VASCO Data Security (VDSI) is a low risk opportunity to invest in the leading authentication services player to the banking sector at a cheap valuation with several significant embedded options.

Business

VDSI develops strong user authentication security solutions that manage access to a system or service.  Strong user authentication is two or more authentication factors that verify the identity of a user.  83% of the business is providing these products to the banking market, where VDSI is the #1 player.  17% is in the Enterprise & Application (E&A) segment, which targets internal enterprise security and non-banking verticals.  VDSI launched a consumer division in April 2012, MYDIGIPASS.COM (MDPC) for B-to-C applications, with an immaterial revenue contribution.  Revenue is 62% Europe, 18% Asia Pac, 8% US, and 12% rest of world. 

Core franchise is worth more than current market valuation

The core franchise is an on premise authentication solution to banks, which install software and host it on their applications and distribute software and hardware (tokens and card readers) to their users.  The on premise solution is designed for a bank's desire to control all aspects of security.    Providing an open standards-based component of the overall security infrastructure allows VDSI to be integrated into bank systems and processes unlike competitors with authentication packaged within a larger closed system (including protection, prevention, analytics, and monitoring, etc.)  This explains VDSI’s 80% market share in the banking sector. 

This is a fantastic business with high margins, high return on capital, little invested capital and near zero customer turnover with high switching costs. 

The banking sales cycle is typically 6 months and 18 months for larger deployments with replacement occurring every 3 to 5 years.  This results in a lumpy business when analyzed on a short-term basis. 

 The normal sales and replacement cycle are being extended leading to depressed results.  European banks are uncertain on the future regulatory framework including a comprehensive banking plan.  Furthermore, mobile banking is growing 30%+ annually resulting in banks taking more time to test products before deployment.  Additionally, the economic environment in Europe and Asia has created a general hesitancy to make capital investments.

There is a demand and requirement for these products and at some point, these orders will be initiated.  It is only a matter of time.  VDSI will easily exceed their previous peak results as this is a growing industry (IT security is a priority, regular price increases, new customer additions in international markets, etc.).  At $25m EBIT @ 10x, the banking franchise is worth $6.50.  There is $2.40 in cash and assuming the other businesses are worthless, VDSI is worth $8.90 (+16% upside from current price).   The $25m (20% below peak) and 10x (3% growth and 13% cap costs; see peer multiples) assumptions are ultra conservative but illustrate the egregious undervaluation.

Several Embedded Options

There are several significant, very realistic upside potentials at VDSI, none of which are implied at the current market price. 

Potential Upside #1: Business shifts from hardware to software and services

Hardware is 72% of the business and consists of card readers, tokens and backend server products.  Customers are increasingly demanding authentication services and software to replace the historical hardware components.  This trend is accelerating due to mobile banking, cloud computing, online application growth and growth in connected devices to the Internet.  VDSI has significantly increased their R&D efforts (absolute dollar, % of sales and headcount at all-time high) to fully develop products that meet their customer demands. 

Per the 10-K, software margins are 20 to 30 percentage points higher than hardware implying software margins of ~85% and hardware margins of ~60%.  Every 1% migration of the business to software and services is ~$380K pre-tax (1c/share) or 3%+ accretion to LTM EBIT. 

It is highly unlikely that 100% of the business will go to software & services.  Due to the banking customers desire to control their security infrastructure, they will continue to demand back-end hardware products and most likely would not implement a major service element.  However, the use of tokens and card readers will be materially smaller in the not too distant future.  These products are 15% of revenue.  At the current, depressed run-rate of sales, migrating this business to software (45% software/55% hardware split) and assuming no other portion of the business makes that transition, would result in ~$5.7m pre-tax (14c per share) or 43%+ to LTM EBIT. 

Notably, the newly created consumer division (MDPC) and recently launched DIGIPASS as a Service (DPS) product in the E&A market are both 100% software and services.  These do not generate material revenue however, the multi-million dollar investment in these products would presumably result in future software and service revenue.  We will analyze this later. 

The market is moving in the direction of software and services and VDSI made the investments to meet that demand.  It is only a matter of time before they will realize those benefits.  

Potential Upside #2: Value Realization of New Businesses

In October 2010, VDSI launched a cloud based authentication service called, DIGIPASS as a Service (DPS), for B-to-B and B-to-E applications in the E&A market that desire a quick, easy to implement, low cost and highly scalable solution for strong authentication.  In April 2012, VDSI made their first move into the consumer market with MYDIGIPASS.COM (MDPC), a cloud based B-to-C strong authentication service. 

