR uplift despite selling more product modules to its customer base (additional features bundled together to drive retention). This will not impact gross margin necessarily as providing a new product module such as AI analyst or Antigena autonomous response does not require shipping an additional appliance (for on-premises deployments) and may not result in a commensurate increase in hosting costs for cloud-delivered solutions. | Darktrace operates in a highly competitive market with broadly similar offerings available from competing vendors. This likely limits the company’s ability to price its products at a premium and increases retention costs. This could partly explain why the company has not seen a meaningful contract ARR uplift despite selling more product modules to its customer base (additional features bundled together to drive retention). This will not impact gross margin necessarily as providing a new product module such as AI analyst or Antigena autonomous response does not require shipping an additional appliance (for on-premises deployments) and may not result in a commensurate increase in hosting costs for cloud-delivered solutions. | ||
| Line 1,151: | Line 1,148: | ||
'''Figure 23: Period-end constant-currency ARR ($, m): 2019-24E'''<ref>Source: Company data, J.P. Morgan estimates. Constant currency rates: 1.3835 and 1.1878 for the British Pound and the Euro, respectively; FY ends in Jun.</ref> | '''Figure 23: Period-end constant-currency ARR ($, m): 2019-24E'''<ref>Source: Company data, J.P. Morgan estimates. Constant currency rates: 1.3835 and 1.1878 for the British Pound and the Euro, respectively; FY ends in Jun.</ref> | ||
'''Figure 24: Period-end number of customers and net new customers added: 2019-24E'''<ref>Source: Company data, J.P. Morgan estimates; FY ends in Jun.</ref> | '''Figure 24: Period-end number of customers and net new customers added: 2019-24E'''<ref>Source: Company data, J.P. Morgan estimates; FY ends in Jun.</ref> | ||
Darktrace generates revenue almost exclusively (99%+) from subscription contracts (with an average contract term of ~3 years). Revenue from these subscription contracts is recognized ratably over the contract period. Darktrace has high revenue visibility, with ~80% of annual revenue underpinned by the backlog at the beginning of the period. Based on JP Morgan's ARR assumptions highlighted above, JP Morgan models revenue to grow 48% YoY to $415m in 2022; JP Morgan's revenue growth estimate of 48% stands slightly above Darktrace’s guided range of 44.5%-46.5%. JP Morgan models revenue growth to slow to 32%/28% in 2023/24, mimicking the trend in ARR growth during these periods. | Darktrace generates revenue almost exclusively (99%+) from subscription contracts (with an average contract term of ~3 years). Revenue from these subscription contracts is recognized ratably over the contract period. Darktrace has high revenue visibility, with ~80% of annual revenue underpinned by the backlog at the beginning of the period. Based on JP Morgan's ARR assumptions highlighted above, JP Morgan models revenue to grow 48% YoY to $415m in 2022; JP Morgan's revenue growth estimate of 48% stands slightly above Darktrace’s guided range of 44.5%-46.5%. JP Morgan models revenue growth to slow to 32%/28% in 2023/24, mimicking the trend in ARR growth during these periods. | ||
'''Figure 25: Revenue ($, m): 1H20-2H24E'''<ref name=":4">Source: Company data, J.P. Morgan estimates; FY ends in Jun.</ref> | '''Figure 25: Revenue ($, m): 1H20-2H24E'''<ref name=":4">Source: Company data, J.P. Morgan estimates; FY ends in Jun.</ref> | ||
'''Figure 26: Revenue ($, m): 2018-24E'''<ref name=":4" /> | '''Figure 26: Revenue ($, m): 2018-24E'''<ref name=":4" /> | ||
== Risks to profitability == | == Risks to profitability == | ||
| Line 1,172: | Line 1,161: | ||
=== Higher cloud deployments likely to pressure gross margins === | === Higher cloud deployments likely to pressure gross margins === | ||
This cost bucket primarily includes costs associated with deploying Darktrace software – either via physical appliances or via cloud. Costs associated with providing customer support and supplementary monitoring and response capabilities (‘concierge’ services). Darktrace does not earn any material revenue from selling physical appliances – the company considers physical appliances as its assets, with the corresponding depreciation logged either as cost of sales (for appliances deployed at contracted customer sites) or as sales and marketing expenses (for appliances used in customer acquisition, i.e. as part of the POV process). With a growing portion of cloud-hosted product sales, the portion of hosting costs will increase. The