Proofpoint, Inc. (PFPT) is a cybersecurity company with a different approach than what the typical tech company provides. Proofpoint provides people-centric security and compliance solutions for companies with the goal of protecting employees by use of security awareness training, phishing simulation, web browser isolation, and soon zero trust.
The company has a comprehensive set of capabilities:
These capabilities include email protection and authentication, advanced threat protection, data loss prevention, email encryption, SaaS application protection, response orchestration and automation, digital risk, security training, web browser isolation, archiving, eDiscovery, supervision, and secure communication. Our solutions are built on a flexible, cloud-based platform and leverage a number of proprietary technologies - including big data analytics, machine learning, deep content inspection, secure storage, advanced encryption, intelligent message routing, dynamic malware analysis, threat correlation, and virtual execution environments to address today's rapidly changing threat and compliance landscape."
Proofpoint meets the Rule of 40, has expected growth of 20+%, great free cash flow, and, in my opinion, is fairly valued. I believe that Proofpoint is a solid Growth-At-a-Reasonable-Price (GARP) investment. Therefore, I am giving Proofpoint a Buy rating.
Proofpoint was founded in 2002 with a product that tackled Email spam and viruses. Since then, Proofpoint has evolved its solutions to defend against threats originating from mobile apps and social media, and protect and provide compliance for corporate information.
Proofpoint typically expands its product offerings primarily via acquisitions. In the last ten years, Proofpoint has acquired more than 16 companies, most recently Meta Networks, a company with zero trust network access technology.
Proofpoint now has a portfolio of 18 unique services, with the newest additions contributing significantly to growth:
…our emerging products continued to be an excellent source of growth, meaningfully outpacing the rest of our product portfolio and again, contributing over one third of the total new and add-on business closed during the quarter."
Competition in cybersecurity is, of course, fierce. Symantec (NASDAQ:SYMC) and Cisco (NASDAQ:CSCO) have products that directly compete with Proofpoint's offerings. Large companies such as Microsoft (NASDAQ:MSFT) and Google (NASDAQ:GOOG) (NASDAQ:GOOGL) are developing their own security features that compete with Proofpoint. There are also smaller companies such as FireEye (NASDAQ:FEYE) and Mimecast (NASDAQ:MIME) that compete with partial solutions. Finally, software vendors may offer security solutions as part of a bundle that makes it attractive to go with a competitor.
I determine stock valuation on a relative basis by comparing sales multiples and sales growth to the company's peers. I believe that high-growth companies should be more highly valued than slow-growth companies. After all, growth is a prime factor in valuation models such as DCF. Higher future growth results in higher valuation and, therefore, higher EV/sales multiple.
To illustrate this point, I created a scatter plot of enterprise value/forward sales versus estimated YoY sales growth for the 82 stocks in my digital transformation stock universe.
(Source: Portfolio123/MS Excel)
The sales multiple in the vertical direction is calculated using the EV, "next year's sales estimate" mean value based on all analysts from the Portfolio123 database. The estimated YoY sales growth is calculated using "current year's sales estimate" and "next year's sales estimate" also provided by Portfolio123.
As can be seen from this scatter plot, Proofpoint is sitting slightly below the trend line, suggesting that its forward sales multiple is modestly lower than its peers, given its estimated future revenue growth rate. My interpretation is that Proofpoint is fairly valued relative to the average stock in my digital transformation universe.
High growth companies generally sacrifice profits for growth, and traditional value factors such as P/E ratio are not meaningful. Therefore, I focus on other metrics such as the "Rule of 40," free cash flow margin, and cash burn to evaluate software companies.
The Rule Of 40
The Rule of 40 is a metric used by software companies to help them achieve a balance between growth and profitability. The Rule of 40 is interpreted as follows: If a company's growth rate plus profit adds up to 40% or more, then the company has balanced growth and profit and is financially healthy.
There are several different ways of calculating the Rule of 40:
Growth - The standard growth metric is to use the Annual Recurring Revenue (ARR) growth rate. For my Rule of 40 calculation, I use percentage sales growth TTM. There are three reasons for this: (1) ARR is not always available; (2) most SaaS companies grow not only organically but also by acquisition; and (3) many companies are in the middle of a transformation to SaaS and have a significant amount of product sales.
