Thales to Buy Imperva From PE Firm Thoma Bravo for $3.6B

Thales has agreed to purchase Imperva for $3.6 billion to enter the application and API security market and expand its footprint in data security.

See Also: Live Webinar | Unmasking Pegasus: Understand the Threat & Strengthen Your Digital Defense

The Paris-based conglomerate said its proposed acquisition of Silicon Valley-based Imperva will round out Thales’ security portfolio by adding a robust web application firewall along with capabilities in API protection, data discovery and classification, data security governance and data access monitoring. The deal will create a $2.66 billion cyber behemoth as well as $110 million in cost and revenue synergies (see: Imperva CEO on Maximizing Visibility Into Unstructured Data).

“The acquisition of Imperva marks a major milestone in Thales’ cybersecurity strategy,” Thales chairman and CEO Patrice Caine said in a statement. “With this acquisition, we are seizing a unique opportunity to accelerate our cybersecurity capabilities and are taking an important step towards our ambition to build a world-class global cybersecurity integrated player, providing a comprehensive portfolio of products.”

The transaction is expected to close in early 2024, and will add nearly $500 million of security revenue to Thales’ line card. Thales’ stock is down $2.10 – or 1.44% – to $144.28 in trading Tuesday. The acquisition is expected to generate $50 million of cost synergies and $60 million of revenue synergies and will drive organic sales growth of 6-to-7% and a 16.5% EBIT margin in Thales’ digital identity and security practice.

What Thales and Imperva Bring to the Table Together

Thoma Bravo took Imperva private for $2.1 billion in January 2019 following more than eight years as a publicly traded company and named longtime Infor COO Pam Murphy as its next CEO in January 2020. Imperva has been acquisitive under Thoma Bravo’s ownership, buying API security vendor CloudVector in 2021, database security startup JSonar in 2020 and bot management vendor Distil Networks in 2019 (see: APIs Are the New Battleground in Cybersecurity).

“Over the course of our more than four years of partnership, Imperva further differentiated itself in the competitive cybersecurity market,” said Thoma Bravo Managing Partner Seth Boro. “We are proud of what we built through our partnership with Pam Murphy and the Imperva team, and look forward to watching the company’s continued success as part of Thales’ innovative and diverse security portfolio.”

The joint security portfolio will unite Thales’ strength in identity, Imperva’s strength around application security and capabilities from both companies in data security, where Thales focuses on data in motion and Imperva protects data at rest and in use. Imperva will be part of Thales’ security products business, which today includes data security, identity and access management, and cloud defense and licensing.

Gartner named Imperva a leader in cloud web application and API protection in August 2022 alongside Akamai and Cloudflare, praising the company for its product maturity, event analytics, account takeover detection and application security portfolio. And in April, Forrester named Imperva a strong performer and Thales a contender in data security, praising Imperva’s progress and Thales’ focus on encryption.

“Today’s announcement represents an exciting new chapter for Imperva, one that will further our mission to help organizations protect data and all paths to it,” said Imperva CEO Pam Murphy. “We admire Thales’ vision and culture, and believe that, together, we can deliver greater product innovation and efficiency through disruptive solutions, while helping to simplify the greatest security challenges.”

How Thales Built a Cybersecurity Behemoth

Thales significantly expanded its presence in the cybersecurity, IoT and payments markets through its $5.63 billion acquisition of Gemalto in April 2019, and in 2022 purchased CIAM provider OneWelcome for $101.6 million as well as European cyber services vendors S21sec and Excellium. The company last month agreed to buy Tesserent for $119.1 million to expand its cyber services capabilities in Oceania (see: Thales to Buy Tesserent for $119.1M to Aid Australian Growth).

Reuters and Bloomberg reported in February 2022 that Thales was putting together a plan to buy Atos’ $1.41 billion cybersecurity business in a deal that would have had private equity firms like Bain Capital picking up the parts of beleaguered IT services giant that Thales wasn’t interested in owning. But no deal was ever consummated.

“We are seizing a unique opportunity to accelerate our cybersecurity capabilities.”


– Patrice Caine, Chairman and CEO, Thales

Application security contributed just over 60% to Imperva’s 2022 topline revenue of $496 million, with data security making up the remaining 39%. Nearly 60% of the company’s 2022 revenue came from the Americas, with APAC and EMEA contributing 22% and 20%, respectively. Imperva employs 1,400 people and serves 35% of the Fortune 100 with strength across financial services, telecom, energy and health.

In 2024, Thales’ digital identity and security business will generate two-thirds of its revenue from data security, application security and identity and access management products, which includes the Imperva portfolio. Remaining sales will come from services in areas like training and simulation and threat and risk evaluation as well as defense tools like high grade encryption and unidirectional security gateways.

Cybersecurity products and services will represent 44% of Thales’ digital identity and security sales next year, with 27% of revenue coming from banking and payments, 16% coming from biometrics and 13% coming from mobile connectivity. The combined cybersecurity business will have 11 Security Operations Centers on four continents as well as 8,000 employees, of which 5,800 are cybersecurity experts.

Thales expects to achieve $50 million of annualized cost synergies from the proposed Imperva deal by reducing its real estate needs, cutting procurement costs and slashing sales, general and administrative spending. The firm expects to spend $30 million on the Imperva integration between 2024 and 2026.