HP’s Fortify Buyout Numbers Tell Lucrative Story For Software Security

By ANDY GREENBERG

When HP announced yesterday that it would acquire software security scanning firm Fortify, the news contradicted hints of an upcoming IPO that Fortify chief executive John Jack had dropped in an interview with me earlier this year. But Gary McGraw, who serves on Fortify’s technical advisory board, says that a public offering was just plan B.

Plan A, for the last year, has been to sell to HP for a hefty sum–which is what the fast-growing firm got. McGraw says Fortify made $44.3 million in revenue last year and sold to HP at a multiple of close to six times those sales.

HP wouldn’t immediately confirm those numbers. But if they’re right, that would put the buyout in the range of $265 million–not a bad outcome for Kleiner Perkins Caufield & Byers, which led a $40 million investment round to create Fortify in 2003.

“This is a classic Silicon Valley success story for Kleiner Perkins,” says McGraw, who also serves as chief technology officer for the security consultancy Cigital. “It shows that the economy isn’t a complete disaster, that things are turned on, that this software security stuff is working.”

That six-times-revenue buyout is higher even than other recent acquisitions of firms similar to Fortify that aim to build security into software development. McGraw claims that Ounce Labs, which was acquired by IBM last year, sold for $27 million, which he says was between four and 5.5 times revenue. And he says he’s learned that SPI Dynamics sold to HP in 2007 for $100 million at a sales multiple of 5.5, just a few weeks after IBM bought Watchfire for $85 million at a multiple of 2.8 over revenue.

McGraw says he helped found Fortify in 2003 when Ted Schlein at Kleiner Perkins licensed a code scanning technology that Cigital’s researchers had developed. He describes its metamorphosis into a fast-growing business as one of the few times he’s seen pure research successfully make the jump from theory to practice. “Usually scientists build cool prototypes and have no idea how to get people to care about them,” says McGraw. “This kind of technology transfer, although everyone talks about it like it happens all the time, is very rare. This is a case where it worked.”