Thales S.A. (HO) Earnings Call Transcript & Summary

July 25, 2023

Euronext Paris FR Industrials Aerospace and Defense m_and_a 87 min

Earnings Call Speaker Segments

Operator

operator
#1

Good day, and thank you for standing by. Welcome to the proposed acquisition of Imperva conference call. [Operator Instructions] Please be advised that today's conference is being recorded. I would now like to hand the conference over to your speaker today, Bertrand Delcaire. Please go ahead.

Bertrand Delcaire

executive
#2

Yes. Hello. Good morning. Welcome, and thank you for joining us on such short notice. At this moment, we will discuss our announcement regarding the acquisition of Imperva. I'm Bertrand Delcaire, the Head of Investor Relations at Thales. With me today are Patrice Caine, Chairman and CEO; Philippe Vallee, Executive Vice President, Digital Identity and Security; and Pascal Bouchiat, CFO of Thales. As usual, this presentation will be in English and followed by a Q&A session. It is webcast live on our website at thalesgroup.com, where the slides and the press release are also available for download. A replay of the call will be available in a few hours. With that, I will now hand over to Patrice Caine.

Patrice Caine

executive
#3

Thank you, Bertrand, and good morning, everyone. And again, thank you for joining us on such short notice. So let's start with Slide #2. As you have seen, we have announced this morning the acquisition of Imperva. This acquisition represents a rare opportunity for us to create a world-class leader in premium cybersecurity products. As Philippe will show in a minute, Imperva is a market leader in the data and application security markets, which are among the fastest-growing cybersecurity product market segments. Its business model is robust. And on a standalone basis, we expect it to sustainably follow the so-called rule of 30 with double-digit growth and an EBIT margin around 20%. From a strategic point of view, its offering is very complementary to ours, massively increasing our total addressable market in these very attractive areas. More broadly, it allows us to TAM scale in the overall cybersecurity market. And of course, it creates a lot of shareholder value with $110 million in run rate pretax synergies and the significant enhancements of the financial profile of DIS, which is why we are comfortable deploying a significant amount of capital in this acquisition. So what are the key financial parameters of this transaction? And I'm now on Slide #3. So we intend to acquire 100% of Imperva's share capital. The closing shall be pretty rapid by the beginning of 2024 and is, of course, subject to regulatory approvals. The transaction price is based on a $3.6 billion enterprise value. I won't comment on all the valuation multiples here. Obviously multiples are much higher in the cybersecurity software market than in aerospace and defense. But let me point out that including run rate synergies, the ratio EV on EBIT for next year amounts to 17x, which is a lower multiple than what analysts use today when they value the digital solution part of DIS, which is above 20x. The transaction is significantly EPS accretive in the medium term, and Pascal, of course, will come back on this point on this topic later. Turning to Slide 4. So let me stress why we are so interested in cybersecurity assets. There are 3 main reasons. #1, this is indeed a very attractive market. Cybersecurity is a core challenge for societies as they digitalize, driving decade of fast-growing, fast growth for this market. No need for me to come back on the exponential growth in the volumes of digital transactions, the numbers of connected devices, and how this trend is further accelerating with the generalization of AI. Like in all of our other markets, advanced technology is essential to deliver it. And it is very much aligned with our proposed building a future we can all trust. And by doing so, building a sustainable digital future. #2, it is a market in which we already have a critical mass. We have disclosed the number back in March. And last year, we generated EUR 1.5 billion in sales in this market. Our portfolio includes world-class positions in a few niche product categories and more local positions in sovereign protection products and in products and services. And #3, cybersecurity is an essential enabler across all our businesses. Digital connected cockpits, collaborative combat platforms, new-generation telecommunication satellites; each of these products absolutely need state-of-the-art cybersecurity to function. And as we explained in the past, for us, introducing digital innovations opens up opportunities to expand our addressable market. [indiscernible] mention the adoption of cloud technology by our customers on both civil and military markets or all the opportunities around secured connectivity. Moving now to Slide #5. Here, you see visually how material this transaction will be on the profile of DIS. With this acquisition, DIS will become the undisputed second pillar of the group. Combined with the acquisitions we announced last year, it will drive a 60% increase in our total addressable market in civil cybersecurity to EUR 36 billion, giving us plenty of room for long-term growth. In addition, within civil cybersecurity, it positions us on faster growing markets. You see the external market growth forecast moving up from plus 10% to plus 13%. Turning to sales. Once the acquisition is completed, i.e., early in 2024, we expect the full DIS portfolio to sustain a solid organic growth pace, 6% to 7%. And finally, it will materially increase its EBIT margin potential. We now target a 16.5% EBIT margin for DIS in 2027. In absolute terms, this represents almost EUR 400 million of additional EBIT by then, EUR 350 million if we put aside the internal transfer of the defense and security, civil cybersecurity business to DIS on which Philippe will elaborate later. So all in all, this really transforms DIS into a world-class cybersecurity leader and materially enhances its financial profile. So after this quick introduction, let me now give the floor to Philippe, who will explain why he and his team are so positive about this asset and how we expect to generate a lot of value with it.

