/ 01
IPO INSIGHTS

Do I need to make money to go public? (And if so, how much?)**

With signs of a measured return of the IPO markets, companies and investors are revisiting the fundamental question, “What do I need to look like to go public?”

In the pre-2020 market, a “unicorn” with a $1 billion valuation and $100 million in annual revenue was a promising IPO candidate (with some variation by vertical). But with the meteoric rise – and subsequent fall – of valuations over the past several years, what’s the right litmus test for IPO success? By some calculations, over 1,000 companies today claim a valuation of $1 billion or more on a post-money basis – but only a fraction of these unicorns are likely to reach IPO, whether due to underlying business fundamentals or macro dynamics that have resulted in companies staying private longer or pursuing M&A exits (Jamie Dimon, in his annual letter to shareholders, recently bemoaned that the number of publicly listed companies today has nearly halved from the mid-1990s). In particular, after the poor performance of many companies that went public via de-SPAC, it is clear that advisors and investors continue to be selective with their money and more rigorous in their views on listed companies’ prospects.

So what does this mean for companies looking to list today? To see if there are any lessons from the recent swell in IPO activity, Orrick's Mark Mushkin looked at the 79 non-SPAC IPOs that priced through June 30, 2024, and sorted them by those companies that have traded up (28) vs. down (51) since listing. For each company, we looked at market cap at listing (based on IPO price) and revenue on a trailing twelve-month (TTM) basis to see if there was any correlation to stock price performance (we also took a look at TTM net income, but it did not show any obvious trends).

The market cap trends are particularly interesting. Of the 20 companies that listed with a market cap of $1 billion or more, only six have traded down so far. In contrast, of the 12 companies that listed with a market cap between $500 million and $1 billion, half have traded up, and half down. And of the 47 companies that listed with a market cap below $500 million, 39 have since traded down. The TTM revenue results also showed some trends. Of the 21 companies with around $300 million or more in TTM revenue, only seven experienced early stock price declines, with the results below that threshold much more mixed. Of the 12 companies with between $50 million and about $200 million of revenue, five have traded up and seven have traded down. And of the 46 companies with less than $50 million of revenue, only 8 have traded up.

What does this all tell us? That the traditional unicorn is not dead? That $300 million of revenue is the “new” $100 million? Maybe nothing so clear, but at least that in the early stages of the IPO market’s resurgence, public market investors have focused more on companies that have not only demonstrated size, but also revenue-generating capacity and some operational maturity. As a result, private fundraising and non-IPO exits may continue to be the preferred path for those unwilling or unable to test the public markets. However, the market continues to evolve. For those companies watching their financial metrics while contemplating a potential IPO, the advice remains – having your house in order is table stakes for considering a listing and can have equal benefits for alternative fundraising and exit strategies, and as every business knows, maintaining optionality can have significant value.

**All figures based on rough lawyer math and stock price movements as of July 26, 2024.

/ 03
SEC ENFORCEMENT

Cyber enforcement forecast post-SolarWinds decision

What’s New

• In late July, a U.S. district court dismissed major parts of the SEC’s case against SolarWinds and its CISO, Timothy Brown, related to the company’s SUNBURST cyberattack.
• The judge rejected claims based on post-SUNBURST statements, ruling that companies aren't required to detail what may have led to potential cybersecurity failures and that disclosures must be judged based on the knowledge available at the time.
• The court also dismissed claims about SolarWinds' internal accounting and disclosure controls, deeming them “ill-pled,” especially since they relied on hindsight from the SUNBURST incident.
• Only claims of securities fraud related to the company’s pre-SUNBURST 2017 Security Statement remain.

Why It Matters

The court’s order essentially gutted the SEC’s case against SolarWinds and will require the SEC to be more vigilant when bringing claims against issuers, with the court emphasizing that disclosures based on knowledge and context – not hindsight – will reduce issuers' potential liability. The remaining claims reinforce the importance of robust cybersecurity practices and clear disclosures.

As Aravind Swaminathan, Global Co-Chair of Orrick’s Cyber, Privacy & Data Innovation Practice, put it in a conversation with other leaders in Corporate Counsel: “This is not going away. And while the judge has said these practices that SolarWinds engaged in are acceptable, if I were a client, I would not be resting on my rear and saying, ‘This is just not a big deal anymore.' This is one judge in one court on one very highly publicized action. But this is not going to necessarily stop the SEC.”

/ 04
CYBER DILIGENCE FOR IPOS

Tech Debt is Common. What does it mean for IPO readiness from a cybersecurity perspective?

Most high-growth companies have technical debt: work owed to IT or software development due to shortcuts that advance the business. That’s natural. But what if the debt carries security risks? Orrick capital markets partner Jamie Evans sat down with Kroll CISO David Dunn to discuss how companies and investment bankers preparing for an IPO can address the risks.

See video here

The Takeaways

For the Investment Banking Team:

• Determine security ownership. Take a step back and start the conversation by assessing who owns security from an operations, product and regulatory compliance perspective. CISO responsibilities are varied and continue to expand, so dive in to learn the company’s current approach.
• Consider security not only for the network but for product. Customers are hyper-focused on product security and how the responsibility is managed within an organization. It may be one of the most important indicators of value and risk for a business.

For the Late-Stage Company CISO:

• Sync with your teams. Ask your infrastructure, product and compliance teams early and often: What’s keeping you up at night? Use this exercise to build trust and identify areas for focus and improvement.
• Demonstrate an effective record. If security issues arise, Dunn says the No. 1 way CISOs can instill confidence is through a record of issue-spotting and process execution.

For more on due diligence considerations, tune in to The Evolving Role of the CISO: From evangelizing product to collaborating with the C-suite.