[ISN] Network security firm explores IPO

[InfoSec News]

http://www.baltimoresun.com/business/bal-bz.sourcefire13apr13,0,7066560.story?coll=bal-business-headlines

By Stacey Hirsh
Sun reporter
April 13, 2006

Martin Roesch's technology company was started in 2001 the same way
many others begin - from his living room.

During its first year, Roesch's network security firm Sourcefire Inc.  
was running shipping and receiving from the foyer and conducting data
operations from what is now the in-law suite at his Eldersburg home.

"It was definitely a startup," recalled Roesch, 36, who is now the
company's chief technology officer.

Five years later, Sourcefire has grown to 150 employees with offices
around the world, including two at its Columbia headquarters. The
network security software Roesch developed is an industry leader. And
despite last month's high-profile disappointment when the government
blocked the $225 million sale of Sourcefire to Israeli-based Check
Point Software Technologies Ltd. because of security concerns,
executives say the company is poised to move forward.

Sourcefire is considering an initial public offering, executives said.  
And with the Check Point deal off, executives said the company's main
focus is growing the business, gaining market share and improving
profits.

Michele Perry, Sourcefire's chief marketing officer, said the company
is "gunning for a fourth-quarter IPO."

"Last year, that was one of the options we had on the table that we
were moving toward, and Check Point came out of the woodwork and tried
to acquire us," Perry said. "So we're just back on our plan."

Wayne Jackson, Sourcefire's chief executive officer, was more measured
in his remarks.

"We want to be in a position to be a public company in that time
frame," Jackson said in an interview at his office this week.

Jackson, 44, said that Sourcefire's focus is to aggressively grow its
business, so that the decision of when - or whether - to take the
company public is within their control.

Sourcefire announced in October that it would be acquired by Check
Point. But the acquisition raised national security issues and was
under investigation by the Committee on Foreign Investment in the
United States, the same agency that investigated Dubai Ports World's
bid to run some operations at six U.S. ports including Baltimore's.  
Check Point announced late last month that it was pulling out of the
deal.

With the Check Point deal behind them, Jackson said, Sourcefire is no
longer focused on being acquired. He said the company has consulted
with a bank about financing strategies to help it expand. Sourcefire
has been profitable since the fourth quarter of 2005, Jackson said,
while declining to provide specifics.

Sourcefire has the potential to be a billion-dollar company as it
grabs a chunk of markets beyond intrusion prevention, Jackson said. He
sees an IPO as one financing option but says it's more of a starting
point than a finish line.

"Like any manager, I'd like to have as many options as I possibly can,
so keeping the company strong enough to do [an IPO] is something I'd
like to do, but it's not a management goal," Jackson said. "We're
growing the company because we see a huge opportunity to be an
industry leader."

Jeffrey W. Englander, an independent analyst who follows the
information security industry, says going public is an attractive
option for Sourcefire and returns them to the path they were on before
the Check Point deal. Englander has no financial relationship with
Sourcefire.

Sourcefire makes open-source intrusion prevention technology called
Snort, which analyzes network traffic to protect against hackers. The
company also makes software to manage that data. Additionally,
Sourcefire makes real-time network awareness technology, which maps
out exactly what the network looks like.

The intrusion detection and prevention market is expected to reach
$700 million this year, Englander said. And Sourcefire's real-time
network awareness adds a feature to the technology that many companies
are looking for, he said.

"That's their secret sauce," Englander said. "It will not only prevent
threats but look at different threats within your network, look at the
configuration of your network, see where there are potential
vulnerabilities and work to remediate those vulnerabilities in your
network."

Snort, which Roesch invented, is a free product, and the code is
available for anyone to see. But Englander said Sourcefire does not
have any true direct competitors for its real-time network awareness
technology.

Englander estimates that Sourcefire will have sales of about $53
million this year.

Kathy Smith, a principal with Renaissance Capital, a Greenwich, Conn.,
IPO research and investing firm, said it's a good time to be going
public. The average stock price of companies that have gone public
this year is up 21 percent from their IPO price, with about half of
that return coming from the first day's trading.

There have been 46 IPOs this year, compared with 38 for the
corresponding period last year, according to Renaissance Capital.  
Smith said technology companies typically make up about a third of the
IPOs each year.

But investors, who were burned when the tech bubble burst, are being
more discriminating these days. In 2000, only 26 percent of the firms
that went public were profitable. By last year, that number was up to
69 percent, according to data from Renaissance Capital.

"It's still a good time for a technology company to go public - the
market is very healthy," Smith said.

"However, it cannot be a company that doesn't have substance, because
investors are selective," he said.

Jackson acknowledges that he was disappointed when the Check Point
deal fell through, because he hates losing at anything.

(His hobby is competitive race car driving, which he says requires
putting aside fears of going fast and focusing on a complex set of
variables in a challenging environment, like running a technology
startup.)

Jackson said he felt better a day after the deal fell through when he
thought about Sourcefire's value. He said the company's $225 million
price tag during the Check Point deal was based on the business as of
a year ago, when the company was not yet profitable.

Jackson expects 2006 to be Sourcefire's first profitable year.

Englander, the information security analyst, agrees that an IPO would
not be the be-all, end-all for Sourcefire. It's a financing option
that could give it more cash to grow the business, either organically
or through acquisition.

"It gives them the additional resources they need to expand the
business, and it would give them a public currency to make
acquisitions, should they desire," Englander said.

Until then, Roesch and Jackson are working at their Columbia
technology company where - as with the startups of the tech boom - the
break room offers Xbox, a foosball table, and free soda and candy. But
the sprawling offices are a far cry from the Eldersburg living room
where the company began.

Copyright © 2006, The Baltimore Sun