Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

"Private equity firms increasingly are setting their sights on the security industry due to its rapid and steady growth."

I do not trust private equity to main the standards necessary for quality and trustworthy security.



To be fair I already don't trust RSA Security before this sale because of Dual_EC_DBRG.


I just heard that they allegedly had backdoors for security agencies implemented. Is this refering to that?


Yeah, the NSA paid them to use a flawed random number generator as their standard.


As was said in another thread, you only tend to hear about the private equity deals that go bad. Here are some of the big ones both good and bad:

https://www.investopedia.com/articles/markets/111015/10-most...

PetSmart was one success story I heard from this podcast: https://www.wsj.com/podcasts/the-journal/how-petsmart-solved...


There is never a bad time to read Barbarians At the Gates to understand how the incentives work in these deals and to help judge for yourself whether they're going to work out or not.

Spoiler / Hot Take: if you're overloading the company up with debt (even cheap, short-term stuff) and taking out cash based on "revenue projections" or "realized synergies" it's probably not gonna work out so hot when the loan comes due.


Debt isn’t dirty. There’s a reasonable case to make for having an appropriate debt load in terms of tax shields and motivating management.


Yeah, some times it does go well. But the managers make money either ways, since they pay themselves back immediately using leverage.


I do, for the sole reason that at the end of (almost) every private equity deal is an exit, and in order for the company to be sold at a higher price than it was bought, it still has to be good/better at what it is supposed to be doing. Also, from my experience for these sorts of Tech deals, the level of due diligence conducted before an exit by potential buyers can be extensive, so I doubt they'd let the security parts of a security business go bad.


> in order for the company to be sold at a higher price than it was bought, it still has to be good/better at what it is supposed to be doing

As someone who has worked for PE owned companies I can confidently say that unless you consider the thing they’re “supposed to be doing” to be reflecting profit on the books, you’re wrong.

The PE owners of companies I worked for pushed EBITDA over anything else and as a result our product became a leaning Jenga tower of half finished functionality combined with unfulfilled promises to customers. Foundational systems were completely neglected in favor of whatever kept costs low and increased closed ARR focused deals. We sold for many times our previous valuation and not one person I spoke to in the company itself or our customer base felt the product was better, all agreed it was worse.


100% in agreement. Same exact experience.

The expectation is 30% YoY growth with 30% margins. At any cost. No excuses.

Your entire company, all of your software, your assets, your people? You’re a single line in a spreadsheet. You’re a stock certificate. An asset. Raise the value or be fired.

What’s that? You care about your employees? They’re working 14-hour days? You need more people. Go ahead, give all the perks you want. 30 Over 30, baby. I don’t care how you hit the number. Just do it or you’re fired.

Oh wait, you can’t hit these crazy numbers given the staff? Boo hoo. Fired.

Your product is falling apart and you’re plugging holes in a dam to prevent churn? Boo boo. Keep doing it.

We’re out in five years anyway.


+1 for the EBITDA focus when they're trying to sell. It felt like hollowing out of offerings for sake of looking good on paper.

We burned a few big clients at a previous gig because the cost-benefit of them wasn't above a certain threshold, even though they were objectively large and consistently growing customers. Few years later one got bought by a defense contractor, the other by a well known consumer goods firm; both expanded their spend. My sales execs were very salty about that...

They didn't get an buyer/exit either -- the big lead declined for reasons they didn't tell us -- and had to reformulate a strategy from scratch, which is when heads started to roll.


The "rational actor" approach to reasoning about how corporations make decisions is as seductive as it is wrong.


> Also, from my experience for these sorts of Tech deals, the level of due diligence conducted before an exit by potential buyers can be extensive, so I doubt they'd let the security parts of a security business go bad.

Due diligence conducted by whom?

If you've worked at any corporation, you will know that most organizations treat "Security" as a "Cover your ass" org. Security teams exist firstly to prevent the company from going under due to incidents; actual protection of production systems is an afterthought. Consequently, you will have corporations touting all kinds of certifications while their production systems continue to e.g. use md5 hashes for user passwords.