Philippe Vallée

executive
#4

Thank you, Patrice. I'm now on Slide 7, starting with Imperva's identity card. Imperva is a leading global enterprise cybersecurity software company, uniquely positioned on the data security and application security market. Imperva was founded in 2002 in San Mateo, California, and has brought to market along these 20 years, proven and leading-edge innovative solutions for the cloud and in the cloud. Leading by its market presence, at scale, we have around $500 million of revenues, $300 million generated by application security and $200 million generated by its data security value proposition. We have a strong presence in all geographies. Over half of its revenues come from North America, which is the lead cybersecurity market in terms of size and innovation, but also in Europe and in Asia Pacific. Imperva has more than 6,000 loyal customers among which 35% belong to the Fortune 100 list, 7 of the top 10 banks and 6 of the top 10 telecom operators, together with [indiscernible] demanding customers, which have the same profile as Thales DIS customers. Turning to Slide #8, looking at the market's Imperva sales. Data security and application security are 2 of the 5 fastest-growing market segments, fueled by the combination of the increase in the number of and the impacts of cyberattacks targeting enterprise and government data like ransomware. And by the growing number of regulation, mandating data protection like privacy rated laws enacted in the European GDPR, and this is growing nearly by the day. Imperva's Data Security Solution address 3 key dimensions of data security solution. One, knowing where an enterprise sensitive data is stored or used, being able to classify data in specific categories like personal data, payment data, et cetera. 2, implementing governance rules defining who or what group of people and which applications are allowed to access data. And 3, monitoring data access to make sure that the governance rules are actually enforced and nobody is trying to get access. Imperva uses advanced AI to learn what is normal data access patterns and detect abnormal behaviors from users or applications. The data security market is a fairly large market of about $9 billion in 2022, growing at the pace of plus 13% to an even more significant $15 billion total addressable market in 2026. On application security solutions, Imperva protects applications, keeping them running and running only the way they were meant to run after they are deployed, and they protect the data those applications use. Imperva was created around its flagship product called Web Application Firewall and extended its capabilities to DDoS, which is distributed denial of access, advanced bot protection and more recently, what we call the API, application protocol interface, security as more and more applications rely on APIs today. The application security market is also a sizable market, the size of $3 billion in 2022, doubling in 4 years to reach $6 billion by 2026. Moving now to Slide #9. Imperva has been recognized as a leader in both data security and application security by the top market research companies. As you can see on the upper left on the slide, KuppingerCole position Imperva as an overall application security leader and ranked Imperva third in its leadership compass. Gartner, another very influential market analyst, positioned Imperva as a leader for web application and API protection. In the last 2 years, only Imperva gathered many awards in both categories for its technologies, innovation, and customer ratings. Turning now to Slide #10. Let me discuss the business and financial profile of Imperva. First, we are talking about an established player with 20 years of accumulated R&D and expertise. I just showed you how technology analysts recognize its products as clear leaders. Second, its revenue base is, by nature, very recurring with typically 90% of sales coming from existing customers. Third, as mentioned by Patrice, it has a very robust cybersecurity software business model. On a standalone basis, we expect it to deliver a sustained double-digit growth over the coming years as it did in the past. Its profitability is similar to other mature software players. It delivers around 80% gross margin with a cost base of 20% for R&D and 40% for SG&A, for targeted EBIT margin of around 20%, which we expect to achieve by 2027. In addition, these business models are very cash generative. Excluding interest cash out, we expect to generate around 20% of free cash flow margin by 2027, i.e., a similar level to the EBIT margin. This business is operating at scale in the U.S. and is now accelerating its global expansion. As part of our due diligence, we analyzed in detail the financial performance over the past 3 years and its slightly lower growth and EBIT margin is explained by the important growth investments it conducted over the recent period. First, Imperva decided to migrate its data security customers from a license model to a subscription model. This type of migration is very attractive in the long run, enhancing the recurring nature of revenues. But in the short term, it significantly dilutes growth as you recognize less revenue in the year that you sign or renew customer contracts, hence the lower growth profile over the past 2 years. We expect a rapid return to double-digit growth going forward. Imperva started to see this, by the way, in H1 of 2023, where it recorded an 11% sales growth. Second, it scaled up its IT infrastructure. In particular, it materially increased the number of points of presence it operates, point of presence, which are really needed to deliver application security on a worldwide basis. And finally, it steps up both R&D and sales and marketing to ensure a successful migration to this subscription model. In short, as you understood, this is a very attractive company on the standalone basis. So let's turn to Slide #11 to tell you how complementary is this combination. So now on Slide #12. Data is the most critical assets of company today and will remain in the future. The more digital, the more AI, the higher is the value of data. At the same time, the volume of data is growing exponentially and the places where enterprise data is used or installed or is computed are also more and more diverse. It can be in the public cloud. It can be in private cloud. It can be in the form of hybrid setup. The combination of Thales Identity and Access Management Solution, of Thales Data Security Solution, of Imperva Data Security Solution, and Imperva Application Security Solution is fully complementary. At the same time, there is no overlap at all between the 2 companies, which makes this combination even more appealing to our customers. Thales was not present in application security and Imperva, for example, was not present in identity and access management. In data security, each company comes from a different starting point, encryption and key management for Thales, data access monitoring and data governance for Imperva. In short, Imperva understands what data is where and monitors who is accessing data. And Thales make sure the data is encrypted and that is accessible unencrypted only in a permitted use context. The depth and breadth of the combined solution will address 3 key field of modern software architecture; identity, data, application. Identity theft is one of the preferred, if not the preferred method for initiating a cyberattack. Holding your data secure in all circumstances, it is just not an option. Making sure your application, which creates process, store, transmit data, also secure is closing the loop. Identity access management, data security, and application security solution finally share the same functional technologies, namely strong authentication, encryption, access management, policy orchestration, and enforcement. These technologies are deployed in public cloud, in private cloud, and in every hybrid