Life has been changing at Veracode so rapidly in the past two years that you could easily forgive someone for not remembering who owned the company on any given day.
Focused on cybersecurity for application development, Burlington, MA-based Veracode had raised about $150 million and grown to a couple hundred employees by 2017 and at one point seemed to be on the path to an IPO.
Then, in March, the first of what would become three successive ownership changes for the company was announced: CA Technologies (NASDAQ: [[ticker:CA]]) bought the technology company for $614 million in cash.
“We came into CA thinking: Now we are going to be a business unit at CA forever,” says Veracode CEO Sam King, who spoke with Xconomy last week to look back on the wild 18 months during which her company ran through four different owners in a riff on the small-fish-gets-eaten-by-medium-fish-gets-eaten-by-big-fish scenario.
“It’s a lot of change for a single company to go through in that time period,” King says.
After that first deal, King delayed putting too much effort into integrating Veracode into CA Technologies, choosing instead to keep focus on growing the business. The decision paid off.
Veracode’s time with its new parent company lasted about a year before Broadcom (NASDAQ: [[ticker:AVGO]]) reached a deal in July 2018 to buy CA Technologies for $18.9 billion and institute its own plans for the company.
“It was puzzling to a lot of people, including us,” King says, noting that the acquisition came right as she and her management team were preparing to finally take on integrating Veracode with CA Technologies. The question for King became “Who are we integrating with?”
With this next round of ownership changes, King says she again focused less on the ownership structures above her and more on what Veracode could control about the business.
“The approach was: OK, here’s another change. Every time changes like that happen it feels like the reaction can be ‘I lost a sense of agency. It’s not in my control,'” she says. “For me and the rest of our team, our goal was to retrieve a sense of agency for our employees and customers.”
Within a few months, King says she met with the leadership at Broadcom to see how Veracode would fit into the company.
“It was clear to them and us that we are a growth business and that the area we are in cybersecurity wasn’t the driving force behind Broadcom’s acquisition of CA Technologies. It makes sense for us to be spun out as an independent business. It helps that we were operating as a small company in CA.”
Private equity had long had its eye on Veracode, King says—firms felt they lost out on Veracode early in its growth. The company’s venture backers include .406 Ventures, Atlas Venture (the tech side of which later became Accomplice), StarVest Partners, Polaris Partners, Symantec, Meritech Capital Partners, and Wellington Management.
Then in January 2019, the situation changed again: Broadcom agreed to sell Veracode to Chicago-based private equity firm Thoma Bravo for $950 million.
King says the premium Thoma Bravo paid for Veracode over what CA Technologies shelled out less than two years prior is a testament to the company’s progress in CA and the market it is in. Thoma Bravo announced it raised a $12.6 billion fund in January and acquires companies in numerous technology sectors, including cybersecurity, such as its $2.6 billion buyout of Redwood City-based Imperva in October.
“They get this market. They get the fact that we are a growth-oriented company, and they get that we want to invest behind solutions,” King says.
After six months with Thoma Bravo, King says she expects Veracode’s growth to continue.
Thoma Bravo’s approach is to “buy a leader of a platform and help them consolidate the space. I fully expect we will continue organic growth, but that we also will have the opportunity for the right reasons and the right companies, to consolidate this space,” she says.
King says after the whirlwind of the past few years, there are no more big moves for Veracode on the horizon.
“We’ve been bought and sold three times in 18 months,” she says. “We already hold the record on that.”
