We believe that shares of Sourcefire, Inc. (FIRE) are highly overvalued.

Our full report is available here.

Note that Sourcefire reports earnings on April 30th, and if it beats analyst estimates, the stock could rise. We’re short regardless.

Following a 55% rally since the start of 2012, FIRE shares now imply a 5.4x 2013E revenue multiple and a 204x 2013E GAAP P/E. With valuation multiples as rich as these, it might sound strange to hear that Sourcefire added only 452 new customers in 2012, the exact same amount they added in 2011. Yet FIRE’s revenue growth expanded from 27% to 35% in 2012, masking the slowing momentum in new customer adds. We can attribute this mismatch to the introduction of two new software products, a next-generation firewall and an anti-malware tool, in Q4 2011 and Q1 2012, respectively. These upsell tools allow FIRE to achieve a combined pricing uplift of 30%, providing a one-time growth boost for new and existing customers. Comments from management indicate that this was a defensive measure taken to protect Sourcefire’s core Intrusion Prevention System (“IPS”) business from obsolescence as recently introduced next-generation firewalls now incorporate many features of standalone IPS. Gartner believes these NGFW systems could subsume 50% of new IPS deployments by 2015. While a bullish Wall Street continues to brush aside these issues, our research indicates that FIRE’s upsell opportunity is becoming saturated, new product introductions will increase competitive pressure, and FIRE’s GAAP earnings are actually shrinking on a year-over-year basis (2012 10-K, 10-Q3).

Sourcefire, a 12-year old network security business, is a leading provider of Intrusion Prevention Systems (“IPS”). Modern IPS tools use rule-based systems to identify suspicious packet traffic, alert the IT administrator, shut down attempted malware attacks, and block host, service, or application access as needed. Every network is different, but a firewall is typically used on the perimeter of the network as a first-line defense, where line speeds are the greatest, while IPS sits inside the firewall to provide a second layer of protection. According to Gartner, the $4.9bn firewall market is believed to be four times larger than the $1.2bn IPS market. Some of the largest end-markets for IPS are security-sensitive industries with large information flows, such as governments, financial institutions, and telecommunications networks.

Prior to the introduction of next-generation firewall (“NGFW”), the firewall and IPS systems were purchased separately, creating the need to manage two different security platforms. But Gartner and other industry expertsnow believe the firewall market is shifting towards NGFW adoption, allowing users to integrate firewall and IPS features into a single tool. Very worryingly for Sourcefire, research from Gartner indicates these NGFW systems could subsume 50% of new IPS deployments by 2015. Sourcefire has reacted to this threat by introducing its own NGFW software, which it now offers alongside its IPS for a 10% pricing increase. While this can help FIRE retain some customers over the near-term, we believe Sourcefire will find it challenging to maneuver from an “IPS-first” business to one primarily known for its firewall. Sourcefire’s founder and CTO, Marty Roesch, has stated that, “we typically lead with Intrusion Prevention Systems” and “we don’t really see greenfield opportunities very often in a space like [Next-Generation Firewall]” (Q4 2012 Call). Mr. Roesch has also acknowledged that Sourcefire’s move to NGFW was mostly defensive in nature: “If you look at some of the market predictions, a fair amount of the IPS market will be delivered on NGFW markets and we don’t want to cede market [share].”

The next-generation firewall sector is extremely crowded with highly-regarded pure-play participants like Fortinet, Palo Alto Networks, and Check Point alongside networking giants like Cisco and Juniper. Given the momentum behind NGFW adoption, Gartner believes that end-market growth in the IPS market will begin to slow in 2013 before inverting to negative year-over-year growth in 2015.

Even in the midst of this market shift, Wall Street analysts have bent over backwards to justify FIRE’s current price. Some of the outlandish valuation metrics proposed by the Street include an 8% terminal growth rate (Wells Fargo, 11/16/12), a 6.7x 2013E revenue multiple (Stephens, 5/1/12), and assigning a 50% probability to FIRE getting acquired “in the next few years” (FBN Securities, 1/12/12). Morgan Stanley (2/22 report) uses a 21x “adjusted” 2014E free cash flow multiple, which would sound more reasonable if it didn’t exclude stock-based compensation expense without adjusting for the corresponding shareholder dilution. Management has done little to temper this reckless enthusiasm going into the new year. On the Q4 2012 call, Marty Roesch stated that FIRE continues “to see the opportunity to double the top line every 3 years,” a goal we believe is unrealistic given the transitory benefit of upsells, the market’s shift towards NGFW, and FIRE’s heavy reliance on federal spending (20% of 2012 sales). Moreover, our management-case discounted cash flow model, where FIRE’s operating margins reach management’s long-term goals, implies a fair value range of $17 – $26. This equates to a discount of 50% – 65% below Sourcefire’s current share price. With such a large disconnect between FIRE’s share price and intrinsic value, it should be concerning that FIRE’s GAAP earnings actually shrunk by 24% in 2012 due to skyrocketing equity-based compensation and buckling gross margins.