setups. Pulling together Thales' R&D teams and Imperva's R&D team will enable customers to benefit from even faster and more impacting innovation in all these 3 fields. The complexity of enterprise of having to use tens of different cybersecurity products is a key concern for their Chief Information Security Officers, we call them CISO in the industry, even more in a context where cybersecurity resources are scaled. Bringing under the same umbrella solutions that span identity and access management, data security and application security is a step change in reducing this complexity, implementing an end-to-end security policies and offering a kind of one-stop shop solutions to the Chief Information Security Officers of this world. Turning to Slide #13. The combination will be particularly attractive on the data security market. Thales CipherTrust data security platform and Imperva Data Security Fabric are both recognized leaders in their respective categories. By bringing both together, we are building a first-class global data security platform that follows the path of the successful integration of acquisitions that we have done in the past on both sides, namely SafeNet by Gemalto in 2014, Vormetric by Thales in 2016 and the 6 acquisitions that Imperva made over the past 10 years -- 9 years. On both sides, technology and innovation are recognized as top class. The most frequent use cases or key functional areas will be covered and the scale-up of R&D team of over 700 highly skilled engineers dedicated to better security, leverage the best and most efficient talent pools in the U.S., in the Silicon Valley, in Texas, in Florida, but also in Israel, Canada, and India. Turning to Slide 14. Looking at the synergies we expect from this combination. Let me first stress again that this is a private acquisition, meaning that we were able to conduct a detailed assessment of the synergy opportunities, together with the Imperva team. Starting first with the cost synergies. The biggest bucket there will be related to SG&A. These first categories represent around 40% of sales in both Imperva and our own cybersecurity product business. We are talking of a revenue scope of more than EUR 2 billion by 2027. So a pretty large cost base we can work on. In Asian, we expect to capture savings, traditional savings on procurement costs, for example, regarding cloud operations or the purchase of licenses as well as on real estate. In terms of ramp-up, more than 80% of these cost synergies should be captured by 2027, and we expect the full run rate level of $50 million by 2028. As usual, revenue synergies will take a bit longer to materialize. Of course, we intend to rapidly leverage the joint sales, customer success, and digital marketing team to upsell and cross-sell all the products that we will have in the portfolio. We see major demand from large customers who really want suppliers to manage this complexity for them. As I showed on the previous slide, we expect, in particular, a lot from our new data security platform, combining the best-in-class capabilities on both sides. And we also expect synergies with cyber consulting and managed security services provider, MSSP, but will come from other activities of Thales and join DIS in the near future. Altogether, on the revenue synergy side, we expect 5% incremental revenues for the combined entity by 2029, generating around $60 million of incremental EBIT. So combining costs and revenue synergies will amount for a total of $110 million by 2028. Let me finish by stressing that there are 2 key reasons why these synergies amounts are so high. First, the 2 businesses we are combining are growing fast, meaning that the cost base we are working with is not the $400 million we are accruing now, but much larger going forward. Second, we are putting together 2 very similar businesses, sharing similar corporate culture. And we have a track record of combining cybersecurity businesses. This is what we did back successfully in 2019-2020, when we merge SafeNet and Thales eSecurity. So we are very confident regarding the ability of the teams to capture these synergies. Moving now to Slide #15. It shows the shape of our global cybersecurity portfolio on a pro forma basis. Once the acquisition of Imperva is completed, it also includes the revenue of Tesserent, the ongoing acquisition in Australia on the service side. It should generate around EUR 2.4 billion in sales in 2024, so 70% more than what we delivered in 2022. So we are really here scaling up this business. The breadth and quality of this portfolio will be quite exceptional, driving significant synergies within the business itself and of course, supporting sales and differentiating across the entire Thales portfolio, like Patrice said a while ago -- a minute ago. To facilitate the capture of the synergies, Patrice has decided to regroup both the service business and the global products business under DIS to the global business unit, I'm today managing. As you see on the right, the overall financial profile of this business will be quite robust, bringing double-digit organic growth and sustaining EBIT margin above 15% building it on. So we will have a world-class portfolio protecting data and all path to it, trusted by the most demanding customers; banks, telco, health companies, a network of 11 security operations center scattered in 4 continents, ensuring global and permanent monitoring of cyber threats, and being the trusted partner for government and institution in Europe for major sovereign and defense projects. This represents a total of 8,000 employees, of which 5,800 are cybersecurity experts, one of the largest security expert team on this planet. So turning to Slide 16. Here, you see the impact of today's announcement on our total addressable market in civil or, let's say, commercial cybersecurity. Our current total addressable market is around $22 billion, $4 billion for data security, $9 billion in identity and access management, and around $9 billion in services. The already announced acquisition of OneWelcome, S21 Sec, Excellium and soon to be Tesserent, add approximately $5 billion in total addressable markets and Imperva $8 billion. So this is roughly 60% higher than our current scope markets we are addressing. In Asian, as you can see on the side of the chart, these moves allow us to address materially faster-growing markets. Market analysts estimate that our new addressable market grows on average at 13% CAGR, so 3 points faster than our previous scope. So let me wrap up with Slide #17, showing you the financial profile and the sales mix of DIS once this acquisition is completed and the targets we are setting today for the segment in consequence. Starting from the consensus sales for next year of circa EUR 3.6 billion. Imperva will add a bit more than EUR 500 million. And the transfer of the civil cybersecurity business from defense and security segment, roughly between EUR 350 million to EUR 400 million. So -- but the new scope on a pro forma basis, we generate around EUR 4.5 billion next year. At EUR 2 billion, cybersecurity will be by far our biggest business within DIS, representing 44% in sales. So you remember the growth target we fixed back the Capital Markets Day in 2019, namely that DIS will grow by 4% to 6% in the midterm. Considering the dynamics of the cybersecurity portfolio, we now expect the overall segment to grow organically by 6% to 7%, reaching between EUR 5.4 billion to EUR 5.5 billion in 2027. From a margin point of view, the improvement will be quite material as well compared to the current consensus of 14.4% for 2024, we are now targeting a 16.5% EBIT margin in 2027, a 200 basis point improvement. Patrice expressed it in absolute terms earlier, this corresponds to an EBIT of around EUR 900 million in 2027, so really a very material enhancement in our financial profile. Let me now hand over to Pascal, who will address the value creation aspect of this event.

