Initiating Coverage of NetScout Systems

NetScout Systems (NTCT) enables enterprises, government agencies and service providers to monitor and secure their mission-critical networks and applications. The company’s solutions provide IT operations, security and development teams end-to-end visibility into their network infrastructure via a single pane of glass. NetScout’s transformational acquisition of Danaher’s Communications Business in 2015 positioned the company as a highly strategic supplier to its customers and expanded its total addressable market into higher growth areas like cybersecurity. However, a significant reduction in spending by its largest North American carrier customers in the ensuing years prevented the company from realizing the synergies originally anticipated. We believe NetScout has now weathered the storm and reached an inflection point for renewed growth and margin expansion. New products for monitoring virtualized and hybrid cloud environments have driven a return to enterprise growth of late, while looming carrier investments in 5G and network function virtualization suggest service provider growth may soon follow. Moreover, the availability of alternative deployment options is also increasing the mix of high margin recurring revenues that we believe will allow for more predictable results over the long-term. Our projections reflect top line stability over the coming fiscal year followed by a return to mid-single digit growth in FY ‘21. We expect the company’s non-GAAP operating margin to expand in concert and ultimately reach management’s long-term target in the low-30% range. Near-term, we would await the company’s upcoming earnings release on May 2, 2019 before taking any action as we suspect management’s FY ’20 guidance will be back-end loaded as usual and is unlikely to reflect much, if any, upside relative to consensus. Our price target of $33.00 represents a FY ’20 (March) EV/EBITDA multiple of approximately 13x and is consistent with our discounted cash flow analysis.

Investment Highlights

The Leader in Service Assurance. According to Analysys Mason, NetScout’s share of the market for IP-based service assurance solutions exceeded 40% following its acquisition of Danaher’s Communications Business, more than doubling the share of the next largest vendor. Similarly, the acquisition’s contribution to NetScout’s enterprise business lifted the company’s market share in network performance management to over 20%, nearly twice the size of the next largest competitor. We believe the company’s penetration into the largest organizations provides a substantial economic moat given its solutions have been hardened in the most demanding environments, the availability of technical personnel trained on its solutions and the scale to reinvest significant sums in product development.

An Expanded Product Portfolio. NetScout has introduced several new products over the past two years that we expect to aid in accelerating enterprise growth. vSCOUT and vSTREAM, virtualized editions of the company’s traditional nGeniusONE and InfiniStreamNG offerings, enable enterprises to monitor hybrid and public cloud environments. nGeniusPULSE adds synthetic testing to the company’s toolkit, providing the ability to test and monitor the performance of applications and other critical business services. In security, the launch of Arbor Edge Defense (AED) combines the company’s established Distributed Denial of Service (DDoS) mitigation platform with a threat intelligence gateway to provide enterprises with another line of defense against inbound and outbound threats. With the introduction of these new product offerings, NetScout is able to offer customers a greater value proposition, which we expect to translate into more meaningful growth. In this regard, NetScout’s enterprise business returned to positive organic growth during fiscal Q3 ’19 driven by the closure of over 30 transactions in excess of half a million dollars, 85% of which included multiple products such as vSCOUT, vSTREAM, nGeniusPULSE and nGenius Packet Flow Systems.

5G Network Deployments. While the advent of 5G networks may not translate into immediate gains for the company, we believe the benefits of higher data speeds, reduced latency and increased capacity bode well for the introduction of new technology and service offerings such as connected cars, smart cities and automated factories. These new network use cases have the potential to dramatically increase data volumes and provide new revenue streams for service providers, which would require additional monitoring capacity to ensure service availability. NetScout is already providing network calibration services related to 5G, and we expect the company to exhibit more meaningful service provider growth once carriers invest more significantly in 5G. In a similar vein, as carriers begin to upgrade their network infrastructure, we anticipate many will embrace the benefits of network function virtualization. This in turn should provide NetScout with ample opportunity to pursue software-only deployments, which provide customers with broader network coverage and garner the company a higher margin, recurring revenue stream.

