A Retrospective on Veritas

Symantec and Veritas were a weird couple that never made sense. Has Veritas finally found its forever home?

In the early days, we didn't know what security was supposed to look like. As a program, as a discipline, as a career, as a market.

Like patching, backups were security-adjacent but never really considered a ‘pure play’ security product. It was a little odd for Symantec to acquire Veritas, but what did we know? Everything was new back then. Maybe hybrid IT/security vendors would be the thing from now on. We still see some of that today where there is clear synergy between the IT and security sides, like with data (Splunk, Elastic, DataDog, etc).

It was announced last week that Veritas and Cohesity will merge (it sounds like a merger, at least), which seems a much better fit than Symantec ever was. This seemed like an excellent opportunity to do a bit of a retrospective.

In the year 2000…

Symantec paid $13.5B (a 6.75x revenue multiple) for Veritas in an all-stock deal that closed in 2005 (okay, not quite 2000). The pairing didn't make a lot of sense and was later undone. It’s said that, after the acquisitions, Symantec and Veritas continued operating independently.

What a difference ten years can make! In 2014, Symantec was getting bloodied by 'next-gen' AV startups like Crowdstrike and Cylance. The endpoint security incumbents, Symantec and McAfee, rejected innovation, resulting in the creation of their own worst enemies. This occurred directly in the case of McAfee, as Crowdstrike and Cylance’s founders both came from leadership roles there before founding the companies that would outcompete their former employer. This battle would inevitably see Symantec and McAfee be taken private and dismantled by private equity.

To drive my point home - can you recall what Symantec and McAfee are called these days, without looking it up? I’ll put the answer at the end of this piece if you give up.

Symantec at least had the foresight to see that they needed to focus on security, so in late 2014, they announced the sale of Veritas to The Carlyle Group, a private equity firm. Completed in February 2016, the deal was only for $8B. The revenue multiple was less than half (3.08x) what Symantec paid ten years prior.

The acqui-merger-combination

Somehow, another ten years have passed (I feel OLD), and Carlyle is selling off Veritas in what appears to be a merger. The press release never uses the term “acquisition” or “merger.” The businesses will instead “combine” and are referred to as “the combined company” thereafter.

While we can’t estimate a multiple for the sale of Veritas alone, the press release does share combined numbers: $1.6B in total revenue, $1.3B ARR, and a combined valuation of $7B. Combined, the companies are targeting a market with a $30B TAM that I suspect is likely shrinking, as many of the products and services offered here are increasingly consumed as features within other platforms (e.g., AWS Glacier).

This isn’t the most exciting product category, but it also doesn’t seem like one that is going away any time soon. I’m just glad that, after 20 long years, Veritas finally has a home that makes sense.

What’s in a name?

If you’ve given up, here’s what happened with the branding.

Symantec was split into two, with the enterprise software becoming a product within Broadcom called Symantec Enterprise Cloud. The consumer side of the business was rebranded as Norton LifeLock and later rebranded again as Gen Digital after merging with Avast.

As for McAfee, the name stayed with the consumer product, while the enterprise business was split off and split again into two pieces by STG: the SSE products became Skyhigh Networks, and the remainder of McAfee’s enterprise business was merged with FireEye (which was split off from Mandiant) and rebranded as Trellix.

Editors Note: If you can follow all that splitting and rebranding, you deserve a cookie!