VDSI does not segment the results or quantify the financial impact of these businesses.  In the April 2013 earnings call, in regards to DPS losses “It’s substantial.  It’s several million dollars annually” and on the July 2012 earnings call, management indicated the R&D efforts for DPS are “several million dollars of investment in terms of annual costs”.  With both businesses not producing revenue, staffed with a dedicated sales team, and incurring additional overhead costs, my estimate is that VDSI invested well over $15m into these two businesses with the combined annual loss of at least $5m per year. 

With VDSI trading at a depressed valuation on a consolidated basis, these two businesses imply negative value.  There are three ways to realize value for these businesses. 

First, if the businesses begin to gain traction that would be massively accretive to earnings.  The service business is a much better business given the recurring revenue nature and margin structure.  VDSI has a ~20% return on capital, assuming that there is $15m invested in the services platform @ that same rate, these businesses would generate $3m pre-tax.  Another consideration is that management originally projected the services businesses to be at least 10% of FY2013 revenue ($16m+) at higher than average margins.   Although the guidance was rescinded as the market isn’t come along as quickly as anticipated, this does provide another data point on the opportunity.    

Secondly, these businesses could be sold.  There are several VC funded authentication startups with much higher implied valuations (and most with no or little revenue and no operating history).  These are startups like Authy, Encap, Toopher, Nok Nok Labs, KeyLemon, LaunchKey, Bionym,  Certus, Cloud Security Corp, It’s Me!, and Stormpath.  Validity Sensor was acquired for $255m in October (14.5x revenue, including earnout) and Cronto was acquired by VDSI for $22m in May – both VC backed businesses.  This is not a comprehensive list but illustrates that there is private money investing in the space.  VDSI has a long history of profitably generating cash as a leader in strong user authentication thus, it seems reasonable that their startup in this arena would be valued at least on par with the VC funded investments, which have no credible track record of industry success. 

Finally, these businesses could be closed down.  DPS and MDPC have no impact on the core authentication business for banks.  Closing down this initiative would save $5m annually and would be immediately accretive to earnings.  This is the worst case scenario. 

At the current valuation, these two businesses ascribe negative value to VDSI.  There are multiple avenues to value creation from the worst case scenario at closing these down to the home run scenario of the businesses gaining traction.      

Potential Upside #3: Pickup in Enterprise & Application Market

Recent performance in the E&A segment has been poor.

There are several reasons that there is upside in this segment.  Firstly, management announced in October 2013 that they would implement a cost reduction program closing their Australian facility resulting in $2m cost savings for FY2014 ($1 to $1.5m net of added staff to Vienna facility).  On the November 2013 earnings call, Management stated with regards to the E&A market that the current plan “is adjust the expenses for that business and try to get to breakeven or a small profit”.  At the very least, the current loss making E&A segment will have $1 to $1.5m in higher profit contribution in FY2014.     

Secondly, the E&A market is primarily sold through VARs that spec VDSI products onto customer orders.  The relatively low price point and low awareness among the VARs leads to poor sales execution.  The products are open standards-based and compatible with many larger IT partners (http://www.vasco.com/partners/partners.aspx).  VDSI intends to pursue more direct business in a partnership format targeting their larger IT partners.  These partners can market their products as featuring “additional security” adding-on the authentication product earning an additional price markup.  The CEO personally rekindled the VDSI-IBM relationship recently and I would expect similar initiatives in the near future.  This is a low resource approach to growing the E&A market and given the VAR approach isn’t working, this seems more promising than the current situation. 

Finally, VDSI hired a new Senior Vice President of Sales in E&A in May with his team recently fully staffed.  The E&A market is multiples larger than the banking market with better growth opportunities and a higher margin profile (better mix of software and services). 

Whether it is cost cutting, pursuing partnership deals or allowing time for the new sales force to implement their sales strategy, the E&A segment has upside from the currently depressed levels.    

Potential Upside #4: Traction in United States Banking Market

VDSI derives less than 5% of revenue from the US banking market where they provide niche services for large corporate transactions.  The core banking franchise exists in Europe and Asia primarily due to banking regulations and secondarily by both banks and customers desire for added security.  The US market does not require strong user authentication with both banks and customers valuing convenience over security.  VDSI management believes that strong user authentication will have a presence in the US market, and they have publicly stated on earnings calls that they continue to have discussions with US banks for deploying these solutions.  It is highly uncertain to determine the winner if US banks adopt strong user authentication.  However, VDSI is as well positioned as anyone (despite their small US presence) given the US banks will probably demand the same open standards-based products that they can own and control in house like their European and Asian counterparts.  Thus, the market dynamics that allow VDSI to command an 80% market share in Europe and Asia are also applicable in the US.  Nevertheless, headline news on security, hacking and privacy combined with the growth in mobile banking and more stringent banking regulations, indicates that user authentication will likely be more robust in the future. 