Calling the Bottom. Between reductions in service provider spend and NetScout’s divestiture of a non-core handheld network test business acquired as part of the Danaher Communications Business transaction, revenues have declined in each of the past two years. We believe the company is approaching an inflection point in which revenues stabilize and resume an upward climb. Over the few quarters, NetScout has also instituted significant cost actions expected to reduce expenses by nearly $24 million on an annual basis, which combined with the sale of the lower margin handheld network test business provides a path towards renewed margin expansion in the near-term even absent any material top line growth. As revenue growth reaccelerates, we see steady increases in operating leverage towards management’s long-term target in the low-30% range.

Return of Capital. Despite the growth headwinds in recent years, NetScout still generated significant earnings and free cash flow, much of which was returned to shareholders via stock repurchases. In fact, the company completed a $300 million accelerated share repurchase program just last year. Given our expectation that fundamentals improve from here, we believe the company is likely to remain a buyer of its shares and may eventually opt to return cash to shareholders through a dividend.

Valuation. Based on our estimates, shares of NTCT currently trade at FY ’20 EV/Sales, EV/EBITDA and P/E multiples of 2.6x, 11.6x and 20.5x, respectively, a discount to the company’s peer group median. We set our price target at $33.00, representing a FY ’20 EV/EBITDA multiple of approximately 13x.

Investment Risks

Acquisitions. NetScout has completed several tuck-in and transformative acquisitions throughout its history and remains active on the M&A front. Acquisitions pursued by the company may not be purchased at an attractive price or yield any anticipated synergies, and may result in integration challenges, earnings dilution or other negative outcomes.

Competition. The markets for network performance management and cybersecurity solutions are highly competitive. NetScout competes with numerous vendors across each of these markets, some of whom may have significantly more scale and resources at their disposal.

Customer Concentration. Although customer spend may vary dramatically from one period to the next, the company had one customer comprising over 10% of revenue in Q3 ‘19. Large customers tend to be confined to the service provider market where AT&T and Verizon have reached that threshold in certain periods historically.

Debt. NetScout currently has $600 million in debt outstanding. Fluctuations in interest rates could raise the company’s funding cost and failure to comply with its debt covenants could negatively impact the company’s liquidity and financial position.

Industry Concentration. Approximately half of NetScout’s revenues stem from service providers, including wired and wireless communication service providers, cable television providers and other internet service providers. Should service providers reduce their spend or NetScout fail to adapt to changes in the landscape, the company’s financial results could suffer.

Intellectual Property (IP). NetScout is dependent upon the licensing of its technology to customers. Should the company fail to maintain its IP or its IP infringe upon those of third parties, the company’s results could be harmed.

Missed Expectations. NetScout’s results are reliant upon closing large transactions that are inherently lumpy and difficult to predict. Should the company’s results fail to meet the expectations of management, investors or sell-side analysts, shares of NTCT could come under pressure.

Technology Tuck-Ins and Transformative Deals

Headquartered in Westford, MA, NetScout was founded in 1984. The company provided consulting services during its formative years before turning its focus to the development and sale of network performance management products in 1992. NetScout completed its initial public offering in August 1999. Following its introduction to the public markets, NetScout unveiled its nGenius Performance Management System, which featured full integration of the company’s key technologies and functionality along with real-time displays and customized reports for managing network performance. The nGenius platform remains a staple in the company’s service assurance solutions today. To accelerate the reporting and service level management capabilities within the new platform, NetScout acquired NextPoint Networks in July 2000 for $53.4 million in cash and stock. A year later, the company announced a significant change in its strategic relationship with Cisco Systems (CSCO), discontinuing Cisco’s private labelling and reselling of NetScout’s probes and shifting to a referral relationship in lieu of joint sales efforts. The change was notable given that half of NetScout’s revenues arose from direct royalties and licenses received from Cisco and sales to Cisco’s customers. Not surprisingly, revenues declined in each of the next two years before stabilizing during NetScout’s fiscal 2004. Revenues grew significantly the following fiscal year and shortly thereafter, the company announced the $9.3 million tuck-in acquisition of Quantiva, an application performance management vendor. NetScout planned to integrate Quantiva’s application performance anomaly detection and automated problem analytics into its nGenius solution.