Recent commentary from Fortinet (FTNT) and Check Point (CHKP), two leading network security vendors, could foreshadow industry-wide weakness in the first quarter results. On a special investor call on April 10th, Fortinet was forced to lower its Q1 2012 revenue guidance from $138m – $141m to $134m – $136m, sending FTNT shares down 13% for the day. Fortinet attributed the weakness to slowing European spending and delayed capex at the large telecom customers. Sourcefire is meaningfully exposed to both end-markets. Check Point reported its Q1 2012 report on April 23rd, 2013 with a revenue print of $322.7m, at the low-end of management’s guidance ($320 – 332m) and below analyst expectations ($328m). Due to industry-wide weakness, CHKP doesn’t expect a resumption of growth until the second half of the year. This pair of read-throughs could be particularly dangerous for Sourcefire following the victory lap it took on its Q4 call, which reset growth expectations higher than the Street expected. At a 5.4x 2013E revenue multiple and 204x GAAP P/E, FIRE will have little margin for error on its April 30th earnings announcement.

Summary of Red Flags

We believe that Sourcefire is substantially overvalued for the following reasons:

• Next-Generation Firewalls Could Replace 50% of IPS Deployments by 2015. As the creator of the open-source Snort software, Sourcefire is deservedly praised for creating one of the industry’s most influential IPS products. But when it comes to mindshare in the firewall market, Sourcefire fails to even earn a mention in Gartner’s Enterprise Firewall Magic Quadrant. This should be concerning to FIRE investors because industry pundits believe that next-generation firewall technology, which combines the features of both traditional firewalls and IPS systems, will subsume 50% of IPS deployments by 2015. Admittedly, some customers may continue to prefer a multi-layer approach as opposed to all-in-one NGFWs, but the threat to standalone IPS will only grow in time. Even after launching its own version of an NGFW in Q4 2011, Sourcefire’s founder, Marty Roesch, admits that FIRE still approaches customers with an IPS-first mindset, “I think the way people are approaching is that we typically interact with, you see them starting up with IPS deployments and then turning on license keys to bring the additional functionality to bear where necessary” (FIRE Q3 2012 Call). While this strategy plays to FIRE’s strengths, and allows them to avoid head-to-head competition with Palo Alto (PANW), Check Point, Fortinet, and other NGFW leaders, it could be a losing strategy over the long term.

• Slowing New Customer Adds and Saturation of the Upsell Opportunity will make Growth More Challenging in 2013. Sourcefire has attempted to mitigate the threat from competitive NGFW systems by launching two new products, a Sourcefire-branded NGFW and the FireAMP Anti-Malware tool. After paying the upfront hardware, subscription, and maintenance costs associated with a Sourcefire IPS, customers can add NGFW and Anti-Malware software for a combined 30% price increase. The addition of these tools to FIRE’s portfolio in late 2011/early 2012 allowed Sourcefire to grow quarterly revenue by an impressive 51% (year-over-year) in Q1 2012. Since then, however, upsell opportunities appear increasingly sparse, as YoY revenue growth slowed to 27% in Q4 2012. Many have overlooked this slowing quarterly growth, instead citing FIRE’s 35% revenue growth in 2012. Yet recent data in FIRE’s 10-K reveals that Sourcefire only added 452 new customers in 2012, which is precisely the same amount of customers adds as in 2011. This may indicate that 2012’s growth reacceleration was the result of one-off upsell opportunities, not increased customer wins.

• A Management-case DCF Model Yields a Fair Value of FIRE of $17 – $26, a 60% Decrease from the Current Share Price. Since GAAP profitability continues to shrink, Sourcefire utilized a February 25thInvestor Presentation to remind shareholders of its long-term margin goals. FIRE argues that, as the business expands, it can materially decrease R&D, selling & marketing, and G&A expense as a percentage of revenue. This long-term plan would theoretically add around 1000bps to FIRE’s 2012 operating margin. While these long-term goals are praiseworthy, in practice they could be difficult to achieve. Given the more than dozen competitors in both IPS and Firewall, FIRE must perpetually invest in new research just to stay competitive. As for the selling & marketing expense, Sourcefire’s shift towards adding channel partners should pressure margins during the transition period, as shown by the 200bps increase in S&M expense between 2010 and 2012. But even if we overlook these challenges and assume that FIRE’s EBIT margins consistently expand, reaching management’s long-term goals by 2017, a discounted cash flow analysis yields a fair value of only $20/share. This analysis uses a 10% cost of capital and a 3% long-term growth rate, both reasonable assumptions given FIRE’s share price volatility and the growing threat from NGFW. Further sensitizing this range to a 9% – 11% WACC and a 2% – 4% long-term growth rate produces a fair value range of $17 – $26/share, or about 60% below FIRE’s current share price of $51.04.