Pascal Bouchiat

executive
#5

Thank you, Philippe. I'm now on Slide 19. So let me start here by addressing first valuation multiples. Continuing the growth and cash generation quality of cybersecurity software companies, the market often looks at EV over forward sales multiples. And the multiple for this acquisition is of 6.1x next year's expected sales, in line with trading comparables and below transactions comparables, which are typically 7x to 8x next 12 months sales. We believe this is a reasonable multiple for an asset of such high quality. Philippe has presented its financials and its robust standalone dynamics. This multiple is also only slightly above what Thoma Bravo paid when it acquired it at a time when it was much less profitable. Now of course, considering its very synergistic nature with our own operations, it's also pertinent to look at the multiples, including run rate synergies. On a 2024 basis and including them, the EV over EBIT multiple is around 17x. Not many analysts who follow us use some of the current elevations, but the ones we do and who actually assign an EV to EBIT multiple to our digital business within DIS actually use a higher multiple than that above 20x. It also compares favorably with trading multiples in this space, which are typically around 30x next 12 months EBIT. On the 2027 view, post synergies, the EV over EBIT comes down to 13x, i.e., lower than our group multiple today. So in short, attractive multiples for an asset of this quality. Turning to the value creation side. Our M&A policy has always been focused on improving the financial profile of our core businesses, accelerating growth, improving margin and [indiscernible] our technology portfolio. Obviously as Philippe demonstrated in details, from this point of view, the impact is really material. We now expect DIS to generate EUR 900 million of EBIT by 2027 compared to a little less than EUR 500 million last year, which was already a record year for the segment. Looking at adjusted EPS, the accretion is very significant once the majority of synergies have been captured. Of course, in the near term, considering the level where interest rates are today, the impact is very small in the first year following the acquisition. Finally, considering the strong cash generation profile of this acquisition, we felt more appropriate to look at the cash ROCE, i.e., comparing its unlevered free cash flow generation to the capital invested in the transaction. We expect this metric to be above WACC in the fourth or the fifth year post-closing. This is not surprising considering the long-term nature of synergy. Moving now to Slide 20, looking at balance sheet and capital allocation. On a pro forma basis, taking into account the various ongoing acquisitions and disposals and starting from a consensus net cash positions of EUR 2.2 billion at the end of 2024. The net debt over EBITDA leverage will be around 0.7x, implying that we'll keep our solid investment rate profile. This allows us to confirm our overall capital deployment framework in terms of both dividend payouts and the ongoing share buyback program. Finally, for the coming years, we plan to stick to a bolt-on M&A strategy with the same discipline as before. Let me now hand over to Patrice for a few words of conclusion.

Patrice Caine

executive
#6

Thank you very much, Pascal. So I'm now on Slide 21 for a short drop up. But I think you've understood that all the key messages about this transaction. So let me recap. #1, this represents a rare opportunity to be the global leader in one of the most attractive cybersecurity product segments, driving very significant synergies. #2, it really changes our scale in civil cybersecurity. #3, you saw how it is very accretive to DIS' financial profile and how it is now affecting our investment-grade profile. Not affecting, sorry, our investment-grade profile. #4, altogether, it fits perfectly with our long-term strategy, focused on improving the structural quality of the portfolio. And it is really in the same vein as the decision to dispose the transport business, to dispose the transport business of [indiscernible] or to acquire [indiscernible] premium businesses like Cobham Aerospace Communications, and what we are announcing today with Imperva. So combined with all the internal transformation initiatives, this is the best way to maximize shareholder value creation. So this concludes our presentation. Many thanks for your attention. And now together with Pascal and Philippe, we are now pleased to take your questions.

Operator

operator
#7

[Operator Instructions] We will now take the first question from the line of Aymeric Poulain from Kepler Cheuvreux.

Aymeric Poulain

analyst
#8

Congratulations on the deal. The pro forma figure you provide for DIS in 2024, implies that you're about to transfer the civil cybersecurity of defense into DIS. What are the margins and profit contribution of this business to defense today? That's the first question. And secondly, you mentioned the multiple -- the trading multiple that you compare this transaction with. But you obviously paid also onetime sales for Tesserent and clearly, defense assets have a lower multiple too. So what would be in your view the blended or the best guess for the blended multiple to apply to the new cybersecurity component of DIS?

Pascal Bouchiat

executive
#9

So I mean, starting with, I mean, the level of profitability percent of EBIT margin of this service business that we are moving from defense to DIS, which is very much about what we call MSSP, managed security service provider. So it's really a service-driven type of business, which also help us as a go-to-market to sell products. It's a business where today and the profitability is rather limited. Overall, out of this EUR 350 million that we mentioned, overall it's today a low single-digit EBIT margin. But it's true that, in particular, with the acquisition of Tesserent, it's a business that we believe in the next 4 years should be able to report the level of EBIT margin probably around 8%. And this based on, in particular, the overall leverage effect as we acquired both Tesserent and S21, Excellium last year. Your second question was the overall, I mean, blended multiple relating to our overall cybersecurity business. Was it your question?

Aymeric Poulain

analyst
#10

Yes. Obviously the multiple depends on the quality of each component. And of course, perhaps you can have in mind a peer, in listed peer in the market just to get a sense of what would be the right blended multiple for the new cybersecurity part of DIS?

Pascal Bouchiat

executive
#11

No, I mean when overall, looking at this global cybersecurity business within DIS taking I mean, the 2024 level of revenue around EUR 2 billion. I mean, the vast majority is really, I mean, a product type of business where, I mean, margin is rather strong. Typically, I mean, close to 20%. This is a typical level of margins that we expect in this product component of this overall global cybersecurity business. Well, that's relating to your first question. The service components represent today 15% of the overall EUR 2 billion. And this is where, I mean, profitability is, at this point, quite smaller, as I mentioned, low single digits, but probably moving up to, as I mentioned, 7%, 8% in the next 4 years. But you see on one side, you compare our business with overall EBIT margin 20%, 20% plus and which, of course, I mean, is in line with quite high level of multiple. And this is really the bulk of our cybersecurity solutions business and the service front where our profitability is lower and which, of course, is in line with lower multiples.

Operator

operator
#12

We will now take the next question from the line of Olivier Brochet from Redburn.

Olivier Brochet

analyst
#13

Yes. I will have 2, please. The first one is regulatory approvals. Do you have any antitrust matters to deal with and CFIUS questions to take care of? And the second question, have you identified the key employees that you need to retain? And have you done what is needed to make sure that they stay with the company, please?

