Description

Mimecast

Executive Summary

Mimecast is a cloud-based cybersecurity company focused on the SMB/ mid-market. The company has a leading product in the email security space and is actively expanding its feature suite to upsell its clients (recently began offering security training solutions). Company is trading at $48/share (6.5x revenues), a slight discount to its pre-COVID high of $54/share. The company is growing well with +15% topline growth, high gross margins (+76%) and increasing profitability (EBITDA margins have increased from 10% in FY18 to 18% in FY20). On a Rule of 40 basis, Mimecast has been clearing the hurdle for the last three years. Company has only tapped into 3% of its addressable market and has a lot of greenfield ahead of it so there is ample growth opportunity in the coming years. Company has witnessed some softening retention as COVID has impacted its core client set. As the economy recovers, performance should improve and the stock should rerate. Note that SaaS companies with mid-teens growth are typically valued at ~12x, representing a +80% premium to current trading levels.

Company Background

Mimecast is a software-as-a-service (SaaS) cybersecurity company focused on email security and data archiving services. The company has clients of all sizes but is focused on the SMB and mid-market. Since its founding in 2003, the company has grown a sizeable footprint and now has over 38,000 customers globally with an ACV of ~$11,000. The company’s products are primarily focused on email security though the company has ambitions to develop or acquire ancillary security products that expands its portfolio.

The core product entails i) email security (protects against spam, phishing attacks, malicious URLs, etc.), ii) mailbox continuity services (back-up email service when there are system outages), iii) information archiving for compliance / e-discovery purposes and iv) web security (protects against malicious web activity and blocks access to inappropriate sites).

Email is a prevalent threat vector for cyber attacks and as phishing attacks become increasingly sophisticated, this threat vector remains one of the prominent areas that enterprises need to focus on. Gartner recommends that corporations invest in anti-phishing technology but also supplement their security posture by adopting ancillary tools such as multi-factor authentication. Email events should also be integrated into broader security platforms so companies have a more holistic view of their organization and the threats they face.

Mimecast’s email security product is a leader in its field and is highly rated on G2 Crowd, a public software rating platform, where its email security with threat detection is rated 4.4/5.0 (N=130). If we look at the Gartner ratings for Enterprise Information Archiving, Mimecast is listed as a leading vendor alongside Smarsh, Microsoft and Proofpoint.

Market

The market for cybersecurity products is very large and gaining mindshare. The company’s core markets represented ~$12B at the time of its IPO but through market growth and product expansion, its current addressable market is over $23B, leaving plenty of room for growth. In Mimecast’s primary markets of secure email gateway ($3.3B), e-discovery ($2.9B), backup and recovery ($8.7B), and secure web gateway ($4.0B) comprise over $18B of market opportunity. Assuming a core addressable market of $18B, Mimecast has only achieved 2.4% market penetration.

Another way to think of the market opportunity is via end user count. As of the most recent quarter, the company had 15M users out of an addressable market of 300M SMB- mid-market business users representing 5% penetration.

Mimecast has benefited from the growth of Office 365 and as the corporate world migrates to the O365 platform, Mimecast’s opportunity set likewise expands. Though MSFT has compliance and cybersecurity products that it offers to its clients, these products do not provide sufficient coverage and are very expensive at the enterprise level.

Recent Performance

The company generated $427M of revenues in FY2020 (3/31/20 YE), growing topline at 25%. Gross margins have expanded nicely from 71% in 2016 to 76% in the most recent quarter. Operating leverage is also being achieved with sales and marketing as a percentage of sales declining from 46% in 2016 to 36% in the most recent quarter ended 9/30/20. Improved operating leverage has driven profitability, which is a rare sight in SaaS. Finding a SaaS company that is growing +15% topline, decently profitable and trading at a reasonable valuation is a high bar and Mimecast is one of the few that fit the bill. If you measure a company via the Rule of 40 (i.e. revenue growth rate + EBITDA margin), Mimecast has cleared the threshold since FY18. Company is also well-capitalized with over $123M of net cash.