company expects the increase in hosting costs to be partly offset by a decline in appliance depreciation (substitution effect). JP Morgan models Darktrace’s cost of sales as % of revenue to increase gradually from 10% in 2021 to 12.5% in 2024. | This cost bucket primarily includes costs associated with deploying Darktrace software – either via physical appliances or via cloud. Costs associated with providing customer support and supplementary monitoring and response capabilities (‘concierge’ services). Darktrace does not earn any material revenue from selling physical appliances – the company considers physical appliances as its assets, with the corresponding depreciation logged either as cost of sales (for appliances deployed at contracted customer sites) or as sales and marketing expenses (for appliances used in customer acquisition, i.e. as part of the POV process). With a growing portion of cloud-hosted product sales, the portion of hosting costs will increase. The company expects the increase in hosting costs to be partly offset by a decline in appliance depreciation (substitution effect). JP Morgan models Darktrace’s cost of sales as % of revenue to increase gradually from 10% in 2021 to 12.5% in 2024. | ||
'''<br />Figure 27: Darktrace: Cost of sales as % of revenue: 2019-24E'''<ref>Source: Company data, J.P. Morgan estimates; FY ends in Jun.</ref> | |||
=== Sales & Marketing expenses likely to remain elevated === | === Sales & Marketing expenses likely to remain elevated === | ||
Darktrace has reported scale efficiencies in its core non-T&E operating costs (excluding share-based | Darktrace has reported scale efficiencies in its core non-T&E operating costs (excluding share-based comp and associated employer tax charges) in recent years, with total non-T&E operating expenses as a % of revenue declining from 86% in 2020 to 74% in 1H22. This is primarily a function of some scale efficiencies the company has reported in its marketing function. Adding back share-based comp and associated charges, non-T&E opex as % of revenue declined from 91% in 2020 to 84% in 1H22. Margin performance in 1H22 was helped by the following one-off components (these costs will likely return through 2H22/2023): | ||
* Impact from pandemic-related sales hiring delays; Darktrace is still getting back to its normal cadence of salesforce hiring and expects a catch-up in employee costs over the coming months; | * Impact from pandemic-related sales hiring delays; Darktrace is still getting back to its normal cadence of salesforce hiring and expects a catch-up in employee costs over the coming months; | ||
* Lower facilities/office costs as the return to office was delayed. | * Lower facilities/office costs as the return to office was delayed. | ||
While the company has not quantified the impact from these factors, it notes seeing some scale efficiencies, driven by a more efficient marketing function. The majority of sales and marketing expenses (salaries + 50% sales commissions) associated with revenue generated in a given period are incurred in prior periods (during contract acquisition) – this coupled with some improvement in marketing efficiency has translated to scale efficiencies. Darktrace sees a healthy pipeline of potential new customer opportunities and stable POV conversion rates (although the company has not disclosed this metric). However, JP Morgan believes it is too early to extrapolate this trend to outer years, given the increase in competitive intensity. Wage inflation is another factor to be considered in assessing the evolution of margin going forward. | While the company has not quantified the impact from these factors, it notes seeing some scale efficiencies, driven by a more efficient marketing function. The majority of sales and marketing expenses (salaries + 50% sales commissions) associated with revenue generated in a given period are incurred in prior periods (during contract acquisition) – this coupled with some improvement in marketing efficiency has translated to scale efficiencies. Darktrace sees a healthy pipeline of potential new customer opportunities and stable POV conversion rates (although the company has not disclosed this metric). However, JP Morgan believes it is too early to extrapolate this trend to outer years, given the increase in competitive intensity. Wage inflation is another factor to be considered in assessing the evolution of margin going forward. | ||
'''<br />Figure 28: Non-T&E operating expenses* (total) as % of revenue<ref name=":5">Source: Company data *includes share-based comp and associated employer tax charges; FY ends in Jun.</ref>''' | |||