After a couple of years of solid growth and the introduction of additional application performance management capabilities, NetScout completed its first transformational deal in November 2007, acquiring its primary competitor Network General for $212.0 million. Funding for the deal included 6.0 million shares of common stock, $100.0 million in debt and $53.0 million in cash. The acquisition brought NetScout the InfiniStream product line, which was soon integrated with its nGenius Performance Management System. InifiniStream remains the company’s high-end monitoring solution for the enterprise and service provider markets today. The addition of Network General’s revenues also enabled NetScout to exhibit growth even amidst challenging economic conditions in the ensuing years. While revenues finally dipped in the company’s fiscal 2010 due to the broader macro environment, the benefits of marrying NetScout’s nGenius platform with Network General’s high-end probes became more apparent as the company exited the year with service provider growth partially offsetting declines in enterprise sales.

NetScout was largely focused on organic growth in the years following the Network General acquisition, but beginning in 2011, the company completed several tuck-in acquisitions. Most notably, the November 2011 acquisition of Simena marked the company’s entrance into the market for packet flow switches, also referred to as network packet brokers or network visibility solutions. This was further solidified through the October 2012 acquisition of ONPATH Technologies, an established provider of scalable packet flow switching technology for high-performance networks. Other deals during this period included the acquisitions of Psytechnics for $17.0 million, Fox Replay for $20.2 million and Accanto Systems for $15.0 million, adding technology to address unified communications performance management, session reconstruction and voice service delivery, respectively. Of course, the acquisitions expanded the breadth of products and features the company was able to offer to customers, and NetScout posted strong double-digit growth in the following years driven by market share gains in the service provider vertical and rapid growth in sales of packet flow switches.

As NetScout was closing in on another year of mid-teens product and total revenue growth, the company announced plans to acquire Danaher’s Communications Business in October 2014. The deal closed in July 2015 with NetScout issuing 62.5 million shares valued at approximately $2.3 billion to Danaher, which later distributed the stock to its shareholders. The transformational acquisition brought the company a slew of assets that together generated over $700 million in revenues versus NetScout’s approximately $450 million. At the time, management highlighted the strategic benefits of adding Tektronix Communications, NetScout’s primary competitor in the service provider vertical; Arbor Networks, which expanded NetScout’s addressable market into cybersecurity; and Fluke Networks, which allowed the company to move down market in the enterprise. The transaction also solidified NetScout’s packet flow switch offering with the addition of VSS Monitoring and expanded its analytical and troubleshooting capabilities for the radio access network. From a financial standpoint, management put forth post-integration expectations for a $1.2 billion revenue company capable of sustaining double-digit growth and operating leverage in the low-30% range over the long-term. However, the deal was not well received from the outset as investors eyed the declining growth and lower margin profile of the acquired assets warily. While management managed to deliver upon its initial goals of achieving $1.2 billion in non-GAAP revenue and identifying cost synergies, the past two years have been marred by declining revenues as the company’s largest service provider customers have cut spending. More recently, management has revised its long-term goals to include mid-single digit increases in top line growth, while maintaining its prior operating leverage target.

Since closing the acquisition of Danaher’s Communications Business, NetScout’s M&A activity has been fairly limited. The company acquired Avvasi in August 2016 for $4.6 million to enhance its technology for monitoring video in service provider networks and purchased Efflux Systems in July 2017 for $8.6 million to integrate that company’s technology for detecting, analyzing and correlating threat activity within enterprise networks to Arbor’s advanced threat detection solution. In September 2018, NetScout divested its Handheld Network Test (HNT) tools business acquired as part of the Danaher Communications Business acquisition. While the jury is still out on the company’s ability to extract higher returns from its most recent transformational deal, looking back, it’s clear that NetScout has a long track record of successfully acquiring and integrating technologies into its core offerings, taking steps to remain atop the competitive landscape and weathering sales challenges arising from customer concentration and cyclical spending patterns.

A Single Pane of Glass

NetScout’s products work in concert to enable network operations, IT security and application development teams to monitor, secure and optimize the performance of mission-critical networks and applications via a single pane of glass. Typically, a customer instruments its network by deploying NetScout’s physical and virtual probes at various points throughout the network to collect, analyze and monitor traffic in real-time. End users of the company’s software and analytics modules are then alerted to any potential service degradation or security threats and can quickly drill down into the relevant data to identify and remediate the underlying issues. We estimate that approximately 80% of NetScout’s sales arise from its service assurance offerings and complementary products like packet flow switches with the remaining 20% from its cybersecurity solutions.