Patrice Caine

executive
#14

Let me take the first one, and I will leave Philippe to answer the second one on key eyes and key employees. So yes, on the regulatory approvals, no, we do not expect, I would say, any difficulties. As explained by Philippe, our business is fully complementary. There is no overlap with Imperva business. So it should be no brainer, honestly, it should be no brainer. And on the CFIUS standpoint, we have, I would say, a long-lasting track record in the U.S. So here as well, we do not anticipate any difficulty. We just have to follow the process and to send all the documents to get the different approval. That's why we foresee a closing beginning of next year. Philippe, on the second one?

Philippe Vallée

executive
#15

Yes. As far as the key management, the key management team currently running Imperva, we have secured deal with each and every individual, very sensitive. And the rest, we have a sort of extended vesting of our stock together with a sort of bonus plan, which is, let's say, aligned with the business plan. And we intend also to work with Imperva management on a specific retention plan for our key technical member or key members of the community. And this retention plan has been fully factored in the business plan we are proposing today.

Patrice Caine

executive
#16

Shall I? That's is what I mean, Olivier. This acquisition has been co-built between the 2 teams. It's really a co-construction which secure, I would say, the -- all the figures and numbers that we have forecasted for 2027-2028 and so on and so forth. So this is very important. It's not, I would say, an open tender where you buy a company without any due diligence, we've had extensive due diligence. The team has been very professional on the other side, no surprise, but they have been very professional. So this is, for me, a very secure transaction. Thanks to this, I would say, profile process and what I call the unconstructed business case. And lastly, the 2 teams and the one which is under the leadership currently of Philippe and the one of Imperva as really the same DNA, the same corporate culture. They are very close to each other. By the way, they knew each other before the deal. In fact, they were in discussion to have some kind of commercial arrangement because the offerings were complementary. So it's another, I would say, element that for us, they risk significantly this kind of competition.

Olivier Brochet

analyst
#17

When did you start the negotiations?

Patrice Caine

executive
#18

A while ago. You are very curious.

Olivier Brochet

analyst
#19

I am very, very curious.

Operator

operator
#20

We will now take the next question from the line of Ben Heelan from Bank of America.

Benjamin Heelan

analyst
#21

I had one first on pro forma leverage, I guess, for Pascal. So you say pro forma leverage in 2024 is going to be 0.7x. I'm assuming that, that is pre the Cobham deal that you announced a couple of weeks ago. So when we think about deals and appetite tiles going forward, should we assume that this is going to be the last large deal for the next couple of years while you digest these 2 existing deals? And then a second one, I guess, maybe for Patrice. If I look at Slide 17, and look at the portfolio of the DIS business today, you're clearly growing a lot in cyber. But how are you thinking about the other verticals of DIS when you look at mobile and biometrics. Is there anything else in that portfolio that you think doesn't make sense and you're considering divesting? So how do you think about the rest of the DIS portfolio there? And then a final one on the Cobham deal, you said that you were going to do that deal from available cash. I'm assuming you're going to have to raise some debt to complete this deal. How are you thinking about the debt that needs to be raised and how we should think about financing rates for that?

Pascal Bouchiat

executive
#22

So on the first one, the 0.7% is a pro forma end of 2024 net debt to EBITDA assuming both, I mean the Imperva transaction, but also taking into account the Cobham transactions. So it takes -- I mean, both -- I mean, the acquisitions that you have just announced, the 2 -- those 2 acquisitions that we have announced, but also it's also taking into account the disposal of our transport business. And of course, I mean, this level of leverage, 0.7 is consistent in my view, are very much consistent with the current level of rating of states and allowing us to preserve the strong investment investment-grade rating from rating agency, which, as you know, is very important for us for the long term. Now I mean, going forward, it's quite obvious that we have announced 2 large acquisitions. And I mean, first, I mean, those 2 acquisitions will be integrated into different global business units. As we mentioned, Cobham will be integrated in our avionics business and Imperva in the DIS business. As we kept saying that we are looking to quite easy to integrate acquisitions, and it's going to be the case for those 2 transactions. However, it's quite important to say that we need, of course, I need to digest those 2 large acquisitions and of course, to deliver on our commitments on those 2 acquisitions. So this is what I can share with you adding in mind that I may be clear that what we are looking -- what we are looking for. Potentially for the [indiscernible] is bolt-on and pure bolt-on M&A, I mean, potential transactions. But once again, very much focused on core business and of course accretive to our financial profile. Now at this point, it's really about us to integrate and to deliver on those 2 significant acquisitions that we have announced. This is really the top priority for Thales.

Patrice Caine

executive
#23

If I can take the second one, Pascal?

Pascal Bouchiat

executive
#24

Yes.

Patrice Caine

executive
#25

So the second one is related to DIS profile. So in this DIS is, I would say, is interesting, I would say, a balance of activities. On one hand, as you have mentioned, I would say, fast-growing activities, free digital growing from, let's say, 10% up to 20% in the product cybersecurity solutions, highly profitable, very profitable. So clearly, a very -- I would say, very promising for the future. On the other hand, we have, I would say, more mature activities indeed, the so-called banking and payment and mobile connectivity. So these 2 activities clearly are not, I would say, growing at a fast pace. It's really flattish, 1%, 2%, but very cash generative. So it's a good mix between, I would say, activities generating, I would say, a lot of cash and activities that are fast boring and profitable. Last perhaps, element, just to say that for the moment, I do not anticipate, I would say, any change in the mix of DIS, I would say, business is the fact that on the 2, I would say, mature activities, banking on one hand and mobile, on the other hand. We are willing to harvest 2, I would say, important technical transitions that will still create value for all of us. Clearly, on the mobile connectivity -- mobile and connectivity side, there is this transition to 5G and the transition from rSIM to eSim and iSim. And again, this business is going to move from a purely or largely hardware business type of model to a software business model. And this is very interesting because it could be highly relative. And on the other hand, for the banking and payment side for activity, again, there is this very increasing transition to a digital payment. Again, the credit card and all that was go which is full of innovation, by the way, still is a nice business because profitable and cash generative. And there is this, I would say, a transformation from we say, hardware to digital banking and digital payment, which is, again, very promising. So if this is endorsed by everybody, these 2, I'd say, so-called mature activities have still a lot of content in terms of value creation for the future. Pascal?

