Synopsis

Blue Coat Systems, herein referred to as "BCSI" or the "Company", trades at a significant discount to intrinsic value which we estimate at $32/ share under our base case.  We believe the Company is a classic example of a turnaround story that is underappreciated as a result of Wall Street's focus on short term results.  There are many aspects of the story that we like: strong cash flow, a new and experienced CEO, expanding TAMs, a replenished salesforce, sticky customers, options on accelerating growth, and an active board.  At $6.08 net cash / share and 6.4x FCF to the enterprise, we believe current prices make a compelling entry point.

There are 4 key aspects to this story that we believe investors should focus on:

1.       The Company's FCF is significant and will substantially exceed earnings for the foreseeable future due to a favorable international tax structure, $259M of NOLs, and depreciation in excess of capex

2.       The cloud security business is not understood/discussed but it is a game changer; cloud is gaining substantial traction and can leapfrog WBSN, FTNT, and disintermediate firewall providers such as CHKP.  This business is based on a SaaS model and should be valued on bookings.

3.       The WAN optimization business has the potential to be $100M in a few years.  The product is finally competitive and is gaining momentum in a market that is still greenfield.

4.       The turnaround is progressing well, and at 9 months in, we are still early in the re-alignment.  In our experience, these turnarounds take time but the street has priced in an expectation that it has already failed.

Business Description

BCSI operates in 3 business segments: security, WAN optimization, and cloud.  The security division sells webfiltering, malware, SSL analysis, and data loss prevention tools through its ProxySG, ProxyAV, and webfilter product lines.  This business generated $216M of product revenue in the LTM period and sells to Fortune 500, federal, and mid/large enterprise customers though a combination of direct sales and a VAR/reseller channel.  Ex-federal and strategic accounts, 30-35% of sales are to the mid/large enterprise customer segment. 

The WAN optimization business provides enterprises the ability to accelerate applications over a WAN by eliminating redundant transmissions, staging data in local caches, compressing data, and streamlining chatty protocols.  BCSI's Packetshaper, which shapes and prioritizes applications, and Mach 5, which is similar to RVBD's steelhead product line, generated $76M of product revenue in the LTM period; in addition, WAN optimization can also be sold in the ProxySG appliance.  BCSI's customers range from mid-market to large enterprises and distribution channels include resellers, VARs, and direct.  Unlike RVBD which targets both branch and datacenter to datacenter markets, BCSI specifically targets branch customers.

Cloud security is based on a subscription SaaS model that brings Blue Coat's high end security to public and private clouds to help secure branches and mobile end-points.  The feature set includes real-time protection, location aware protection, and application level filtering.  BCSI's focus is on small and large businesses and products are sold through a combination of white label OEMs, security VARs, and a direct sales.  Launched last April, BCSI already has 100 trials underway that encompass over 70,000 seats.  By comparison, BCSI's security appliance user base is currently 60 million.  This product is complimentary to the ProxySG for the large enterprise who need hybrid solutions and greenfield for smaller customers that launch directly into the cloud.  

Greater than 50% of sales are through 3 major resellers: Computerlinks, Westcon, and Arrow.  Several large customer accounts are deemed strategic and are touched by a direct salesforce but over 90% of sales are indirect.  The recent reorganization of the salesforce further streamlined teams under security, WAN, and cloud.

Additional issues also plagued the company.  Our research has uncovered that a lethargic salesforce, poor customer support, and increased competitiveness from WBSN and FTNT were critical factors that eroded BCSI presence in the channel.

To address these challenges, BCSI embarked on a turnaround beginning with the appointment of Mike Borman as CEO in September 2010. Following the announcement and Mr. Borman's promise to demonstrate results after 9 months, BCSI's stock began to move off its $18 lows and touched year highs at $32/share. 

The restructuring over this period has been significant.  The salesforce has been replenished after massive turnover and has been recently stabilized. Many of the sales representatives that customers deal with are new, and they are still ramping on the productivity curve.  The organization was also split into 3 business units: security, wan optimization, and cloud.  New division heads were assigned to each of these units to create better P&L accountability and clearer go-to-market messages.  Heads of sales were replaced geographically in North America, Europe and APAC and a new CMO was brought onboard.  In addition, stronger sales incentives, including better margins for the channel versus Riverbed, were put in place to help focus on WAN optimization.      

Concurrent with the restructuring, the Company began to release both new and upgraded products.  All appliances were refreshed with 64-bit operating systems, bringing densities in line with the market.  The Mach 5 WAN appliance was simplified for easier installation (previously a major complaint), and it now boasts leading technology over RVBD in video acceleration and file sharing.  The new mid-market ProxyOne appliance was launched last quarter and in April, the cloud based security product was introduced. 

Despite these changes, it became clear at the end of FY Q4 that the restructuring efforts would take longer than anticipated.  The company pre-announced unfavorable results for the April quarter - 9 months into the CEO's promise to demonstrate results - and the stock traded down on the news.  Further, BCSI guided down during its earnings call citing greater competition in the mid/large enterprise security business.