Profit - I have seen many variants for the profit metric. Some analysts use EBITDA margin, others use operational cash flow margin or free cash flow margin. I use the free cash flow margin, as I believe that is the most meaningful factor from an investor perspective.
Proofpoint's revenue grew by 29.9% for the most recent twelve months, down from 43% revenue growth a little more than two years ago.
Free Cash Flow Margin
Proofpoint had a free cash flow margin of 23.8% for the most recent twelve-month period.
Rule Of 40 Applied To Proofpoint
Proofpoint's YoY revenue growth was 29.9%, while free cash flow margin for the trailing twelve months was 23.8%. Therefore:
Revenue Growth + FCF margin = 29.9% + 23.8% = 53.7%
Since the Rule of 40 calculation comes out higher than 40%, I conclude that the company is financially healthy with balanced growth and profits.
Note that Proofpoint management is quite aware of the Rule of 40 and uses the same factors as I do. From the Q2 2019 results earnings call transcript:
I would like to highlight that this guidance for 2019 reflects our dual objectives are driving attractive growth in both revenue and free cash flow, which remains a hallmark of Proofpoint's disciplined operating strategy, and is further corroborated under the rule of 40 metric as discussed in prior quarters."
Normally, when a company fulfills the Rule of 40, I don't analyze cash burn. But I am providing the SG&A expense here for reference. In the case of Proofpoint, the SG&A expense is 84% of the total revenues.
Note that SG&A includes Sales & Marketing, General & Administrative, and R&D.
In the case of Proofpoint, the SG&A expense is 84% of the total revenues. This means that Proofpoint is spending a significant portion of revenue on SG&A expenses. Proofpoint is burning cash, but the question is whether it is excessive cash burn. In order to determine this, I use a scatter plot that shows the operating margin/EV versus forward sales growth for all of the stocks in my digital transformation stock universe. The operating margin for my purposes is before depreciation and amortization and is calculated as follows:
Operating Margin = Gross Margin TTM - SG&A Expense Margin TTM
(Source: Portfolio123/MS Excel)
Proofpoint is for all practical purposes sitting on the trend line, meaning that spending plus gross margin is in line with its SaaS peers for the expected future growth.
While the long-term picture for Proofpoint appears to be quite rosy, there are several investment risks that investors should be aware of.
The first concern is that the investment is based on revenue growth expectations that may fail to materialize. Outlook failure may occur as a result of new technological trends, increased competition, erosion of the customer base, or a recession.
Some analysts believe that SaaS stocks are in bubble territory, and it is possible that we could experience a dot-com-like crash in the future. Remember that my valuation assessment is relative, not absolute. If the SaaS cohort falls, Proofpoint stock will fall as well.
High-growth SaaS stocks are also very sensitive to any market volatility, even if not related to the company's area of business. Growth tends to magnify volatility.
Proofpoint provides people-centric security and compliance solutions including security awareness training, phishing simulation, web browser isolation, and soon zero trust. The company has acquired more than 16 companies in the last ten years. These acquisitions have been catalysts for Proofpoint growth and the company now has 18 services in its portfolio. There is significant competition in the cybersecurity industry, but with a focus on people-centric solutions, Proofpoint products protect well over 100 million end-users.
Proofpoint fulfills the Rule of 40 metric as a result of good revenue growth and free cash flow margin. I believe that the stock is fairly valued and that Proofpoint is a good GARP investment. Therefore, I have given this company a Buy rating. This investment comes with significant risk. All SaaS stocks have very lofty valuations, and at some point in time, there will be a significant correction. Proofpoint may also fail to meet analyst growth expectations which would cause the stock price to go down. Also, keep in mind that SaaS stocks are highly volatile and can easily lose 5-10% on market noise unrelated to the stock's area of business.
Disclosure: I/we have no positions in any stocks mentioned, and no plans to initiate any positions within the next 72 hours. I wrote this article myself, and it expresses my own opinions. I am not receiving compensation for it (other than from Seeking Alpha). I have no business relationship with any company whose stock is mentioned in this article.