Pascal Bouchiat

executive
#26

Last point Ben, was about, I mean, the way we will fund these acquisitions. So what we have in mind is to fund half of these transactions through available cash on the balance sheet and half through new debt. Now in terms of overall, what does this mean in terms of our interest rate and interest expenses. I mean, considering the return on available cash on our balance sheet and what we see today in terms of, I mean, interest on new debt, a blended interest rate for you to model, I mean, the impact of the transactions is between 3.2% and 3.3% in terms of overall blended interest rate.

Operator

operator
#27

We will now take the next question from the line of Charles Armitage from Citi.

Charles Armitage

analyst
#28

A couple of questions. First of all, what are you using? And then the second one is I'm kind of interested by the employed growth rates versus the market growth rate. So, application security market growing at 18%, data security growing at 13%, so that's probably about 16% market growth. But if you say 6.1x 2024 sales versus just under EUR 500 million in '22, that's 9% CAGR. And then if you take 13x 2027, knock off the synergies and 20% EBIT, that's about 11% CAGR. So it seems why are you undergoing the market?

Pascal Bouchiat

executive
#29

Charles, I mean your second question was quite clear about WACC. So I mean, today, I mean, assessments of WACC roll for Thales is between 8% and 8.5%. That's really the average, which, by the way, is what we see on many analysts paper. So this is what I have in mind. And -- yes, please. Okay. I mean certain things that I will let, of course, I mean, Philippe to discuss about that. Now I mean, your math absolutely correct. So '23-'24 overall, we see a blended organic growth slightly above 9% and from '23 to '27 11%. Now we expect, I mean, overall, the organic growth of Imperva, I mean, to move up gradually year after year. And Philippe will explain why. I mean, we are quite positive on the overall midterm trajectory in terms of top line growth.

Philippe Vallée

executive
#30

Yes. Thank you, Pascal. So the point I covered a little bit quite quickly during my presentation, in my remarks was the fact that at Imperva over the past 2 years, they have conducted a very significant business model evolution from a starting point where they were almost selling everything under the perpetual license model. So you sell everything at once and then you wait for the next renewal to something which is based on the sort of subscription model. And in this tradition pattern, and they have started that move at evolution in the -- in both of the segments. So in application security and in data security, and by the way they are not exactly at the same stage, one is more than 90%, the other is more like 60% of customers converted to [indiscernible]. And bring the sort of U curve, so to speak, which is at -- in this process, you are growing less than the market, but we expect the sort of mechanical rebound once we have all our customers, all Imperva customers on the supplement model. The maximum, the selling being 90% because you still have some integration services, which are one-off at the beginning or at some point. So this is the reason why we expect the market -- we expect the company after that mechanical remount to grow as fast, if not better than the market. So this is really the position sales, which is explaining this so-called performance during that transition phase. And a transition like that, when you have a customer base of several thousand customers, I mean, 4,000 customers, it's not something easy to do because you need to train your sales people, you need to measure your retention rate. You may need to measure the customer success of your existing product to make sure you can upsell. So it's not an easy transition that you do in a quarter. It takes usually between 2 to 3 years.

Charles Armitage

analyst
#31

So it should be done by end of '24? Is that a reasonable assumption?

Philippe Vallée

executive
#32

'24, '25, yes.

Pascal Bouchiat

executive
#33

Charles, my view is also, I mean, to consider that, in particular, on the Application Security segment, I mean we are today probably a bit cautious in terms of expected organic growth. And it's really, I mean, what Philippe mentioned in overall, I mean, the expected growth of Imperva in the next years is really, I mean, the commitment from the team. And I mean, I think that, in particular, the uptake security, that is a bit of a more new market for us, new segment for us. We might have been probably a bit overall cautious in terms of forecasting the next few years of the top line growth. So my view is that, hopefully, we will be able to do maybe slightly better than the figures that we present to you today.

Operator

operator
#34

We will now take the next question from the line of Christophe Menard from Deutsche Bank.

Christophe Menard

analyst
#35

I had 2. The first one is you're moving the CVO defense and security activity into DIS. So that's clear. Are there any synergies? I mean, now you have a much bigger cyber business in civil with this acquisition. What about the defense activity in cyber? Will there be any synergies with that? Or is it, I would say, an isolated activity now compared to what you're going to have in DIS? And the second question is synergies. I mean, quite obviously, there are -- I mean these are, I mean, high synergies. The question is, from your point of view, are they conservative? Or are they ambitious? And is it all -- I mean, you provided some details on -- I mean, I understand it's SG&A essentially a little bit of real estate licenses, but it's really SG&A. Is it all about cross-selling? Just trying to better understand whether this is really within reach or whether it's quite ambitious.

Philippe Vallée

executive
#36

So starting by the synergies between what we call the MSSP or the SOC security operations center. What you have to understand is that Imperva by design is monitoring, for example, the application when they offer application security value proposition, they understand what's happening in the application by being connected through a network and different point of presence, and they have a sort of a fresh analysis team, which is, let's say, fuel or let's say, by this capacity to understand what's happening when they detect abnormal behavior within the application. And by having this kind of threat analysis in advance of time, so to speak, this is a very important feed for the stock for the MSSP because they can, let's say, receive those information events and somewhat anticipated a little bit what could happen on a more general basis with the customer base. So there is a sort of mutual benefit on both sides by having this kind of freight analysis in advance of time. In particular for what we call the 0-day attack. And on the other end, I think Pascal mentioned it, MSSP also is a service business, and they are advising our customers and they are reselling solution. And the idea is, obviously for MSSP business to become a channel of Imperva solution. So that's the EBIT synergy question.