'''Figure 29: Non-T&E S&M expenses* as % of revenue<ref name=":5" />''' | '''Figure 29: Non-T&E S&M expenses* as % of revenue<ref name=":5" />''' | ||
=== R&D intensity needs to pick up to create a sustainable moat === | === R&D intensity needs to pick up to create a sustainable moat === | ||
Non-T&E R&D expenses grew as % of revenue from 6% in 2020 to 8% in 1H22 (although this metric declined from 12% in 2H21). This was partly aided in 1H22 due to capitalization of share-based | Non-T&E R&D expenses grew as % of revenue from 6% in 2020 to 8% in 1H22 (although this metric declined from 12% in 2H21). This was partly aided in 1H22 due to capitalization of share-based comp and related tax charges associated with development projects that met the capitalization criteria. One criticism of the Darktrace model has been the low R&D spend, both absolute and as % of revenue, compared to US cybersecurity peers. According to Darktrace, this is due to low R&D employee costs (given the company’s R&D function is primarily based in Cambridge, UK) and relatively lower development expenses needed for maintaining the self-learning cyber AI platform. The argument is that, unlike other cybersecurity companies that rely on historical threat signatures, Darktrace does not need to constantly update its platform to account for new detected threat signatures; accordingly, the company’s R&D dollars are primarily spent on new product development and research. | ||
While there is substance to this argument, JP Morgan believes that new product development and platform enhancements will be increasingly important in an environment where technical and product differentiation vs. the competition narrows. This may necessitate higher R&D investment (as % of revenue), going forward, if Darktrace is to maintain its edge over competition. JP Morgan believes R&D expenses as % of revenue should tick up in 2H22 following the Cybersprint acquisition. | While there is substance to this argument, JP Morgan believes that new product development and platform enhancements will be increasingly important in an environment where technical and product differentiation vs. the competition narrows. This may necessitate higher R&D investment (as % of revenue), going forward, if Darktrace is to maintain its edge over competition. JP Morgan believes R&D expenses as % of revenue should tick up in 2H22 following the Cybersprint acquisition. | ||
| Line 1,199: | Line 1,186: | ||
'''Figure 30: Non-T&E R&D expenses* as % of revenue'''<ref name=":5" /> | '''Figure 30: Non-T&E R&D expenses* as % of revenue'''<ref name=":5" /> | ||
'''Figure 31: Non-T&E G&A expenses* as % of revenue<ref name=":5" /><br />''' | |||
'''Figure 31: Non-T&E G&A expenses* as % of revenue<ref name=":5" /><br />''' | |||
Darktrace reported total T&E expenses of $1.8m in 2021, down from $21m in 2020 (normalized 2020 T&E expense is $27-28m). The company reported a lower-than- expected T&E expense in 1H22 of $2.7m – with economies opening up and travel returning to normal, Darktrace expects a steep ramp in T&E expenses in 2H22, returning to a more normalized run-rate. | Darktrace reported total T&E expenses of $1.8m in 2021, down from $21m in 2020 (normalized 2020 T&E expense is $27-28m). The company reported a lower-than- expected T&E expense in 1H22 of $2.7m – with economies opening up and travel returning to normal, Darktrace expects a steep ramp in T&E expenses in 2H22, returning to a more normalized run-rate. | ||
Factoring-in these assumptions, JP Morgan models total opex (incl. share-based | Factoring-in these assumptions, JP Morgan models total opex (incl. share-based comp and associated tax charges) as % of revenue to tick up slightly from 97% in 2022 to 100% in 2023 (driven by the full year impact of normalized T&E expenses and normalized salesforce hiring), followed by a decline to 96% in 2024. JP Morgan models share-based comp and associated employer tax charges to be ~11% of revenue throughout JP Morgan's forecast period. | ||
'''Figure 32: Total opex as % of revenue: 2019-24E'''<ref name=":6">Source: Company data, J.P. Morgan estimates; FY ends in Jun.</ref> | '''Figure 32: Total opex as % of revenue: 2019-24E'''<ref name=":6">Source: Company data, J.P. Morgan estimates; FY ends in Jun.</ref> | ||
'''Figure 33: Total opex (excl. charges associated with share-based comp) as % of revenue: 2019-24E<ref name=":6" />''' | '''Figure 33: Total opex (excl. charges associated with share-based comp) as % of revenue: 2019-24E<ref name=":6" />''' | ||
Given JP Morgan's assumptions on opex, JP Morgan models continued operating loss throughout JP Morgan's forecast horizon. Even after excluding share-based comp and associated employer tax charges, JP Morgan does not model any significant improvement in adjusted EBIT margin during JP Morgan's forecast horizon. | |||
