CA Technologies announces it will acquire cybersecurity firm Veracode for $614M in cash
Burlington security software company Veracode will be acquired by CA Technologies for $614 million in cash, the companies announced Monday. — The acquisition is expected to close in the first quarter of 2018.
Context & Ripple Effects
Veracode's exit via CA Technologies closes a two-year arc that began when the Burlington firm filed for an IPO in early 2015 and planned to go public that May — instead it takes $614M in cash from a strategic buyer. For CA, this is the second capability buy in as many years: the company already paid roughly $480M for Rally Software to build out its Agile and DevOps stack, and Veracode adds application security testing to that same developer-workflow portfolio.
First-order effects
- Veracode's planned public listing is off the table; its investors and Burlington-based team are cashed out at $614M rather than facing public-market scrutiny.
- CA Technologies gains an application-security product line it can attach to the DevOps toolchain it assembled through the Rally acquisition, selling security into the same developer customers.
Second-order effects
- Rivals read the deal as validation that DevOps-embedded security is where buyers are heading: within a year Imperva pays $140M for DevOps-security startup Prevoty, and Tenable later pays $160M for infrastructure-as-code firm Accurics — a bidding pattern for pipeline-native security assets.
- Standalone application-security vendors lose the option of an easy independent IPO, since strategics like CA are pricing these companies at cash premiums before they reach the public markets.
Third-order effects
- Application security is consolidating into broad IT-management platforms rather than remaining a standalone vendor category — a roll-up that continues when Broadcom acquires all of CA Technologies for $18.9B, putting Veracode's technology inside yet another owner's portfolio.
- If the pattern holds, security capabilities become embedded features of development platforms rather than separately purchased products, pressuring pure-play AppSec firms to sell early or differentiate on depth.
The trend: Application-security vendors are increasingly absorbed by large IT-software platforms seeking DevOps-integrated portfolios, cutting off the standalone-IPO path that companies like Veracode once pursued.