Description

Cyren Ltd (“CYRN”) is a commoditized, SDK-based IT security solution provider attempting to transform into a cloud-based IT security provider.  It has been 18 months since the release of CYRN’s cloud offering and it has yet to generate any material revenue, while CYRN’s legacy business melts away as increased competition and free offerings make CYRN’s products obsolete.  With current net cash of $3.9mm and average quarterly burn of $1.3mm, an equity raise is imminent.  CYRN has recently put in place an ATM offering agreement with Craig-Hallum, but management likely wants to do something larger.  We believe investors will soon grow tired of immaterial contract and partnership announcements and realize that both the legacy and cloud products are going away.  Our best-case fair value estimate for CYRN is $0.69/sh, 67.0% below the current price.  However, with continued losses and cash burn the stock could very well end up worthless in the long run. 

Background:

CYRN was formerly known as Commtouch Software Ltd., which went public in 1999.  The company historically offered embedded SDKs for anti-spam, virus-detection, and email protection.  As the market for embedded SDKs matured and open-source SDKs became widely available, CYRN faced continued pricing pressure and contract losses.  To grow the business, CYRN purchased three companies between 2010 and 2013.  Two of these acquisitions added some antivirus capabilities and the third enabled the delivery of services on a private label cloud.  As the embedded business continued to decline, CYRN invested heavily on its cloud offering and integrated their on premise solutions into the cloud platform.  As a result, despite two acquisitions in late 2012 adding $10mm of revenue, CYRN’s expenses in 2013 (excl. earn-out adjustments) were $18mm higher than in 2012, and the company turned loss-making.  In January 2014, the company changed its name from Commtouch to Cyren along with the launch of its cloud offering “Cyren Websecurity”, hoping the new product would help transform the company into a “SaaS player” that promised “significant new revenue streams”. 

Since January 2014 CYRN has mainly produced vague and promotional press releases announcing distribution partnerships or new customers that led to nothing more than short lived spikes in its share price.  For example, CYRN’s stock had doubled year to date by mid-May on a wave of these press releases, which added $54mm to the market value of CYRN.  However, we confirmed with management that all these potential contracts combined would amount to $240,000 of annual revenue, of which $21,000 would be related to the new cloud offering.  We estimate that the 25+ distribution partnerships announced over the last 18 months have led to Cyren Websecurity revenues of less than $30,000 on a run-rate basis today!  Hardly justifying the large moves in CYRN shares or the large investment CYRN has made into the new cloud offerings.

As you can see in the summary financials below, CYRN’s problems appear to be getting worse as topline declines and GM deterioration, combined with increased SG&A investments, has wiped out CYRN’s earnings.

Product Overview:

Embedded SDK – accounts for 75% of CYRN’s total sales.  This is comprised of legacy URL filtering, antivirus, anti-malware, and anti-phishing SDKs.  The SDKs are provided to OEMs who integrate these into their service offerings to end customers.  These commoditized products constantly face pricing pressure, given there are open source SDKs available for free (only requires 1-2 in-house engineers to implement) and many well established competitors (e.g. Symantec, McAfee, Cisco) with more dynamic offerings.  Last year one of CYRN’s largest OEM customers canceled their ~$1mm contract with the company as they felt it was better to go with an open source solution instead of paying CYRN.  We believe the trend of pricing pressure and contract losses will continue to weigh on CYRN’s legacy business as it slowly melts away. 

Email Security – accounts for 25% of CYRN’s total sales.  Most of this business came from the purchase of eleven in November 2012 which enabled CYRN’s cloud offerings (CYRN took this platform and added their products to create Cyren Websecurity).  The legacy eleven business is comprised of scanning emails for spam, virus, and phishing threats.  These hosted solutions are more value-add than embedded SDKs, but overall this business has been experiencing declining volumes given lower customer usage, increased competition, and more robust product offerings from much stronger competitors.

