Carbon Black (CBLK, Financial) is a technology company that belongs to the industry of application software. The company is involved in the provision of end-point (any device that connects to an enterprise’s network) cyber security solutions, including end-point detection and response. Carbon Black’s software allows customers to defend against malware, ransomware and other cyber attacks. The Massachusetts-based company serves more than 4,000 customers globally.
Revenue insights
Carbon Black is witnessing double-digit growth, with revenue up 34.8% year-over-year to $48.4 million during the first quarter 2018. The company generates most of its revenue from subscriptions to its security software, followed by subscription to its cloud platform. During the quarter ended March 2018, Carbon Black generated 66% of its revenue from its on-premise software solution.
However, revenue is shifting aggressively towards cloud services as subscriptions reached 24% of the total revenue during the first quarter of 2018, compared to 11% a year before. Moreover, customers of cloud services increased from 552 to 1,870 over the span of only one year. Overall, Carbon Black is witnessing double-digit growth, with revenue moving increasingly towards the cloud.
Competition insights
- Carbon Black is leading in the EDR market.
Carbon Black offers one of the strongest end-point detection and response (EDR) solution in the market. IDC, a research firm and a vendor analyst, puts Carbon Black in a leading position in specialized threat analysis and protection (STAP) category of cyber security. IDC argues that “Carbon Black is a differentiator against competitors’ products.” However, the market is not without competition. Crowdstrike, another cyber security pure play, offers a strong end-point detection portfolio that surpasses Carbon Black in some areas of functionality. According to a recent report from Forrester, Crowdstrike is quite ahead of Carbon Black in terms of product offerings.
“CrowdStrike understands and articulates the problem of combating sophisticated actors better than anyone. It has built an EDR product company buttressed with threat intelligence and digital forensic services that are widely respected across the industry,” noted Forrester in its EDR third quarter 2018 report. Note that although Carbon Black is lagging behind Crowdstrike, it’s still in the leading category of EDR in Forrester’s Wave.
- Carbon Black is lagging in EPP.
Carbon Black is neither a leader nor a challenger in end-point protection platforms (EPP) – a platform deployed on end-points to detect malware and protect against malicious activity – according to Gartner’s magic quadrant.
Endpoint-protection platforms are more of a unified security solution that also includes EDR. It is worth mentioning that Carbon Black didn’t improve its position in Gartner’s magic quadrant and holds the same visionary position it held in the last year’s magic quadrant.
Furthermore, Carbon Black also didn’t make it to Forrester’s econd quarter Wave for end-point security suites; it’s more of a borderline leader in unified security suites.
Moreover, Carbon Black faces serious competition from the like of Trend Micro (TMICY, Financial) and Sophos, who have a strong presence in the EPP market. Note that both Trend Micro and Sophos are in the leading position alongside Symantec (SYMC, Financial) in the end-point protection market.
Regarding the competitive landscape, it looks like Carbon Black is leading in some areas of cyber security while it continues to lag behind competition in providing a unified solution. On one hand, the company offers one of the premium end-point detection and response (EDR) solutions. On the other hand, this strength isn’t translating into a unified solution that can be truly termed as a leader among competitors' EPP offerings.
The bottom line is that Carbon Black might benefit from the growth of EDR, but taking a bite from unified end-point security might prove difficult for the company going forward.
What’s the outlook?
While Carbon Black isn’t a leader in unified end-point cyber security, it’s also a fact that the company provides best-in-class end-point detection and response (EDR) solutions. That means this cyber security pure play will probably capitalize on the growth prospects of one specific area of cyber security, i.e., EDR, going forward.
Thanks to prevailing bring-your-own-device culture in corporations, end-point threat detection is getting increasingly important. TechNavio forecasts the global endpoint detection and response market to grow at a CAGR of almost 9% during 2017 to 2021. They argue that growing cyber attacks and threats from hackers are driving this growth in EDR. Transparency Market Research holds similar views as TechNavio. It has the following to say about the EDR market:
“As the customized targeted malware attack toolkits and advanced persistent threats (APTs) are increasingly creating threats, the use of endpoint detection and response solutions will prove to be a boon to several organizations.”
Another, rather optimistic, report estimated that the EDR market wwould grow at 25% per year to reach approximately $2.3 billion by 2021. Statista has also projected a 24.5% CAGR for the end-point detection and response market during 2017 to 2020.
It can be seen that both research firms are expecting double-digit growth in EDR going forward. In summary, the EDR industry is set to witness growth that can range from high single-digits to as high as 25% per year. This puts Carbon Black in a favorable position because it’s a leading company in the threat detection and response niche.
Valuation insights
Carbon Black is priced at quite a premium. The end-point cyber security company is trading at a forward price-sales of about 8, which is very high even for a growth company.
Although the company is trading at a very high price-sales ratio, growth forecasts are also very rosy. And, Carbon Black is a leader in EDR market alongside Crowdstrike; the market isn’t flooded with leading-edge competition.
Given that the market is expected to reach about $2 billion by 2020, Carbon Black and Crowdstrike have plenty of addressable market to share between them. With revenue to reach $203 million in 2018, Carbon Black has a lot of room to expand its top line. Moreover, analysts are forecasting 30% per-year growth for Carbon Black going forward. This also puts the company in a favorable position as far as relative valuation is concerned.
To put valuation in perspective, note that if Carbon Black grows its revenue at 25% per year during the next three years, it price-sales ratio will fall below 5, which is an acceptable sales multiple for a growth company. Valuation will become reasonable if Carbon Black continues to differentiate in the EDR market.
Final thoughts
Although Carbon Black lacks leadership capabilities in the unified end-point cyber security market, it’s exposed to the growth prospects of end-point detection and response cyber security market.
The company has best-in-class EDR solutions, which are backed by several vendor analysts including Gartner, IDC and Forrester. Due to absence of many leaders in the EDR market, Carbon Black will materially capitalize on the growth prospects of the industry.
While the market is attaching a premium to the stock, it is warranted because high double-digit growth will make the stock cheaper going forward. All in all, Carbon Black seems to be a good bet for investors looking for cyber security exposure.
Disclosure: I have no position in any stocks mentioned and no plans to initiate any positions in the next 72 hours.