In the service assurance market, NetScout’s primary offerings include its nGeniusOne Management Software and its InfiniStreamNG (ISNG) platform. nGeniusOne leverages the network wire data collected and analyzed by the ISNG network probes, enabling end users to monitor and troubleshoot network performance. Virtualized form factors of the probes are also available and branded as vSTREAM and vSCOUT. More recently, NetScout introduced nGeniusPulse, which is used to actively test SaaS applications and other critical business services to identify performance issues. Another newer product, nGenius Business Analytics, enables the collected wire data to be analyzed by big data applications. While not specifically used for network monitoring, NetScout also offers packet flow switches (PFS) and test access points (TAPs) that provide access to network traffic and allow the traffic to be filtered and delivered to specific systems. These offerings are highly complementary to both the company’s solutions as they allow for specific classes of traffic to be collected and analyzed by the appropriate monitoring and security appliances.

Sold under the Arbor brand, NetScout’s cybersecurity products are primarily used by enterprises, government agencies and service providers to combat Distributed Denial of Service (DDoS) attacks. These attacks attempt to consume all resources available to a network, application or other service to prevent actual uses from gaining access. Arbor Availability Protection System (APS) has been broadly deployed by customers to automate the detection and mitigation of DDoS attacks and also underpins Arbor Cloud, which features cloud-based traffic scrubbing services that work together with on-premise deployments to combat modern, high-volume DDoS attacks. Newer offerings include Arbor Sightline, which is used to analyze data across the network to identify potential threats and improve traffic engineering, and Arbor Edge Defense, which sits outside of the firewall and provides a first line of defense against inbound DDoS attacks and also serves as a last line of defense by detecting and blocking outbound communications to known bad IP addresses, domains, URLs and geographies.

Pricing for the company’s solutions runs the gamut from tens of thousands of dollars to hundreds of thousands depending upon the storage and throughput capabilities required. Given the high price points, NetScout has historically focused its efforts on enterprises in the Global 5000, large government agencies, and Tier 1 and Tier 2 service providers. Average deal sizes tend to range from $250-$500 thousand with seven-figure and eight-figure transactions not unusual for larger enterprise and service provider deals. Of note, software-only deployments tend to throw a wrinkle into the traditional thinking around average selling prices and deal sizes as virtual probes may be deployed more pervasively given the lack of hardware. In these opportunities, the company’s pricing aims to capture the value delivered as opposed to determining a deal size on a per unit basis. In other words, NetScout allows for broader deployment of its solutions in exchange for a recurring annual fee commensurate with the customer’s budgeted amounts for specific projects.

Convergence Creates an Expanding Total Addressable Market

With the introduction of new monitoring and security capabilities into a single unified platform, NetScout aims to expand its addressable market opportunity with an eye towards capturing a larger share of its customers’ IT budgets. According to Gartner, the market for network performance monitoring and diagnostic tools was an estimated $2.2 billion in 2017, growing at a modest rate of 1.8%. IDC’s estimate of the worldwide cloud systems management software market, which encompasses solutions for application performance management, infrastructure performance monitoring, IT operations analytics, capacity analytics and cost optimization was $3.5 billion in 2016. With the addition of Arbor’s DDoS solutions and recently introduced advanced threat intelligence capabilities, along with the launch of business intelligence offerings, management believes the company’s total addressable market is now in excess of $8.0 billion. Of course, these newer categories are also growing at a faster clip than service assurance, typically in the double-digits, providing a path towards accelerating growth as NetScout gains traction with its cybersecurity and business analytics products.

As previously described, visibility into the performance and security posture of a company’s infrastructure and applications usually requires the deployment of probes at various critical points where traffic can be collected and analyzed. With enterprises increasingly adopting hybrid and cloud-based platforms and applications, end-to-end visibility is increasingly difficult to attain and requires numerous tools from disparate vendors. We believe NetScout’s integration of functionality spanning network and application performance management with advanced threat detection creates a compelling value proposition for customers given the potential to consolidate the number of tools in use and the ability for cross-functional teams in areas like network operations, IT security and application development to rely on a single source of truth to efficiently determine and remediate the root cause of any issues.