Patrice Caine

executive
#37

And Christophe, if I just follow up on the, I would say, cyber defense activity. Well, the synergies here are with the civil cybersecurity are clearly more on a technological standpoint. Let me take just one example to illustrate that encryption, and you find encryptions, I would say, specialists in terms of encryption, both in the civil, I would say cybersecurity part and in the defense security part. So this is clearly, I would say, a nice and interesting technological synergies. Secondly, I would mention that cyber defense, you see the best of the worst, if I may say. It's a very, very demanding, I would say, environment. And by the way, as a consequence, it's so-called it elevates the playground, if I may say, of our experts. And these experts on the defense part, I would say, are able to [indiscernible] in return, the expert on the civil cybersecurity part. Now it's true that the go-to-market are different. That's why we consciously decided to leave this, I would say, cyber defense activity within the Defense and Security business segment because clearly, the go-to-market is governmental agencies, MODs all around the world, which is very synergistic with the whole Defense and Security business segment. And the last question is on synergy.

Pascal Bouchiat

executive
#38

It was about -- I mean synergies. So Christophe, maybe I will start giving you my point on the cost synergy. And then I will let Philippe discuss about revenue synergies. So overall, I mean, when we look at cost synergies, what we expect in terms of run rate cost is to be at EUR 55 million in 2028 with $40 million that will have generated by 2027. This is basically presented on Page 14. Now what is quite important to assess, I mean, the level of synergies is to consider the underlying cost basis. And overall, in 2027, the Imperva plus the existing data security business at Thales, those 2 businesses in 2027, overall, the level of revenue will be around EUR 2 billion, EUR 2 billion with overall, I would say, SG&A, R&D cost basis that will represent 60% of those EUR 2 billion. So overall, EUR 1.2 billion. And you see, I mean, $40 million out of EUR 1.2 billion. Overall, I mean, it represents something like around 3%. And I think that it's here again, my view is that you see again quite a cautious level of synergy. We should be able to do probably a bit more than that. So it's also probably true that when it comes to cost synergies, we work in 2 steps. The first step that we put in place quite quickly in -- I mean, as early as 2024, and that probably will be delivered in '24-'25. And then we will consider probably a second one of cost synergies once we have started to streamline the overall organizations. In particular, in terms of sales, marketing and SG&A to consider a second one of cost synergies that will probably material in '27, in 2028. So this is how I see the situation. So overall, my view is that our run rate, $50 million is in my view quite conservative, considering the earned underlying cost basis of the combined entity. Revenue synergies?

Philippe Vallée

executive
#39

Yes, Pascal. On the revenue synergies, like Patrice said, I mean, we have the opportunity to do a very thorough analysis. So in order to prevent any gun jumping as we've seen on [ iTrust ], we have supplied our key customer data to an external lawyer together within Imperva, we did the same. And the return, the feedback we got from the lawyers, in fact the 2 customer base are pretty distinct, which makes us think that we have a good opportunity when it comes to cross-sell, cross-selling. The second element of sales synergy is coming from the fact that there is today, not any single overlap between the 2 platforms in terms of data security, data security fabric on one hand from Imperva and CipherTrust platform from Thales. And by combining those 2 platforms, we think that we can have a very, very important, very nice value proposition combining the 2 platforms, the product solutions to offer upsell to our customers. So both upsell and cross-sell, we think that we have something which is a fair assessment of what we could generate in terms of sales synergies by 2027.

Operator

operator
#40

We will now take the next question from the line of David Perry from, JPMorgan.

David Perry

analyst
#41

I'm sorry if my question sounds a bit pedantic. I'm just trying to make the math work in terms of your takeout multiples. And again, it comes back to the synergies. If I look at Slide 3, you have a footnote there but no fee. And in it, you say run rate cost and revenue synergies of $110 million. And if I've got this wrong, I apologize, but I think you're seeing a $110 million is EBIT there to get the takeout multiple of 13x on 2027, that seems to work for me. And then similarly, on your bar chart on Page 14, you have a comment now saying dollar EBIT impact as a scrap line. So to be clear, assuming $110 million of revenue synergies or the red bit -- sorry, the $110 million is flowing to EBIT when you think about the takeout multiple or just the red bit of the bar on Page 14. Because it means it's a difference between synergies being something like 8% of sales being maybe 4%, 5% of sales. So I hope the question made sense. I'm just trying to understand how you're presenting this today.

Pascal Bouchiat

executive
#42

David, I'm not so sure that I fully understood your question. Maybe I will explain the -- I mean, overall, this level of synergies. So let's take Page 14. So here, I mean, what you see here is, yes, I mean, the EBIT components of synergies. Now and basically, I mean, $110 million is EUR 60 million of EBIT coming from revenue synergies out of a global level of revenue synergies in 2029, excuse me, that will be EUR 130 million. So overall, I mean, the overall move from revenue synergies to EBIT synergy is 45%. So 45% of revenue synergy will be translated into EBIT. So EUR 60 million EBIT impact from revenue synergies coming on top of EUR 50 million cost synergies. All of that is in millions of millions of dollars of U.S. and which is fully consistent with the EV to 2024 or 2027 EBIT multiple that you see on Page 3. This is not this is absolutely consistent. This I can I can assure you that this is fully consistent.

David Perry

analyst
#43

No, it makes sense to me now. I just wanted to clarify, it just strikes me as a very high level of EBIT contribution coming from the synergy.

Pascal Bouchiat

executive
#44

Yes. I mean, David, thank you for this point. You really need to understand, I mean, the type of P&L of this kind of assets we are no longer part of, I mean, the classical defense, aerospace type of gross margin, where I mean, we've got, to make a long story short, a level of gross margin, which is between 25% and 30%. Here, we are discussing about assets where gross margin is between 70% and 80%. So it has nothing to do, which means that the conversions from revenue synergies to EBIT synergy is much higher than it is in I would say classical aerospace and defense type of businesses. Hence, I mean this conversion ratio that I shared with you, which is something around 45%. So in other terms, 45% of revenue synergies will be translated into additional EBIT.

Operator

operator
#45

We will now take the next question from the line of Herve Drouet from CIC Market Solutions.