Very Cheap Valuation

This is a consolidating industry.  VDSI listed 22 peers in the “Competition” section of the annual reports since 1997 (16 years).  An astounding 15 of the 22 peers were acquired since. 

At the currently depressed run-rate of performance, applying the median 2.59x revenue and 11.6x EBITDA multiple, implies a share price of $12.25 (+60% upside) and $7.60 (current market value).  Adding back the losses at the two cloud-based businesses ($5m) and the Australian closure at the E&A segment ($1.5m), values VDSI at $9.50 (+24%) based on the median EBITDA multiple.  Notably, of the 7 peers that were not acquired, none remain small, standalone authentication only providers. 

Additionally, VDSI identifies internet security peers in making compensation decisions.  In the 2012 Proxy, 5 of the 10 peers were acquired in the last year. 

VDSI trades at a discount to peers.

VDSI is cheaper than all peers on a P/B and EV/TTM revenue basis and trades at a premium to EMC, Symantec and CA on an EBITDA basis due to the losses at the two cloud based businesses, the losses at the E&A segment and the push-out of business from banking customers. 

VDSI has at a minimum 30% upside when valued on a normalized basis.  Adjusting for the losses at the two cloud based businesses and the losses at the E&A segment plus the return of normal business at the core banking franchise results in at least $30m in EBITDA (10% below peak).   With peers and acquisitions multiples at ~10x, VDSI is worth at least $10.  I think fair value is closer to $15 with all value attributed to the banking franchise. 

Margin of Safety

• Core banking franchise is lumpy and at the trough of market activity: Orders will eventually be placed and the segment will return to its normal operations.  Without any pickup in the cloud businesses, the E&A market or any other opportunities, the core banking franchise will generate $20m+ in free cash flow annually. 
• Bad Sentiment & Low Expectations: Management cut guidance in three of the last four years.   VDSI acquired DigiNotar in January 2011 for $13m, which filed for bankruptcy shortly after the acquisition due to a security breach.  Management invested substantially (estimated $15m+) in the cloud based offering since 2010 and continues to lose several million dollars annually (estimated @ $5m) with no revenue to show for this investment.  The industry is growing whereas VDSI is stagnant.  The company appears broken and dead. 
• Attractive industry:  strong user authentication is secularly growing.  Despite operational miscues, VDSI still earns double digit returns on capital with 60%+ gross margins.  
• Cash on balance sheet:  30% of the market cap is sitting in cash
• Cost cutting opportunity: VDSI is one of the least efficient companies.  They have 400 employees with operations in 22 European countries (customers in 100+ countries) and three headquarters (Chicago, Switzerland and Belgium)!  Notably, they are in the process of closing the Australian operation saving $2m, which was a facility acquired more than 5 years ago and VDSI does not generate material revenue in Australia.  The CEO flies to Switzerland from Chicago at least once (likely a few times) per month and he is probably not flying the transatlantic equivalent of Southwest with multiple connections.  It is likely other VDSI employees are taking similar flights.  The CEO owns 25% of the shares but Directors are paid ~$150K despite little stock ownership and no contributions to shareholder value.  Purely as an example, consolidating to a single HQ (like a normal company), removing 10 Chicago to Zurich flights and halving the Directors compensation would save at a minimum $2.5m (19%+ increase of LTM EBIT). 
• Consolidating industry: This is a consolidating industry.  Any reasonable person with common sense and a semblance of business judgment would agree that the future of VDSI is not as a small standalone authentication provider for European banks. 
• Near 52-week low

Risks

• Management is a D-: The CEO, Ken Hunt, and the President, Jan Valcke, are not good (Ken Hunt is a cool guy, just not the right person for the job). 
• Bad acquisition: This is an industry where it makes sense to acquire niche technologies.  If the acquired technology is not exactly right, the deal is a complete write-off.
• Reluctance to close down businesses: if VDSI continues to lose millions on the cloud businesses and the E&A segment and management decides to “ride it out”, shareholder value will be permanently eroded. 
• Disruptive technology in the banking business

Catalysts

• Core banking franchise returns to normal
• First glimpse of backlog in 10-K and FY2014 guidance in Q4
• Traction in DPS and MDPC
• Traction in E&A
• Announced closure of DPS, MDPC and/or the E&A segment
• News on bank regulations in Europe, Asia and US
• Headline news on security, hacking, privacy
• More M&A in the authentication industry