Not surprisingly, the company’s expansion into new markets also means competition on multiple fronts. Competitors in the enterprise service assurance market include Avaya (AVYA), CA (acquired by Broadcom), Cisco (CSCO), Dynatrace, ExtraHop, Keysight Technologies (KEYS), VIAVI Solutions (VIAV), Gigamon, New Relic (NEWR), Riverbed and Solar Winds (SWI) among others. In the service provider market, competitors for the company’s service assurance offerings include Anritsu, Empirix, Ericsson, EXFO (EXFO), Guavus, Huawei, Niksun, Nokia, Radcom (RDCM), Splunk (SPLK) and others. Competitors in the DDoS market include A10 Networks (ATEN), Akamai (AKAM), F5 Networks (FFIV) and Radware (RDWR).

From Peak to Trough

NetScout generates revenue primarily through the licensing and maintenance of its products to enterprises, government agencies and service providers. The company’s products have historically been sold under traditional licensing models in which customers pay an up-front fee for integrated appliances bundling proprietary hardware and software and also purchase support services for a recurring annual fee. Over the past two years, NetScout has virtualized its products so that customers may now opt to deploy its products in commercial-off-the-shelf hardware or in bare metal servers, which in effect provides the company with higher margin subscription software revenues. These deployment models move the company away from unit-based pricing to a pricing model based more on the value delivered. Whereas customers were previously limited in the areas of the network that could be instrumented due to the cost of each appliance, the software-only model enables customers to deploy virtual probes pervasively, providing far better insight into potential performance issues. On the one hand, this suggests unit pricing is far less than the company has historically realized. However, initial wins highlighted by management point to annual spending from customers on par with or greater than prior levels. In essence, customer budgets were already constrained by cost considerations under the old model, so NetScout is still capturing all of the available wallet share but providing a greater return to customers by ensuring better visibility.

While early, management has previously noted that software-only deals now comprise roughly one-third of product sales in the service provider vertical with gross margin in excess of 90%. Software-only sales in the enterprise vertical remain nominal at present. Over the next several years, management anticipates that software-only deals could comprise over half of product revenues. Thus, even if product sales were to remain flat, the higher mix of software revenues suggests that product gross margin could expand from the mid-70% range today on a pro forma basis to the mid-80% range. Moreover, the company would have much improved visibility into revenues and a relatively easier pathway to growth given the lower level of non-recurring revenues requiring replacement each year.

Following the acquisition of Danaher’s Communications Business in FY ‘16, management contemplated combined company revenues of $1.2 billion with potential growth of 10% annually and a long-term non-GAAP operating margin aspiration in the low-30% range. While results were generally consistent with management’s expectations during the initial integration period post-acquisition, revenues were flat at $1.2 billion on a pro forma basis (assuming the Communications Business had been owned throughout the prior year) in FY ’17, which was the first full year as a combined company. The primary cause was a significant reduction in spending from Tier 1 carriers, primarily AT&T and Verizon, which NetScout was able to offset in part through robust growth in its Arbor business. This in turn enabled NetScout to hold the line on non-GAAP EPS at $1.91. As carriers continued to pare back capital expenditures in FY ’18, however, and NetScout’s security customers absorbed the capacity investments made in the prior year, both revenues and earnings took a step back in FY ’18, declining to $1.0 billion and $1.41, respectively. These trends persisted throughout 1H ’19 although management began to see signs of stabilization. Additionally, the company also divested its HNT tools business in Q2 ‘19, which contibuted approximately $40 million in annual revenues and had accounted for ~$18 million in revenue to that point.

NetScout recently announced preliminary Q4 and FY ’19 results, indicating non-GAAP revenues for the quarter and year reached $235 million and $910 million, respectively. The results fell short of management’s guidance, principally due to a large international service provider deal for which revenue recognition was delayed. Even so, higher than anticipated gross margin arising from a favorable mix of security and software-only wins as well as ongoing cost controls enabled NetScout to deliver non-GAAP EPS consistent with the midpoint of management’s original guidance. Commentary in the pre-announcement also reaffirmed management’s prior statements that service provider spending has troughed.

