Governance & Risk Management , Patch Management

No Deal: Action1 Rebuffs CrowdStrike's Interest in $1B Buy

Action1 has rebuffed CrowdStrike's interest in acquiring the patch management and vulnerability remediation startup for $1 billion and opted to remain independent, the company said.

See Also: Cyber Hygiene and Asset Management Perception vs. Reality

The Houston-based vendor has decided to turn down acquisition inquiries since the company believes its strong position in the patch management market will allow Action1 to grow into a multibillion-dollar business, according to co-founder and President Mike Walters. He worries the uniqueness of Action1's technology and dedication to patch management could be lost if integrated into a larger organization.

"We are creating a multibillion-dollar company, and $1 billion is not enough," Walters said. "When you become a part of a larger vendor, you get defocused because they have other priorities. We just believe that Action1 being independent would allow us to really take it to the highest possible level."

The announcement from Action1 comes nearly two weeks after co-founder and CEO Alex Vovk told employees in an email, "In light of the rumors inside the company, I would like to confirm that CrowdStrike is interested in acquiring Action1 with an estimated transaction value close to one billion dollars."

A CrowdStrike spokesperson responded to Vovk's Aug. 7 email by saying, "In the current environment, misinformation has become increasingly prevalent. As a policy, we do not respond to rumors or speculation." Talk of a deal came weeks after a faulty July 19 CrowdStrike software update sent 8.5 million Windows hosts into a tailspin of crashing and rebooting, disrupting hospitals and airlines globally (see: Why CrowdStrike Is Eyeing a $1B Buy of Patching Firm Action1).

CrowdStrike Challenges Action1's Version of Events

CrowdStrike pushed back against Action1's telling of events Wednesday as Vice President of Corporate Development Gur Talpaz said on LinkedIn that the company had a single 45-minute group conversation with Action1 following RSA in May. Talpaz said no members of CrowdStrike's senior team were part of the conversation, Action1 signed no NDA and no due diligence of any kind was conducted.

CrowdStrike disengaged after a surface-level conversation, according to Talpaz, and no valuation was discussed and no M&A process occurred.

"What I've seen over the past few weeks from a company called Action1 goes far beyond anything I've ever experienced in my career," Talpaz said on LinkedIn. "This behavior destroys trust and undermines the credibility of our industry."

Action1 responded on LinkedIn on Thursday, saying the company disagrees with Talpaz's post but declining further public comment since "our lawyers are in discussions."

On Monday, Walters told Information Security Media Group that there's been "extensive interest" in acquiring Action1 and that due diligence was conducted along with the type of inquiries you'd normally expect in any M&A conversation. He said Action1 couldn't comment on the exact offers due to some nondisclosure agreements being in place.

"There was no decision from any other party to walk away," Walters said. "It's us making this decision in general to stay independent. So it's not because any of those conversations fell apart."

Why Action1 Will Continue to Ride Solo

Vovk and Walters previously established and led visibility and governance vendor Netwrix before leaving in March 2018, and Walters said their success at Netwrix allowed Action 1 to self-fund growth without taking any outside investment. This financial independence gives Action1 the flexibility to prioritize long-term growth over short-term financial gains by any potential acquisitions, according to Walters.

Also, Action1 is cash flow positive, which Walters said gives the company the financial runway needed to continue growing without external pressure. Walters said Action1's customer base values the company's independence, and many clients have voiced concerns about the potential negative impact if the company were acquired. Customer sentiment further reinforced Action1's decision to stay independent.

"We can fund it so well and have a pretty much endless runway," Walters said. "We can invest in the technology. Selling the company and becoming a part of another bigger vendor does not make much sense to us now just because we can grow it so much bigger."

Interest from prominent industry players such as CrowdStrike was driven both by Action1's technological innovation as well as its potential to fill gaps in the portfolio of the potential acquirer. Larger companies would find it resource-intensive to build something similar to Action1's patch management offering in-house, which Walters said made an acquisition more feasible for these potential suitors.

What Sets Action1's Approach to Patch Management Apart

Action1's cloud-native approach enabled seamless operations for both remote and on-site endpoints, which Walters said made its technology particularly appealing to potential acquirers. Walters said Action1's ability to address patch management for both operating systems and third-party applications drove significant interest from potential acquirers.

Potential acquirers were more interested in Action'1 cutting-edge technology than its current revenue, which Walters said solidified the founders' decision to grow the company further before considering any sale. Walters said Action1's small-business users were concerned the company's free tier for an organization's first 100 endpoints might change or disappear if the company were to be acquired.

"There have been discussions on Reddit and other venues like LinkedIn," Walters said. "We've seen so many polls about Action1, with people saying, 'Please don't do that. We want you to be independent. We don't want you to get sucked into this conglomerate and become another little piece of someone else's technology, because they're going to ruin it.'"

Walters said Action1's cloud-native architecture enables seamless management of both remote and office endpoints without typical challenges such as firewall issues, setting the company apart from rivals. Prior to Action1's arrival, patch management was typically offered as a feature or add-on rather than a specialized tool, and concentrating all R&D on patching allows Action1 to address an underserved need.

"It's really difficult to reject any substantial financial opportunities. It's just emotionally hard," Walters said. "But the future can be so much brighter if we just stay focused, put even more technology investment into this and make it much bigger. That was really the driving factor behind us walking away from all those opportunities and just making this decision to stay independent."

Story updated at 00:55 UTC Thursday with comments from Gur Talpaz's LinkedIn post, and at 17:10 UTC Thursday with Action1's response to the LinkedIn post.