Herve Drouet

analyst
#46

2 questions as well on my side. First one is, I understand that the Imperva is mostly a civil business. But I was wondering, is there any contract with the MOD in the U.S. in the defense side? And as well as a long-term contract, if it is the case, being secured from that perspective? So that's the first question. And the second question is, do you see any combination with the part of Gemalto, which is based in the U.S. with that entity that can help you as well to leverage on the sell side, other things, [indiscernible] security? And as well, do you think in terms of size, you will need potential additional bolt-ons, especially in post-contract cryptography?

Philippe Vallée

executive
#47

Yes. So first of all, first answer first part of your question. As far as governmental contracts are concerned or let's say, defense-related. We don't know that in detail for sure, but we know that Imperva as limited businesses with the famous 3 later agencies in the U.S. But we don't think that business will require any profit buildup. So it's -- like we have, by the way, already from the former Gemalto business in the U.S., like you mentioned. And the [indiscernible] that Imperva will be integrated within DIS. It means that, that business will be integrated within the business segment of DIS, which is coming from the formal Gemalto acquisition. So indeed, we will benefit from product, synergies, revenue synergies and cost synergies coming from our U.S.-based business.

Patrice Caine

executive
#48

I think the one on any follow-on bolt-on. Well, but to be clear -- and by the way, it's not specific to cybersecurity. We do intend to continue to look at, I would say, bolt-on acquisitions in any of our core business, namely defense and security, aeronautic and space and the DIS. It's not specific to DIS. My answer is quite generic because clearly, this is our strategy. Our strategy has not, I would say, changed since now several years in terms of where do we want to allocate our money in terms of M&A, not typically for BIS, if there is any additional need that we will see, probably the priorities, first of all, to digest, if I may say, this requisition. Clearly, looking at the future, I would say, overall portfolio of use cases or less solutions that would be embraced by the combination of Imperva and Thales DIS. This is very wide and comprehensive. So there is no, I would say, things that we would miss desperately. So I think we have built up or we are going to build up very, I would say, strong compelling and comprehensive player that will -- and this is said by Philippe, and I would like us to insist on this point just for a few seconds. That will help large enterprises to simplify the complexity they face. When we discuss with, I would say, large companies, international groups, our customers, in fact, and typically, the Chief Information and Security Officer, the CISO. They all face a huge complexity, both in terms of, let's say, freight, but also in terms of solutions to address the very -- the large variety of types they have to deal with. And having a player tomorrow like Thales, I would say, taking on their shoulder, on our shoulder, I would say, a lot of these, I would say, are concerned is of great help and is a realized value for them. Last question on post-quantum cryptology. We do already have this expertise within Thales. So of growing this expertise on an organic standpoint seems quite natural. It doesn't preclude that, small acquisition, but this is already something that we do matter. I'll just remind you that one of the post-quantum cryptology crypto algorithm that was selected and stems, if I may say, by the NIST is ours, in [ Falcon ] on this algorithm has been designed by Thales team a while ago now. So you be, I would say, confident that we do master this technology that is clearly needed to address, I would say, future fights in the years to come.

Operator

operator
#49

We will now take the next question from the line of George Zhao from Bernstein.

George Zhao

analyst
#50

First one, when you say continuation of the ongoing share buyback program, you're already more than happily done through the current program, and it could even wrap up by the time this deal closes next year. So do you think there will be capacity to continue the buyback beyond the current year program considering beyond this deal? And second one, just a clarification. So Imperva acquired in 2018 for $2.1 billion, were there material acquisitions done by the business since that such that when we're looking at the 3.6% is not comparable to the 2.1 price buyback?

Pascal Bouchiat

executive
#51

Maybe, George, I mean I will start with -- I mean, the first question about our share buyback program. So as we made it very clear that this program, which is well advanced. I mean, we mentioned that by the end of June, we have come -- I mean 58% of this program has been completed. And as we mentioned at the outset of it, we said that it will be completed by the end of March next year. So now, I mean, going forward, at this point, it's probably too early. I mean, we get your questions. It's typically in the type of discussion that we will have at our Board in 2024. And we see, I mean what makes sense on this matter. So making a long story short, which completes has announced the completion of the current share buyback program end of March next year. And we'll see with our board, I mean, next year, what will be the most meaningful way to look at the future. Second question?

Philippe Vallée

executive
#52

So I think the second question was linked to the number of acquisitions that Imperva made, I think, from 2019, which is the year of the acquisition by Thoma Bravo. Well, actually, before 2019 and after 2019, altogether, Imperva is a buildup story, they acquired roughly 6 companies. Helping them to secure, I'm not going to enter into the details, but helping them to secure on both in data security and application security, their breadth and width of what they are offering to their customers. So indeed, Imperva was created in 2002, and at least 6 significant acquisitions were made before or after Thoma Bravo acquisition in 2019.

Patrice Caine

executive
#53

I think this is time to close the Q&A session, and that's what Bertrand at least told me. So Bertrand is the master of the ceremony. So thanks very much. Let me close now with a few words on this session. So as you understood, of course, the entire management team is absolutely excited by this movement, absolutely excited by this move, which is so value creative for DIS and for the group as a whole as well. So clearly, with Pascal and I really look forward to speaking with you in the upcoming investor road shows and conferences, mostly after summer break, we need a bit of rest, if I may say. But we'll be more than happy to discuss as soon as possible with all our investors and of course, with all of you. Thank you very much, and have a good day.

Operator

operator
#54

Thank you. Ladies and gentlemen, if you didn't have a chance to ask your question on today's call, please do not hesitate to send your question to Thales Group Investor Relations at ir@thalesgroup.com, and we will get back to you as soon as possible. Thank you all for your participation. You may now disconnect.

Read the full transcript via the API

You're viewing the first half of this call. Get the complete Thales S.A. transcript — plus 251,000+ transcripts from 12,000+ companies, speaker segments, AI summaries and full-text search — through the EarningsCalls.dev API.

Get the API View API docs →

This call discussed

For developers and AI pipelines

Programmatic access to Thales S.A. earnings transcripts and 251,000+ others is available through the EarningsCalls.dev REST API. Plans from $24.99/month — full transcripts, speaker segments, full-text search, and the recently-added /api/v1/transcripts/recent polling endpoint for ETL pipelines.