Given JP Morgan's assumptions on opex, JP Morgan models continued operating loss throughout JP Morgan's forecast horizon. Even after excluding share-based | |||
=== Long-term steady-state model === | === Long-term steady-state model === | ||
| Line 1,228: | Line 1,209: | ||
'''Figure 34: Adj. EBIT margin (%): 2019-24E'''<ref name=":7">Source: Company data, J.P. Morgan estimates; FY ends in Jun.</ref> | '''Figure 34: Adj. EBIT margin (%): 2019-24E'''<ref name=":7">Source: Company data, J.P. Morgan estimates; FY ends in Jun.</ref> | ||
'''Figure 35: Adj. EBIT margin (%): Long-term steady-state model'''<ref name=":8">Source: Company data.</ref> | '''Figure 35: Adj. EBIT margin (%): Long-term steady-state model'''<ref name=":8">Source: Company data.</ref> | ||
=== The pursuit of growth will likely limit margin improvement === | === The pursuit of growth will likely limit margin improvement === | ||
Adjusted EBITDA is calculated as EBITDA plus share-based | Adjusted EBITDA is calculated as EBITDA plus share-based comp and associated employer tax charges less appliance depreciation incurred as part of cost of sales (i.e. depreciation of appliances deployed at customer sites). JP Morgan models adjusted EBITDA of ~$50m in 2022 with ~12% margin, at the high end of Darktrace’s guided range of 10-12%. Darktrace expects a steep dip in adjusted EBITDA margin in 2H22 following 24% margin in 1H22. This is driven by the following factors: | ||
* Ramp in T&E expenses; | * Ramp in T&E expenses; | ||
| Line 1,245: | Line 1,222: | ||
'''Figure 36: Adjusted EBITDA ($, m) and margin (%): 2019-24E<ref name=":7" />''' | '''Figure 36: Adjusted EBITDA ($, m) and margin (%): 2019-24E<ref name=":7" />''' | ||
'''Figure 37: Adjusted EBITDA margin (%): 1H20-2H24E<ref name=":7" />''' | '''Figure 37: Adjusted EBITDA margin (%): 1H20-2H24E<ref name=":7" />''' | ||
Early success in the AI-driven threat detection and response market has helped Darktrace scale rapidly, delivering above-average growth (52% 2018-21 revenue CAGR); however, the eventual success of the company will be determined by how the company balances growth and profitability. Assessing this development through the lens of the ‘Rule of 40’ is a good indicator of the progress the company is making to sustain profitable growth. The Rule of 40 is the principle that the sum of revenue growth and profitability measure for successful business models should exceed 40%. JP Morgan uses the sum of revenue growth and free cash flow margin (FCF calculated as cash flow from operations less tangible and intangible capex) as a gauge of the success of Darktrace’s business model. With growing competition and commoditization in the AI-driven threat detection and response market, the sum of revenue growth and free cash flow margin is likely to dip and remain below 40% over the next couple of years, in JP Morgan's view (JP Morgan models 38%/35% in 2023/24, down from 58% in 2022). JP Morgan believes that this outcome will be reflected in Darktrace’s valuation compared to other cybersecurity peers that consistently beat the 40% benchmark. | Early success in the AI-driven threat detection and response market has helped Darktrace scale rapidly, delivering above-average growth (52% 2018-21 revenue CAGR); however, the eventual success of the company will be determined by how the company balances growth and profitability. Assessing this development through the lens of the ‘Rule of 40’ is a good indicator of the progress the company is making to sustain profitable growth. The Rule of 40 is the principle that the sum of revenue growth and profitability measure for successful business models should exceed 40%. JP Morgan uses the sum of revenue growth and free cash flow margin (FCF calculated as cash flow from operations less tangible and intangible capex) as a gauge of the success of Darktrace’s business model. With growing competition and commoditization in the AI-driven threat detection and response market, the sum of revenue growth and free cash flow margin is likely to dip and remain below 40% over the next couple of years, in JP Morgan's view (JP Morgan models 38%/35% in 2023/24, down from 58% in 2022). JP Morgan believes that this outcome will be reflected in Darktrace’s valuation compared to other cybersecurity peers that consistently beat the 40% benchmark. | ||
'''Figure 38: Revenue growth (%) + FCF growth (%)'''<ref name=":9" /> | '''Figure 38: Revenue growth (%) + FCF growth (%)'''<ref name=":9" /> | ||
== Shifting the focus to profitability == | == Shifting the focus to profitability == | ||
| Line 2,952: | Line 2,923: | ||
==Notes== | ==Notes== | ||