Looking ahead to FY ’20, we believe the company’s stronger growth trajectory (excluding the impact of the HNT tools divestiture) bodes well for renewed revenue growth. That said, growth is likely to be heavily weighted towards 2H ’20 due to a difficult comparison in the first half as approximately $18 million in divested HNT tools revenues need to be replaced. Thus, our FY ’20 revenue estimate of $917.4 million represents largely flattish growth Y/Y. As NetScout stands to benefit from a full year of its recent cost reduction initiatives, however, and should see a boost to gross margin from the divestiture of a lower margin business and an increasingly favorable mix of software-only deals, we expect non-GAAP EPS to grow at a higher 8.1% clip to $1.43. Beyond FY ’20, we see a path towards mid-single digit growth as service providers invest in 5G and NetScout gains traction with security in the enterprise. Resumed organic growth coupled with further margin expansion and modest increases in expenses should enable the company to return to a non-GAAP operating margin of 20% in short order with longer-term potential to reach the low-30% range as originally contemplated.

Valuation

NTCT shares currently trade at 11.6x and 20.5x our FY ’20 adjusted EBITDA and non-GAAP EPS estimates, respectively. On a historical basis, shares of NTCT have traded at median forward EV/EBITDA and P/E multiples of approximately 9x and 17x over the past five years. During that time frame, the stock has traded as low as 4x projected EBITDA and as high as 13x. On a forward P/E basis, shares have been valued at a low of 10x to a high of 25x. Of note, NTCT traded at the lower end of these ranges when the company initially announced plans to acquire Danaher’s Communications Business and also during the integration phase when substantial reductions in spending by its largest carrier customers created significant uncertainty in NetScout’s ability to meet both internal and Street expectations. As the business has exhibited signs of stabilization over the past year, NTCT’s trading range has reflected the higher end of these valuation multiples. Given our view that the company is approaching an inflection point for renewed growth, we argue that shares should continue to garner forward EV/EBITDA and forward P/E multiples at recent highs.

Looking at the company’s peer group, which we believe encompasses small and mid-cap companies with solutions for application and network performance management, DDoS attack mitigation or other analytics-based service assurance offerings, we note that the median EV/Sales, EV/EBITDA and P/E multiples for the group currently sit at 3.6x, 16.8x and 22.9x, respectively. Of course, a significant disparity exists in the valuations afforded to the fastest growing companies, which tend to also generate revenues predominantly from software subscriptions as opposed to the appliance sales more typical of the lower growth peers. Regardless, the table below suggests that NTCT should at least sustain a forward EV/EBITDA multiple of approximately 10x. As confidence increases in NetScout’s ability to reaccelerate growth, we believe shares could fetch a valuation closer to the group median, perhaps more akin to competitor VIAVI Solutions (VIAV), which possesses similar growth and margin characteristics. Our $33.00 price target represents a FY ’20 EV/EBITDA multiple of approximately 13x.

Prior M&A activity in the service assurance space also suggests NTCT shares could garner a higher multiple. In November 2018, Broadcom (AVGO) completed its previously announced acquisition of CA Technologies for $18.9 billion in cash, equating to TTM EV/Sales and EV/EBITDA multiples of 4.4x and 12.6x, respectively. Nearly one year earlier, Elliott Management completed its take-private of Gigamon for approximately $1.6 billion, representing forward EV/Sales and EV/EBITDA multiples of 3.2x and 14.3x, respectively. Finally, we note that our price target is also supported by a DCF analysis with the following assumptions: a 5% CAGR over the next five years, adjusted EBITDA margin reaching 30% by FY ‘24, a terminal growth rate of 2.5% and a WACC of 8.8%. These assumptions correspond to an intrinsic value calculation of $32.71 per share.

Our published model is available here.

Disclosure(s):

The analyst, a member of the analyst’s household, and/or an account in which the analyst exercises discretion hold(s) a long position in the common stock of NetScout Systems (NTCT).