Barracuda sold to another private equity business


Mail backup and security vendor Barracuda Networks has been sold by its private equity owner to another, giving an indication of late-stage startup life after an IPO had been ruled out.

Barracuda was acquired for $1.6 billion in November 2017 by Thoma Bravo, a private equity investment company. Thoma Bravo has now sold it to KKR for an undisclosed sum. KKR sponsors investment funds that invest in private equity, credit, and real assets, and has strategic partners that manage hedge funds.

Barracuda CEO Hatem Naguib said:  “We‘re grateful to Thoma Bravo for their valuable strategic and operational support over the last four years.”

Chip Virnig, a partner at Thoma Bravo, added: “Barracuda has been a tremendous partner over the last four years and has experienced strong product, customer and revenue growth. We have enjoyed working closely with Hatem and his team through multiple acquisitions and operational improvements, and we are confident that the company is well-positioned for continued success.”

The Barracuda Networks business was started in 2003 and took in $46.4 million through five funding rounds, according to Crunchbase, but it lists two rounds for undisclosed sums so that is probably understating the total raised.

When it was bought by Thoma Bravo, Barracuda was a $400 million run-rate business. Financial analyst Jason Ader said at the time: “For Barracuda, we believe the Thoma Bravo acquisition is probably the best scenario for shareholders, given skepticism regarding the company’s ability to transition the business from on-premises appliances to cloud-based solutions and recent margin challenges.”

Thoma refocused the business on public cloud security along with network security (firewalls) and small and medium business customers. Now John Park, a partner at KKR, says: “We are excited to complete this transaction and begin working with the Barracuda team to support their continued growth and delivery of next generation cloud-first cybersecurity solutions that protect SMEs from an evolving landscape of threats.”


The sequence of events  is that Barracuda was founded in 2003, grew with VC funding to its $400 million/year run rate, but an IPO did not happen. Instead, 14 years after being founded, it was bought in a first-stage private equity transaction. Nearly five years later, it is in the second stage of its private equity life. 

We think stage one reshaped it as a continuing and dependable revenue-earning business. We also think it likely that Thoma Bravo would have sold Barracuda to a publicly owned corporation, if one had wanted to be a buyer, but KKR bought it instead.

The pattern of events here is what probably awaits all late-stage technology startups that have a decent run rate but whose IPO dreams have faded. Private equity ownership beckons if the private equity people can see a viable business (as in, we can do stuff with it and sell it on later). 

Data protection business Datto IPO’d in late 2020 with Vista Private Equity partners having 69 percent of the shares. Datto was then sold to Kaseya for $6.2 billion. There’s money to be made here by PE businesses.

Veritas, coincidentally another data protection and security business, is in stage one private equity ownership, according to this reckoning. The Carlyle Group bought it for $7.4 billion in January 2016.  It’s a potential outcome for other data protection and security startups that can’t quite get to the IPO level but have dependable and sticky revenue streams. These are big bets by private equity players and can take years to play out.