Endpoint Security , Governance & Risk Management , Patch Management

Why CrowdStrike Is Eyeing a $1B Buy of Patching Firm Action1

After initiating the most disruptive IT outage in history with a faulty software update, CrowdStrike is now eyeing the biggest acquisition in its 15-year history.

See Also: How to Unlock the Power of Zero Trust Network Access Through a Life Cycle Approach

The beleaguered Austin, Texas-based endpoint security behemoth is in talks to acquire Houston-based patch management and vulnerability remediation startup Action1 for close to $1 billion, co-founder and CEO Alex Vovk told employees in an email Wednesday. This would be the largest acquisition in company history, more than doubling the $400 million CrowdStrike paid for SIEM specialist Humio in March 2021.

"In light of the rumors inside the company, I would like to confirm that CrowdStrike is interested in acquiring Action1 with an estimated transaction value close to one billion dollars," Vovk wrote in an internal email first obtained by CSO Online. An Action1 spokesperson confirmed the authenticity of this email to Information Security Media Group but declined to comment further.

A CrowdStrike spokesperson told ISMG, "In the current environment, misinformation has become increasingly prevalent. As a policy, we do not respond to rumors or speculation."

Patching Is Paramount After Massive IT Outage

Talk of a deal comes less than a month after a faulty July 19 CrowdStrike software update sent 8.5 million Windows hosts into a tailspin of crashing and rebooting, disrupting hospitals, stock markets, banks and airlines globally. The massive outage resulted in Delta Air Lines pursuing legal claims against CrowdStrike, as well as a proposed class action lawsuit from investors who claim the company misled them (see: Delta Versus CrowdStrike and Microsoft: Accusations Fly).

CrowdStrike's stock is down 30% to $240.04 per share since the outage occurred, lopping more than $30 billion off the company's market cap. Nonetheless, with a $58.4 billion valuation, CrowdStrike remains the world's second-most valuable pure-play cybersecurity vendor behind only Palo Alto Networks, which has a market cap of $106.5 billion.

Action1's product would partially overlap with CrowdStrike's Falcon Spotlight module, which debuted in November 2017 to identify vulnerabilities in real time that exist across customer endpoints. Action1 offers free vulnerability assessments for an unlimited number of endpoints as well as automated detection and remediation of vulnerabilities, according to the company's website.

Action1's capabilities around real-time software and hardware asset monitoring overlap with CrowdStrike's Falcon Discover module, which enables nonsecurity use cases such as asset inventorying. But CrowdStrike has no tools today around patching, software deployment or endpoint management, while Action1 plays in all three spaces with both patch management and third-party patching products.

How Action1 Compares to Previous CrowdStrike Deals

Action1, founded in 2018, employs 41 people, hasn't raised any outside funding and has been led since inception by Vovk, who previously established and led visibility and governance vendor Netwrix. Vovk told employees in Wednesday's internal email that Action1 is in a rapidly growing market, experiencing hypergrowth and on track to soon reach $100 million in annual recurring revenue.

The company works with a variety of high-profile retail and tech organizations including eBay, Nestle, Coca-Cola, Purell, Baxter and the state of California, according to Action1's website. Action1 said it enjoyed 376% global sales growth in 2023 and now includes 99% patching coverage for most enterprise environments through its third-party patching capabilities.

The acquisition of Action1 would be the eighth in CrowdStrike's history and would come five months after the company bought data security posture management startup Flow Security for $96.4 million to safeguard information across endpoints and clouds. Six months earlier, the firm bought application security startup Bionic for $238.7 million to expand risk visibility and protection across cloud computing environments (see: CrowdStrike to Buy Israeli Data Defense Vendor Flow Security).