Bain Capital Private Equity and Crosspoint are spending $900 million to acquire ExtraHop Networks Inc., a software company that uses hundreds of machine learning models deployed side-by-side to find threats lurking in enterprises’ cloud environments.

The deal is at least the third private equity-backed acquisition of a major cybersecurity company in as many months.  

ExtraHop announced the transaction this morning. The deal’s $900 million price tag is nearly 15 times higher than the total amount of venture funding the company has raised since launching 14 years ago. The steep premium is partly explained by ExtraHop’s rapid growth: The company disclosed today on occasion of the acquisition news that it had recently passed $100 million in annual revenues and is growing 40% annually.

ExtraHop competes in the cybersecurity market with a so-called network detection and response platform. The platform’s detection features are powered by hundreds of machine learning models running in the cloud. Its threat response features, in turn, take the form of integrations that allow ExtraHop to share data about hacking attempts with other security systems such as firewalls. Those systems can then automatically block hacking attempts, which reduces remediation time because no manual input is necessary.

The machine learning models ExtraHop uses for detection are so-called unsupervised algorithms. They can identify cyberattack patterns in infrastructure security logs without having to be specifically trained to spot each type of hacking attempt, which allows ExtraHop’s platform to adapt to new types of threats that emerge over time.

The platform relies on programs dubbed smart sensors to gather the security logs it uses for threat detection. In public cloud environments, ExtraHop collects the logs using a technology called packet mirroring that the major infrastructure-as-a-service providers offer as part of their feature sets. Packet mirroring allows cybersecurity tools to create a continuously updated copy of a company’s network traffic that can be analyzed for threats.

The benefit of the technology is that it removes the need to install extra software on virtual machines to collect security data, which reduces complexity. The approach frees up hardware resources in the process since there’s one less program to run. Furthermore, cybersecurity systems that rely on packet mirroring to collect data are in some cases more difficult to disable for malware than other types of breach detection tools. 

ExtraHop originally focused on helping companies detect technical issues in their infrastructure before identifying an opportunity to apply its detection capabilities to spotting threats. The shift has paid off for the company. According to International Data Corp. research cited by ExtraHop, it’s one of the three largest players in the network detection and response market.

ExtraHop says that the sale to Bain Capital Private Equity and Crosspoint will put it in a stronger position to further grow its market share. The company, which reportedly generates most of its revenue in the U.S., hopes to expand its international presence as part of the growth push. ExtraHop will hire more salespeople, boost its channel partner activities and team up with more managed service providers to deliver its software to customers.

“According to Gartner, less than a decade ago just 10% of enterprise security budgets went to detection and response. Today, that number is over 60%, and growing,” ExtraHop co-founders Jesse Rothstein and Raja Mukerji wrote in a blog post today. The executives added that Bain Capital Private Equity and Crosspoint “see a fast growth path to ubiquity for ExtraHop on the horizon, and they are committed to providing the strategic guidance and support to help us achieve that goal through both organic and inorganic expansion and innovation.”

The reference to inorganic expansion suggests that the company may consider making acquisitions to extend its capabilities. Rothstein and Mukerji also provided a glimpse into ExtraHop’s feature roadmap going forward, detailing in the post that the company will look to provide more tools for checking if infrastructure is configured securely. Additionally, ExtraHop will “invest in building out our detection and response capabilities for the explosion of unmanaged devices now connecting to the network, including enterprise, healthcare, and industrial IoT,” the executives wrote.

The acquisition of ExtraHop is the latest in a series of big cybersecurity exits involving private equity firms. In April, private equity giant Thoma Bravo inked a $12.3 billion deal to acquire Proofpoint Inc., which helps enterprises block malicious emails. In March, TPG Capital agreed to buy cybersecurity provider Thycotic Software Ltd. for $1.4 billion. 

Bain Capital Private Equity and Crosspoint expect to close the acquisition of ExtraHop this summer. 

Photo: ExtraHop