
Matasano Security acquired for £8.4m ($13m) - Congrats tptacek - ontoillogical
http://www.nccgroup.com/en/news-events/news/acquisition-of-a-leading-us-security-testing-business-for-%C2%A384m/
======
tptacek
If you thought I was insufferable _before_...

~~~
jonknee
So where are you eating your celebratory meal?

~~~
tptacek
My flight out got cancelled, so my celebratory meal was "Marriott room service
Caesar salad".

Apropos nothing: I do not understand why anyone in 2012 flies United. And
while I understand why someone might order a Marriott room service Caesar
salad, I do not recommend it.

~~~
rdl
SWUs for international flights. Especially if you buy them on eBay for $200. A
cheap coach international fare + a $200 SWU puts you in United Business, which
is sometimes better than best-carrier coach. (honestly, I'd prefer CX Economy
to UA business on most routes, but UA wins for SFO-IAD-KWI.)

~~~
semanticist
United business between Edinburgh and Newark means seats that fold down into
beds and was entirely worth the US$480 I paid to upgrade my flight home last
month.

They also have a monopoly on direct flights to the US from Edinburgh, which is
another reason someone might end up on a United flight.

------
casca
This is an interesting purchase as Matasano is a services company that has
some of the smartest people in infosec. For those not in the field, Thomas,
Dave and Jeremy are well known and highly respected.

Many acquisitions are to get the talent but I can't remember another one where
it's so apparent. The problem is that talent is mobile and $13m for a few
super-smart people who leave after a year is expensive.

~~~
tptacek
There is no such thing as a non-talent acquisition in consulting. We're not
going anywhere; like iSEC before us, we continue to run independently as
Matasano.

~~~
nomore
Are you sure about that?

I used to work for a company NCC Group bought a few years ago and I heard Rob
Cotton say the same thing...

Things got interesting really fast after our friends in Manchester bought us -
changing what computers we use (on the desktop _and_ server), changing email,
etc, etc.

~~~
secalex
I'm one of the founders of iSEC (acquired by NCC in Oct 2010) and I can
confirm that we've had a lot more freedom than anybody actually expected.
There should be a lot more collaboration between iSEC and Matasano as Tom
pointed out, but they don't have to fear the NCC borg assimilating them just
yet.

------
jgrahamc
I'm happy for tptacek. He's a great member of this community and deserves
every success.

~~~
nanijoe
It almost feels like a personal win here(not in SV, "more experienced guy",
networking background etc)...also shows you can be obnoxious and right at the
same time

~~~
dfc
What is SV?

~~~
dbattaglia
Silicone Valley

------
casca
For those who are familiar with tptacek from HN but don't know why he's so
respected in the infosec space: [http://krebsonsecurity.com/2012/06/how-to-
break-into-securit...](http://krebsonsecurity.com/2012/06/how-to-break-into-
security-ptacek-edition/), [http://krebsonsecurity.com/2012/06/how-companies-
can-beef-up...](http://krebsonsecurity.com/2012/06/how-companies-can-beef-up-
password-security/)

~~~
ilconsigliere
I'm really enjoying the "How to Break into Security" posts you linked to.

The infosec (specifically, appsec) space seems very very interesting.

------
fasouto
Congrats for the adquisition tptacek! :)

[Off topic] I really like the name "matasano", it means bad doctor in informal
Spanish. Matasano = matar(kill) + sano(healthy) literally means the doctor who
kills the healthy patients.

~~~
tptacek
We like the name too! We picked it after giving up on naming the company (we
had chosen "Aperture Security" only to find a week later that it had already
been taken) and consulting a "list of plant names" for cool-sounding plants.

We hired a (very smart) Argentine national friend of ours who immediately made
us aware of the connotation. We were somewhat unhappy for about 500
milliseconds, and then immediately very very happy.

~~~
zfran
> We hired a (very smart) Argentine national friend

Any chance we could know who that was? I'm argentinian too and I'm curious.

~~~
tptacek
Max Caceres.

------
smountcastle
How come only ~1.3x annualized revenue (the press release said: Year to 30
June 2012, Matasano revenue was $5.0m)? That seems like a very low multiplier
-- are consulting companies treated differently from product companies in this
regard?

~~~
patio11
Services companies, of which consulting companies are a subset, typically
receive 1.5x to 2x multiples. [n.b. Your math does not match my math.] Why is
this less than product companies get? That's less because consulting companies
are a bad place to be and more because successful products are an awesome
place to be.

It is totally reasonable to have a product company do $7 million of revenue
on, say, $2 million of costs. (Let's see: four devs, two sales guys, one
marketing, two founders... throw in overhead and we're there.) An acquiring
company might have an easy, obvious path to turning that into $70 million of
revenue on $5 million of costs. (For example: "We change essentially nothing
about your company. We hawk your product to our customer base, using our sales
guys, who 6 weeks ago only uttered your name if a customer brought it up, to
disparage you. This makes us a mountain of money.")

A services company, on the other hand, might have $7 million revenue on $4
million in costs (16 consultants, 1 business manager, 2 founders). The most
straightforward pathway to take this business from $7 million to $70 million
is to add 144 consultants. They cost ~$40 million a year. This would be a
radically less attractive proposition if it were even possible, but if hiring
144 consultants was easy, you wouldn't have to buy a company to find only 16
of them.

Also, with a dev company you're buying some capital (software) plus renting
access to brains. With a consulting company, you're renting access to brains.
In all circumstances, brains can move. Software rarely decides to do that
spontaneously.

Edit to elaborate: The above is not a strike against doing consulting, by the
way. Thomas, for example, has frequently mentioned on HN two true, salient
facts: a) almost all products fail miserably and b) the principals at a
consulting company beat BigCo salaries approximately the second they call
themselves "principals at a consulting company", which is very much not the
case at most product companies.