Cyren Websecurity – As noted earlier, we believe revenue from this business is immaterial.  This is CYRN’s latest cloud offering that packages legacy URL filtering/antivirus/anti-phishing detection capabilities into an end product (adding a user interface, enabling monitoring and reporting, etc.) hosted on the cloud.  It’s a standalone end-point protection product for PC and mobile devices used in enterprise networks.  Websecurity so far has been sold by distributors and resellers, and in some cases, customized and rebranded by resellers.  It costs $20/yr per user to customers with more than 1,500 users and up to $45/yr per user to customer with less than 50 users.  However, given sales are done via 1 or 2-tier distribution networks, CYRN ends up getting only 40-75% of the amount charged to end customers.  CYRN has a direct sales team for Websecurity as well, but so far has not generated a single sale on their own.  The same, well established competitors to CYRN’s legacy products, as well as many smaller players, also offer the cloud solution at competitive prices. 

Business Viability:

We believe CYRN is a melting ice cube as customers increasingly abandon its legacy products and new cloud offerings are failing.  Customers of CYRN’s legacy SDKs are opting for free, open-source solutions while larger customers are switching to larger security providers with more comprehensive solutions.  CYRN is stuck in the middle without the resources to stay competitive.  During the 1Q2015 results conference call, CYRN’s CEO talked about three ways that CYRN has been losing customers in its legacy embedded SDK and email businesses:

1.       Customers discontinued contracts altogether;

2.       Customers brought the service in-house;

3.       Customers switched to larger providers that could provide bundled services.

Another issue CYRN faces is that its remaining customers are reporting lower volumes of usage among end users, which directly impacts CYRN’s topline and profits as many of CYRN’s contracts have a profit-sharing component. 

All these issues led to a 13.6% y/y sales decline in 1Q2015 (7.9% FX headwind, 5.7% organic decline), the biggest drop in revenues since 2004, and management guided $7mm of revenue for 2Q2015, implying a 15% y/y decline.  CYRN’s CFO confirmed that the company needs at least $8.5mm in quarterly sales to break even on EBIT, something we believe will never happen.  With its embedded SDK and email businesses declining amidst competitive pressures and reduced demand, CYRN’s only hope is its Websecurity solution.  As discussed throughout the write-up, we believe this solution is unlikely to amount to anything other than promotional press releases.  To achieve $8.5mm quarterly run-rate sales, CYRN needs to add 545,000 more subscribers to its Websecurity offering (assuming $20/user and 55% gross-to-net), assuming no further declines in the legacy businesses.  To put that into perspective, CYRN currently has around 2,000 subscribers for its Websecurity offering, 18 months after launch.

Capital Raise:

After raising $11.5mm in July 2014, CYRN now has less than $4mm of net cash and we expect the company to burn $3mm more this year (on top of $2.2mm cash burnt in 1Q2015).  CYRN has already filed for an ATM, and will need to raise more cash soon in order to stay afloat.  However, this time it’ll be much more difficult to raise capital given management’s history of promotion and subsequent disappointments.  On top of the failed launch of its cloud offerings, the decline in the legacy businesses is accelerating which should further weigh on valuation.

Fair Value:

We believe Cyren Websecurity is value-destructive and will only bring more cash burn and shareholder dilution.  We think the company might have some value left (in terms of cash flows) if it gets rid of the Websecurity business and runs the legacy business for cash.  We’ve estimated the value of CYRN’s legacy business applying a peer multiple of 6.6x EBITDA, which is arguably generous given the declining nature of the legacy business. 

2015E Revenue                                 $28.6

2015E Gross Margin                        71.2%

2015E Gross Profit                           $20.4

Est.  Legacy R&D                               $8.4

Est.  Legacy S&M                              $6.2

2015E G&A                                          $6.0

Legacy EBIT                                         ($0.1)

2015E D&A                                          $2.8

Legacy EBITDA                                   $2.7

Peer Multiple                                    6.6x

Enterprise Value                              $17.9

Net Cash                                              $3.9

Equity Value                                       $21.8

FD Shares Outstanding                 31.5

Fair Value per Share                       $0.69

Catalyst

CYRN is quickly losing credibility as management fails to deliver material growth with its cloud offering.  Meanwhile, the legacy business continues to decline.  High fixed costs will limit CYRN’s ability to contain costs going forward and the company will run out of cash in less than a year.  Given the deteriorating business trends and reduced excitement over its cloud offering, CYRN will face difficulty in raising capital to keep itself afloat.