I would ask that you reconsider your views. You would think the buyer in these transactions would conduct due diligence, but consider that the people who are technically competent to do a thorough due diligence are few in number. It is in everyone's interest to let the transaction go through; the security due diligence happens after the decision has been made and rarely can break a deal.


Does PE do the VC thing where they buy 10 or 20 things expecting 1 or 2 to hit big and the rest to fail? If so, they're placing a bet, but if it's not promising they'll let it die on the vine.


It's kind of the opposite - funds take relatively concentrated positions using a lot of leverage then install new management or hire consultants to make the company more profitable (on paper at least, and usually by cutting costs).

Also, VC returns are distributed according to a power law because most startups won't pan out. Private equity buys companies later in their lifecycle, banking on levering up stable operating cashflow rather than banking on the product becoming the next FAANG unicorn. There's a bit of a continuum between VC -> Growth Equity -> Private Equity.


They operate a bit later on a different risk profile.

Their MO is more like (1) take something that is basically working but needs capital (2) work out a deal that gives them a enough leverage (e.g. board input/control, debt financing pressure, etc.) then (3) squeeze it for a quickish exit for the PE and (4) move on to the next.

Doesn't always work, of course, but that's the playbook.

Of course the flip side of that is sometimes, particularly with a young company, they just don't know what the hell they are doing. A PE company could potentially fix some of that, potentially at a reasonable cost.

One way to perhaps think of it is this: VC types are in the business of betting on people, and don't necessarily trust the product. PE types are in the business of betting on products, and don't necessarily trust the people.


Cybersecurity seems to be growing fast enough that the talent has run out. So lots of under-qualified CISO types running around with money to spend. I think the PE firms are onto something, investment wise.


To be fair, Entrust and RSA tokens are a relic of the past, systems like Duo Mobile are far better and easier to use.


I think you can shorten that statement significantly, wlog.


RSA was already incapable of maintaining those standards.


I don't trust Dell to do that either...


And what alternative do you propose? Public equity? Ever heard of NSA, Australian government, UK, etc, and that's just the "democratic", "free" world?


Are you implying that public equity is some sort of government-owned entity?

My best guess is that you are confused as to what the term "private equity firm" means. Your post is so entwined with implications that I have no idea what you really mean.


In my country public means government controlled, which of course includes any assets, yeah. I think as a founder of a startup with VC money and successfully investing with my own money for some time as well, I have a modest grasp on what a private equity firm is.


Is your startup planning to have an initial public offering? I’d be interested to hear how that works in your country.


How is that in any way relevant to ownership of assets?


This is about private equity vs public equity, no?


In finance, equity is ownership of assets that may have debts or other liabilities attached to them. Publicly owned assets are going to further the goals of said owning public entity (just as if it was a private owner) and of its parents in the hierarchy.


You're conflating public/private ownership and public/private availability.

"Private equity" doesn't mean "privately-owned equity". It refers to equity which is not publicly traded.

Likewise, public equity doesn't mean "publicly-owned equity"... it means "publicly-traded equity".

See: https://en.wikipedia.org/wiki/Public_equity

Also see definition 6(b): https://www.merriam-webster.com/dictionary/public

Again, I'm not sure if you live somewhere that this might be different, as you alluded above, but this is generally the case across predominantly English-speaking countries.


Okay, seems like language misunderstanding. The system is just very slightly different where I live; the law systwm here is predominantly based on the Austrian one.


This language misunderstanding took longer to clear up than I thought it would.


The problem might lie in that our laws are very precisely worded with words that could be translated as equity or other of these words as well, along with a dozen of other options. Translating these text is hugely painful to me (and other people as well, imho). While I am ok in conversational English, my level of more formal/financial English is not that good.

I've just started attending a professional English course. :-)




Consider applying for YC's Winter 2027 batch! Applications are open till November 2.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: