FireEye: Demanding More From Mandiant

| About: FireEye, Inc. (FEYE)
This article is now exclusive for PRO subscribers.


Mandiant will play a bigger than expected role in FireEye's turnaround story.

The shift from physical on-prem appliances means more pressure on incident responders to drive ROIC.

This bestows conversion rate at every level of the value chain in the hands of the human element to make FEYE's AI-driven technology a standout product amidst growing competition.

With opportunities for massive cost savings, how can Mandiant achieve its hidden potentials?

Mandiant was acquired by FireEye (FEYE) in 2013 in one of the largest cyber security acquisitions till date. Then, off the back of the APT One report, Mandiant was projected into the media limelight as the go-to company for mitigating the so-called nation-state attacks. These attacks were deemed the most organized, sophisticated and deleterious, capable of being pulled with such level of stealth and precision that the victim will be totally unaware, years after the operation has been carried out.

In what was deemed a land and expand strategy, the Mandiant team which specializes in threat detection (endpoint), advanced threat intelligence, and alert services, including post-breach forensic and incident response, would help win new logos.

Essentially, by performing a forensic audit of a network akin to a penetration test, the Mandiant team would expand the level of FEYE's engagement via its recommendations and inferences from its findings.

However, 3 years later, the annual revenue from the combined deal is yet to hit the $1 billion windfall FireEye paid for Mandiant.

The projections that Mandiant will produce an upward ramp in ARR didn't pan out and the opportunities to upsell and cross-sell became fewer and far between.

I took a closer look at the revenue contribution from professional services (largely driven by Mandiant services) and the numbers have not been so promising.

Mandiant was making $100 million in sales in 2013. In the last earnings report, the professional services division was responsible for only $121 million of FEYE's 2016 annual revenue as indicated in the chart above.

In an effort to pause the freefall, FireEye has transitioned its business model into a subscription/service-based platform. With offerings like FaaS (FireEye as a Service) amidst several attached and non-attached subscriptions, how will Mandiant achieve the aim it was acquired for?

The opportunities for Mandiant arise from deal sizes, frequencies of cyber-attacks and margins per engagement. In the past, the Mandiant team was popular for charging high fees per engagement, giving rise to the lofty optimism at the time of the deal.

While competition and the declining scale of cyber-attacks have been a headwind to top line sales growth, it is hard to justify that FireEye is breaking even in the professional services division. Given that it is a division with a significant portion of headcount (mainly researchers and forensic experts), there is a need to understand the revenue contribution of each talent.

Data: From Marketwatch

Broadly, FireEye has one of the lowest sales/employee figures, as indicated in the chart above. Compared to other competitors, the chart details the gap in the overall conversion rate of its talents.

This is important given that the new Helix technology alongside the new vision of the company revolves around melding talent with AI to drive better intelligence. Since talent plus AI is the heart of FireEye's value proposition, we need to start witnessing improvement in either sales growth or profit/talent.

This will justify any decline in redundant hardware appliance sales as a result of an automation-driven effort to improve TCO while edging out competitors in pricing. This is important because not all competitors are giving up on redundant hardware sales as soon as expected.

While the overall market is being forecasted to shift towards fewer appliances, implying smaller deal sizes; this will result in a sequential decline in sales or profit per head.

Therefore, for an early innovator like FireEye, the Mandiant division holds the key to capturing future market share as more intelligence-driven architectures (built for the cloud) will take over appliance-filled data centers.

While this trend will drive a need for more value per talent, it also means a corresponding need to improve the insights and conversion rate at every level of the value chain.


Going forward, the leading figures of value creation will shift from generic metrics (growth-based) such as the number of appliances sold, net new logos to efficiency driven metrics like sales conversion ratio, revenue/head, ROIC, and ROA. Driven by lower deal sizes and increasing competition, talents will command a larger portion of ROIC and ROA.

Chart FEYE Return on Assets (TTM) data by YCharts

While return on asset and equity have been on an upward ramp, FEYE still lags competition in its ability to generate a positive return on invested capital.

Therefore, in the absence of a justification for poor sales/quarter, losing out on important RFPs and clients (Fortune 500) would prove costly. Essentially, FireEye is becoming like a law firm in which the reputation of its talents can make or break its yearly revenue and profitability projections. And these talents will be playing a significantly greater role than ever to differentiate FEYE from competition.

Provided that no significant improvement is made in R&D to strengthen its current line of security boxes; also, in the absence of an acquisition, all eyes will be on the sales and marketing team to deliver quarterly promises. And if the last two quarters are anything to go by, investors should expect highly volatile quarterly prints as the human element takes a significantly greater role in driving FireEye's turnaround story.

Disclosure: I/we have no positions in any stocks mentioned, and no plans to initiate any positions within the next 72 hours.

I wrote this article myself, and it expresses my own opinions. I am not receiving compensation for it (other than from Seeking Alpha). I have no business relationship with any company whose stock is mentioned in this article.