• Recent CEO Appointment and Industry Precedent Suggest that Sourcefire is not a Near-Term Acquisition Target. When traditional valuation metrics fail, analysts have turned to valuing Sourcefire as a buyout target. For example, last year’s initiating coverage report from FBN Securities (1/12/12) assigns a 50% probability to FIRE getting acquired “in the next few years” as part of its valuation analysis. Assumptions like this are reckless. To begin with, the April 10th appointment of John Becker at CEO, replacing Marty Roesch who served in an interim role, reduced the odds of a near-term takeover. If FIRE had been in back door negotiations for a sale of the company, it wouldn’t be necessary to grant Mr. Becker a 400,000 share restricted stock and option package that would partially accelerate on a change of control. Secondly, a survey through precedent network security deals reveals that many have already passed over Sourcefire in favor of other platform acquisitions.  IBM (IBM) acquired Internet Security Systems in August 2006, HP (HPQ) acquired TippingPoint via the 3Com deal in November 2009, Intel (INTC) bought McAfee in April 2010, and Dell (DELL) paid $1.2bn for SonicWall in March 2012. The two firms most cited as acquirers, Cisco (CSCO) and Juniper (JNPR), already market in-house, highly-ranked next-generation firewall systems. Finally, the Israeli-based Check Point agreed to acquire FIRE in 2005 only to have the deal blocked by the U.S. government on security grounds. At 21% of 2012 revenue, the federal government is by far Sourcefire’s largest customer and has its IPS systems installed throughout its official networks. The government is extremely interested in ensuring FIRE remains domestically controlled. Because of this, the possibility of an acquisition by a foreign buyer is effectively nil while national security risks would complicate a transaction with a U.S. buyer, especially one that has interests abroad. These reasons, in addition to Sourcefire’s high 6.8x LTM revenue multiple, make us believe that a near-term takeout is unlikely at the current share price.

• Wall Street Research is Drastically Overstating Sourcefire’s Addressable Market Opportunity. By combining the firewall with the IPS, next-generation firewalls can consolidate hardware and software tools into one platform, eliminating the need to purchase separate IPS and firewall hardware. Since upfront product expenses are typically the lion’s share of a vendor’s income, the cost savings to customers are meaningful. But when viewed from the perspective of the vendors, such as Sourcefire, this innovation might lower the revenue opportunity. This can be demonstrated by Sourcefire’s new sales model, where customers need only pay 30% more to add NGFW and Anti-Malware software to FIRE’s traditional IPS system. And because FIRE is an IPS-first business, we believe Sourcefire’s ability to upsell NGFW and Anti-Malware is primarily limited to existing IPS users. If this is the case, we can calculate FIRE’s addressable market by multiplying the size of the IPS market ($1.2bn) by the incremental upsell opportunity (130%), yielding a TAM of $1.5bn. Since Gartner’s market size data only tracks product revenue, and not service revenue, it makes sense to gross this figure up to $2.5bn (product revenue is 60% of FIRE’s total). Lastly, if we then apply Gartner’s prediction that 50% of standalone IPS will convert to NGFW, then FIRE’s addressable market would be just $1.25bn, or about 25% less than FIRE’s current market capitalization. Comparatively, many analysts mistakenly believe that FIRE’s TAM is between $5 -10bn (Topeka, FBN, Wells Fargo, and others). Without this enormous addressable market opportunity, many of the valuation arguments made to justify FIRE’s 2013 GAAP P/E of 200x+ quickly fall apart.

• FIRE’s Valuation Disconnect can be Partially Attributed to Non-GAAP Earnings, which Overstate GAAP Earnings by 400%. Any investor that takes the time to scrutinize Sourcefire’s 10-K would quickly conclude that not only is FIRE’s business barely profitable but its GAAP earnings actually fell in 2012. Diluted earnings per share shrunk from $0.21/share in 2011 to just $0.16/share in 2012. But this is of little concern to Wall Street research analysts, who instead value Sourcefire using “adjusted” earnings. Driven by the exclusion of stock-based compensation, Sourcefire’s adjusted earnings per share grew from $0.57 in 2011 to $0.81 in 2012. Realizing that SBC expense seems to be considered free in the research community, Sourcefire’s management appears to be actively shifting cash salaries into equity-linked compensation. Even as revenue grows, SBC as a percentage of revenue has doubled since 2008, growing from 6% in 2008 to 12% in 2012. These adjustments have allowed FIRE to show steady year-over-year adjusted earnings growth when underlying earnings have actually decreased since 2010. This tactic has buttressed FIRE shares over the short-term, but we believe the continued degradation of FIRE’s quality of earnings should be a clear red flag to any potential investor.

Below is an embedded copy of our research report on FIRE.