The Opportunity

Security Products Are Not Dead

Similar to the security business, we believe the WAN optimization business is of higher quality than most analysts believe.  Although the Company has provided the Mach 5 product for some time, the first iteration was admittedly sub-par relative to RVBD.  As a result, RVBD grew to become the dominant WAN player in the first installation cycle.  In 2008, the Company bought Packeteer for $268M which provided application performance visibility, application shaping, and more importantly, a sales channel.  However, Packeteer was never fully integrated and the basic Mach5 was still marred with issues including difficult installation and management.    

Today, the new WAN optimization product appears to be solid.  It is perceived as being just as capable as Riverbed's and even better in some aspects including video acceleration through object caching (RVBD is byte level caching), consolidation of SSL acceleration into the same appliance, and asymmetrical acceleration into the cloud.  An independent organization, Broadband Testing, confirmed these results and channel checks confirmed that the new products are highly regarded and more competitive on price. 

The issue for BCSI is that they face the reverse problem from high end security; it is difficult to unseat the incumbent, especially when they are already installed within a customer's premise.  However, unlike the security market, we believe there is a strong path to growth.  Management has taken a strategic angle by focusing specifically on branch offices - rather than the datacenter to datacenter market which is dominated by RVBD and SilverPeak - and is targeting customers to which video and cloud are key decision factors.  Moreover, BCSI has significantly increased its marketing spend, focused on providing more test/demo models quickly into customer labs, and began providing the channel with better incentives to push sales.  Our checks have commented that the BCSI salesforce now seems refreshed, focused, and aggressive.

There are two macro tailwinds that should also help the Company.  First, the WAN market is healthy and growing at a 14% CAGR through 2014.  Moreover, RVBD's consensus growth for 2011 and 2012 are 32% and 23% respectively.  Driving this growth is a combination of datacenter consolidation and network intensive application upgrades such as Sharepoint and Exchange.  Bandwidth is also expensive, so as consolidation occurs, WAN optimization has become a more efficient path for companies to upgrade their networks.  Second, we are now approaching the next upgrade cycle for initial WAN optimization installs.  Many companies initially bought RVBD appliances for moderate deployments 4-5 years ago and are now architecting for larger build-outs.  Our checks have indicated that BCSI has already started displacing RVBD in major accounts like Citibank Retail.  There is also a large greenfield opportunity in WAN, especially with mid-enterprise companies who are now adopting the technology as it has matured.  VARs, and even RVBD's management, have indicated that a significant portion of the market is still greenfield.

We believe that breaking out the WAN organization will help the company focus on delivering a cleaner message to the market and create much greater accountability in terms of sales performance.  Already, the results are beginning to show with sales increasing 82% YoY to $27M.  Although these are smaller numbers, we believe BCSI should be able to grow this business in excess of market rates and that it could potentially be a $100M business over several years.  Management believes it can get the business to at least double in the short term.

Cloud Security is the Next Growth Wave

As businesses move to public and private clouds, protecting the cloud and mobile endpoints is becoming a greater priority for CIOs.  Currently, only zScaler (~$65M in sales) and CSCO's Scansafe have options on the market, but neither are as robust as Blue Coat's offering.  In addition, zScaler's products are not appropriate for large enterprises.  The cloud product also bakes in firewall functionality which allows it to be very competitive against players like Checkpoint and UTM players like Fortinet.  According to 1 super regional bank, the migration to BCSI's cloud security platform will allow them to "tear down 15 Checkpoint implementations". 

Gartner is forecasting that 40% of secure web gateways will be delivered through the cloud by 2015 from 5% today, and Blue Coat's initial uptake seems to support this trend.  Since the launch in April, BCSI began 100 trials encompassing over 70,000 seats.  At an average price per user of $12 / year and a total security install base of 60M users, the TAM on BCSI's install base alone can be $840M.  It is important to note that this TAM does not eliminate the need for the ProxySG appliance but rather compliments existing implementations. 

Moveover, because this business is based on a "software as a service" (SaaS) model, the valuation of cloud security should be based on bookings and cash flow.  SaaS companies such as SFSF, LOGM, and CSOD trade at forward multiples of 7x bookings.  Based on the above install base, we believe at least $50M in bookings should be easily achievable within the next couple years which would add ~$350M of additional market capitalization.

After the end of the Continuing Resolution, government VARs raised federal spend targets; while the DoD budget remains flat, there appears to be a shift in spend away from military equipment towards IT. One large government reseller believes that security based spend will increase this year and another believes that BCSI is the default vendor because it is easier to upgrade rather than re-architect.  However, government preference for security vendor depends on the department and some, like education, have historically placed large purchase orders and only fulfilled a fraction of them.

Also of significant importance for shareholders is the magnitude and speed of the recent $50M stock buyback.  The repurchase was the first buyback authorized by the Company based on trading levels rather than as an offset for option dilution.  This buyback was announced after Q1 2011 earnings and will be completed prior to Q2 2011.  At an estimated average cost of $23/share, share count will now be reduced by 5%.