~~~
dugmartin
What keeps me building product each day after billing 8 hours of consulting
time is that consulting profit is a linear function of time * employees but I
can't make more time and I don't want to manage a bunch of consultants.

------
alinajaf
More congratulations for tptacek, I'm significantly less stupid for his
comments and wish him all the best.

It's weird, just today I was thinking about what it would be like to work at a
company like Matasano instead of being the paranoid security guy on every web
app project I'm hired for.

~~~
ontoillogical
They're only hiring more people now then before. You should apply.

~~~
alinajaf
I've had a look at the requirements and I'm not really up to scratch,
additionally I've spent the last five years trying to get _out_ of full-time
employment. If I were looking for a day job and was able to relocate to the
states, I would totally spend a few months training up on the required skills
and send my details over.

------
revorad
Congrats tptacek!! Thanks for all your amazing comments over the years and now
that you are set for life, I expect more higher quality commentary. :-P

------
latortuga
Congratulations Thomas, I know I'm not the only one who has learned a mountain
about security from you! You're an invaluable member of the community.

------
justjimmy
tptacek is one of the few names on HN I recognize during my short time here
(not to mention he posts alot!), so needless to say it's pretty awesome to see
this happened to him/her.

Congratulations!

------
petercooper
This makes me wonder.. how many of the <http://news.ycombinator.com/leaders>
have had a company/technology acquired? Would be an interesting stat.

------
edanm
Congrats tptacek.

Besides being very happy for you, I'm now very happy for myself, for listening
to your advice during the last half-year of starting my own consulting
business.

Your very generous and open comments about everything to do with running a
consulting business were, and are, a constant source of help and
encouragement.

So congratulations, and I hope you have a lot of fun with your new friends at
sibling companies! Much deserved!

------
trevelyan
What a wonderful thing to read. Upvoting threads doesn't have the weight of
leaving a separate note, so congratulations!

------
kyro
Jesus, another no-revenue Silicon Valley social startup acquired. This madness
will never end.

Congrats, though, Thomas.

------
rdl
Congratulations! (and wow, the low multiple for consulting in general is kind
of sad, but oh well)

~~~
alinajaf
£8.4 million sits comfortably in the 'fuck you' category of windfalls as far
as I'm concerned.

~~~
rdl
Split how many ways? (and maybe there is equity split beyond the top 3?) I
personally would be quite happy with $5-10mm, but to net that, I presume he'd
have to sell the company in the $40mm+ range. Nice that they did it this year
before cap gains go up, though.

~~~
void-star
HN always seems so fixated on the big payout. tptacek, the other founders, and
employees have also just taken their baby to the next level in so many ways.
Getting acquired doesn't have to be the end-game.

~~~
_delirium
There's a not-always-unjustified perception in the SV startup scene that it
_is_ the end-game, at least of a particular run, because so many startups'
products are shuttered by the acquirer. So it better be a big enough payout
that you're satisfied with that cashout.

But it looks like this is a quite different kind of acquisition, where they'll
basically be doing the same job as before, just under a new umbrella, so it's
not really cashing out and shutting down the old business at all.

------
debacle
Does this mean you're going to be putting some of that $13m towards hiring a
few fellow HNers?

~~~
tptacek
Yes? Very yes?

------
dhimes
I'll add yet another "Congratulations, Thomas." Not only have your posts
enlightened me with answers about security, more importantly they have taught
me to ask _questions_ about security practices. Thank you. This WIN was well-
deserved.

------
grandalf
Congrats! I've much enjoyed your comments and knowledge on HN over the years.

------
gruseom
Extremely many congratulations! Now get some sleep.

~~~
tptacek
Can't sleep. Clown'll eat me.

------
feralchimp
rock on, tptacek! if you're not eating sushi off the top of a rare steak right
now, stop what you're doing. :)

------
rman666
Congrats tptacek and crew, and NCC, too!

------
kajecounterhack
Congrats tptacek!

------
ephermata
Congratulations!

------
staunch
Congrats!

------
sabat
For just a moment, I thought that Monsanto corporation had been acquired, and
thought: "oh, nooooo."

