Today, we take a closer look at a small cybersecurity startup and Busted IPO that recently announced a relationship with Alphabet (NASDAQ:GOOGL) and trades at slightly more than 50% of forecasted revenues. An analysis is provided below.

Overview of the Company

ZeroFox Holdings, Inc. (NASDAQ:ZFOX) is a SaaS-based external cybersecurity solution provider situated in Baltimore, Maryland that exposes disrupts, and responds to threats beyond the typical corporate perimeter. It leads the category with 2,100 clients, more than 1,200 of whom are service subscribers. ZeroFox was founded as Riskive in 2013 and went public in August 2022 after merging with special purpose acquisition company (SPAC) L&F Acquisition Corp. and ID Experts Holdings (IDX). Its first post-merger transaction was at $10 per share. the stock trades at roughly $.80 per share, corresponding to a market cap of around $100 million, excluding the issuing of 9.4 million shares for the planned acquisition of LookingGlass.

The fiscal year (FY) of the corporation ends on January 31st. To minimize ambiguity, FY23 refers to the fiscal year ending January 31, 2023.

Cybersecurity on the Outside

Traditionally, cybersecurity has concentrated on securing an organization’s assets, such as laptops, networks, systems, and cloud workloads. With more businesses delivering mobile or online applications and/or utilizing social media to facilitate consumer engagement, more of their digital assets are now located outside of their ‘internal’ corporate borders. Traditional cybersecurity concerns that focus either internally or at the edge – where computing and data storage is given to the end user via a distributed architecture – generally ignore and unprotect these digital assets on the public internet. As a result, these external assets are vulnerable to assault, as indicated by a 307% increase in account takeover attacks in the last two years.

Capabilities of ZeroFox

Here comes ZeroFox. Its solutions handle the full range of external threats via four strategic platform pillars: protection, intelligence, disruption, and response.

ZeroFox Protection regularly monitors newly registered domains relevant to the client’s brands to verify that a bad actor is not mimicking the brand in order to either divert customers away from the true brand or damage its reputation. It also monitors dark web talk to prevent the selling of sensitive client information.

ZeroFox Intelligence discovers and collects information about potential attackers across the internet, with the assistance of a specialized threat intelligence analyst. The acquisition of LookingGlass, a provider of attack surface intelligence for global threat visibility and cyberattack disruption, would strengthen this unit.

ZeroFox Disruption can: take down a malicious domain; delete objectionable or sensitive content from social networks, mobile app stores, and other channels on behalf of a customer; and prevent traffic from traveling to dangerous sites across the web.

ZeroFox Response delivers breach notification to the client and cyber insurers, incident remediation, and compromised individual protection services. This unit was improved by combining it with IDX.

Revenue Segmentation

Subscriptions and Services account for the majority of the company’s revenue. Subscriptions give users access to ZeroFox’s platform, which includes protection, intelligence, disruption, and response capabilities, as well as credit and identity protection services. This unit generated $61.8 million in sales in FY23, compared to $48.3 million in FY22, a 28% increase.

The money generated by services is derived from breach response, training, and investigative services, which can be offered at a fixed or variable price. The majority of this business comes from IDX’s U.S. Office of Personnel Management (OPM) contract ($82.7 million), which was responsible for $113.9 million in revenue in FY23, an 8% increase over $105.4 million in FY22.

Domestic clients account for over 90% of ZeroFox’s revenue.

Market Potential

Based on internal business estimates, the overall addressable market for external cybersecurity solutions is estimated to be between $9 billion and $13 billion.

Results and Outlook for the Fourth Quarter of Fiscal Year 23

The company announced a Q4 FY23 non-GAAP loss from operations of $7.2 million on total revenue of $45.4 million on March 14th, 2023. There are no comparables, and management chose not to provide net income on a non-GAAP basis. A back-of-the-envelope computation puts non-GAAP earnings in Q4 FY23 at a loss of $0.16 per share.

In FY23, revenue increased by $22 million to $175.7 million, reflecting a 14% rise. Nonetheless, annual recurring revenue from its platform increased 27% to $74.0 million, excluding its OPM contract. The adjusted gross margin was 41%, which was hampered by the low-margin OPM contract. Subscription Adj. gross margin was 73% ex-OPM.

In fiscal year 24, management anticipates a non-GAAP loss from operations of $9.55 million on revenue of $185 million (based on range midpoints), representing a 5% increase in revenue.

Google Collaboration

That prediction was made before the company announced a collaboration with Google Cloud to combat phishing campaigns, which are on the rise. ZeroFox will utilize its expertise and artificial intelligence to identify phishing domains, which have surged by 75% in the last year, and will report harmful URLs using Google Cloud’s Web Risk Submission API to alert users and interrupt assaults. The announcement of this cooperation drove ZFOX shares up 21% to $1.99 on a volume of 29 million shares on April 11, 2023. Short on specific economics, ZeroFox’s stock has since fallen by 60%.

Balance Sheet and Analyst Commentary

 As of January 31, 2023, the firm had $47.5 million in cash and equivalents against $173.8 million in debt. In Q4 FY23, ZeroFox expended $5.3 million in cash from operations.

Given its small size and the somewhat haphazard manner in which ZeroFox went public – L&F was past its initial 18-month time allotment to close a deal – it is not surprising that the only Street coverage comes from Stifel and Jeffries, both of whom were agents on the PIPE financing concurrent to the August 2022 merger that publicly birthed ZeroFox. Stifel rates ZFOX shares as a buy with a $6 price target, while Jeffries rates them as a hold with a $3 price target. They anticipate a loss of $0.25 per share (non-GAAP) on revenue of $185.4 million in FY24, followed by a loss of $0.38 per share (non-GAAP) on revenue of $200.9 million, showing 8% growth in the top line. Neither analyst has spoken since the Google agreement was announced.

Verdict

It’s difficult to believe that this SPAC-born company was sold for $1.1 billion. It had little chance of being profitable – unprofitable businesses were already obsolete when the company went public – and was sold to the public at 6.7 times FY23 revenue. That statistic was 12 times revenue if the low-margin OPM contract is removed, with a 5% growth rate, predicted for FY24 and net debt of $100 million. After completing the first post-merger trading session at $14.71 on August 4, 2023, shares of ZFOX were down 74% by September 6th, exemplifying the ludicrous prices that Wall Street banks may periodically foist on an ignorant market.

Given its FY24 operational loss prediction, management’s assumption that it has “the capital required to cross over free cash flow breakeven late next year [YEFY25]” is a risk the market isn’t and shouldn’t take. If a capital raising is required, any dilution will be noticeable if the stock continues to trade near $1 per share.

The external cyber threat market has real legs in theory, and ZeroFox’s solutions look to be well-received, but it lacks a moat to prevent internal and edge cybersecurity companies from expanding their array of offerings to cover external threats. When you consider the present macro background, which will delay sales cycles, it’s difficult to get enthused about ZeroFox, even though it’s now trading at slightly more than 0.5 times FY24 revenue. As a result, it is smart to remain on the sidelines until there is greater clarity that the company can attain profitability without dilution.

Featured Image: Pexels @ Caio

Please See Disclaimer