It is worth noting that net dollar retention has been negatively impacted with NDR dropping to 105% in the quarter ended 9/30/20 compared to a recent historical average of 110%. With 15M users spread across +38,000 clients, the average Mimecast customer has <400 employees. Mimecast is thus squarely a SMB/mid-market focused cybersecurity provider, a market segment that has been particularly hard hit during the pandemic.

Valuation Overview

Topline growth has slowed as the company grows in scale but it has been able to add an average of $80M of revenues each year. As the company gains more traction in the enterprise sector, there should be the ability to upsell accounts, driving higher ACVs and topline traction. The average client buys 3.4 products out of a suite of 12 with an ARPU of $37 compared to a theoretical potential of $120. Even without much expansion, at $80M of revenue-add per year that equates to mid- to high-teens revenue growth. Management expects revenues to grow 15% in FY2021 and to grow between 15-20% over the coming years. For SaaS companies that are growing in the mid-teens (10-20% growth rates), average LTM revenue multiples are ~12x, a +80% premium to where Mimecast is trading currently (~6.5x annualized quarterly revenues). While Mimecast revenue growth declined to 16% yoy in the quarter ended 6/30/20, it has since re-accelerated to 19% in the quarter ended 9/30/20.

Note that since the financial recession of 2007-08, SaaS companies have traded at an average of 6x LTM revenues with multiples gyrating from as low as 2-3x to as high as 15x currently. Growth stocks in SaaS have inflated in value this year partly due to the interest rate guidance from the Fed. With rates dropping to zero, the future profits from high-growth companies are ascribed a higher present value. With the Fed committing to holding rates low for the long-term, the re-rating of revenue multiples is likely to persist over the coming years.

Valuation Discount and Re-Rating

Mimecast is a public company that is covered by equity research and has been public since 2015. It is thus not a hidden asset. I suspect that Mimecast is trading at a discount to peers for a couple of reasons:

-          Cybersecurity Risk: Cybersecurity is not the easiest sector to invest in. The sands are always shifting and the industry clockspeed is one of the fastest in the economy. Larger incumbents can potentially bundle their products to squeeze out smaller players and the sector receives a lot of VC financing so there are plenty of ankle-biters that are picking up market share.

-          Enterprise Risk: Mimecast has conveyed its ambitions to penetrate the enterprise market where ACVs are larger and contracts are stickier. The company has broadened its menu of products for the enterprise sector but still has a relatively narrow product suite. It is conceivable that larger incumbents could bundle their products and offer email security as a loss leader. I suspect that this risk is overblown since the cyber landscape is still relatively fragmented and buyers are still picking up best-of-breed solutions. CISOs recognize that it is impossible to cover the waterfront with a single vendor and are willing to go through the brain damage of quilting a comprehensive solution together. Cybersecurity is now board-level consideration so there is a lot of attention and budget being allocated here. Email remains one of the most prominent attack vectors and Mimecast is one of the best email security vendors so is in a relatively attractive position in the cybersecurity market.

-          SMB Softness: 2020 has been a really tough year for the SMB and mid-market business where Mimecast has built its business. This is evident in the company’s net dollar retention, which has softened from 111% in FY19 to 105% in the quarter ended 9/30/20. As a COVID-19 vaccine becomes more widely available and the broader economy recovers, the SMB/mid-market will return to growth.

Though NDR has softened in recent quarters, I’m confident that Mimecast will be able to continue to demonstrate its leadership in email security and improve both its growth and profitability profile. As the SMB market continues to heal, growth in that segment will return. In the interim, Mimecast’ efforts in the enterprise sector could yield fruit and drive growth. Lastly, the company has demonstrated its ability to drive operating leverage through the organization and as profitability increases, Mimecast will build up cash that can be used for product development or M&A purposes.

Catalyst

Stock should re-rate as growth continues and metrics improve. Net dollar retention should improve as COVID impact fades and its core clients (SMB/Mid-market) return to health.