Thales to acquire Imperva for US$3.6 billion, expanding its cybersecurity business

French multinational company Thales announced Tuesday that it has reached an agreement with software investment firm Thoma Bravo for the acquisition of 100 percent of Imperva, a U.S.-based data and application cybersecurity company, for an enterprise value of $3.6 billion. The deal excludes Imperva’s transport business, which is being divested. With this acquisition, Thales is taking its cybersecurity business to the next level. 

The deal enables Imperva to drive growth in data security and Thales’ entry into the application security market. Imperva’s integration into Thales will also significantly expand Thales’ addressable market in an already fast-growing sector. The acquisition is in line with Thales’ disciplined capital deployment framework, with no impact on the Group’s existing dividend policy or ongoing share buyback program.

“The acquisition of Imperva marks a major milestone in Thales’ cybersecurity strategy,” Patrice Caine, chairman and chief executive officer at Thales, said in a media statement. “With this acquisition, we are seizing a unique opportunity to accelerate our cybersecurity capabilities and are taking an important step towards our ambition to build a world-class global cybersecurity integrated player, providing a comprehensive portfolio of products and services. We have tremendous respect for Imperva’s innovative application and data security offerings.” 

Caine added that Imperva and Thales share the same vision and the same DNA. “We are thrilled to enter the next phase of our growth together. We look forward to welcoming Imperva to Thales to further enhance our cybersecurity solutions, and help customers address their most important digital security challenges.”

“Today’s announcement represents an exciting new chapter for Imperva, one that will further our mission to help organizations protect data and all paths to it, bring better protection and strategic value to our customers and partners, and create more opportunities for our team members,” according to Pam Murphy, chief executive officer at Imperva. “We admire Thales’ vision and culture, and believe that, together, we can deliver greater product innovation and efficiency through disruptive solutions, while helping to simplify the greatest security challenges facing organizations today: protecting digital identities, applications, APIs, and data in any environment, and any industry.”

With over half a billion dollars in revenue on a TTM (trailing twelve months) in 2022, basis and over 1,400 employees, Imperva protects critical applications, APIs, and data anywhere at scale. With an integrated approach combining edge, application security, and data security, Imperva protects companies through all stages of their digital journey.

Headquartered in San Mateo, California, Imperva has a global footprint in the Americas, Asia Pacific, Europe-Middle East, and Africa, and monitors threats across 180 countries. Its comprehensive portfolio combines expertise and products in the fast-growing application and data security markets, including application security and data security advanced offerings.

Imperva offers a Web Application Firewall (WAF), which prevents attacks by analyzing web traffic to applications. Imperva’s Application Security portfolio includes API security, advanced bot protection, and DDoS (distributed denial-of-service).

Imperva’s Data Security platform helps enhance the visibility of a company’s data, in order to prevent breaches and avoid compliance issues. It provides Data Discovery and Classification on both structured and unstructured data, data security governance, data access monitoring, risk analysis powered by AI, real-time risk monitoring, and intrusion detection on databases, on-premise, and in the cloud.

With this acquisition, Thales will add circa $500 million of revenue and expand its data and application security offering. The combination of Thales and Imperva’s operations will create a world-class global cybersecurity portfolio structured around three product areas – Identity (Thales); data security (Thales and Imperva); and application security (Imperva).

Additionally, Thales and Imperva will combine their respective strengths. Increased capabilities are notably expected in the fields of protecting data at rest and data in use, complementing Thales’ know-how in data in motion. Imperva and Thales will also benefit from their strong complementarity and cultural fit in terms of clients and addressable markets. The combination is expected to yield significant commercial opportunities within the existing client base as well as revenue synergies in the years ahead.

Thales estimates that the combination will generate c.$110 million of pre-tax run-rate synergies, including $50 million of cost synergies and $60 million linked to revenue synergies.

Thales plans to regroup as of Jan. 1, 2024, all its civil cyber activities, currently split between its Digital Identity & Security (DIS) and Defense and Security operating segments within the DIS. This will further strengthen DIS’ position as a go-to player for civil cybersecurity products and solutions, and facilitate the capture of synergies within the full portfolio.

This acquisition allows the Group to set new financial targets for DIS. Over the 2024-2027 period, DIS sales are now expected to grow annually by 6-7 percent on an organic basis, to reach a level of sales that will be between €5.4 to €5.5 billion in 2027. Its EBIT margin should reach 16.5 percent by the same horizon.

The closing of the transaction is expected by the beginning of 2024, upon completion of customary anti-trust and regulatory approvals.

In January 2021, Thales announced a collaboration agreement with TT Electronics to enable the future development of operational technology (OT) based cybersecurity initiatives and research. The deal will blend Thales’ experience in securing critical systems with TT Electronics’ approach to electronics manufacturing.

Anna Ribeiro

Industrial Cyber News Editor. Anna Ribeiro is a freelance journalist with over 14 years of experience in the areas of security, data storage, virtualization and IoT.