In private equity crackdown, DOJ may challenge cybersecurity merger

The Justice Department is nearing a decision on whether to challenge private equity firm Thoma Bravo’s acquisition of an enterprise software company over concerns it would unduly harm competition in a growing corner of the cybersecurity sector, according to four people with direct knowledge of the matter.

The DOJ is approaching a deadline for a decision later this month on whether to bring a case, over the $2.3 billion acquisition of ForgeRock, and it remains concerned that it is too close of a competitor to Ping, a similar company bought last year by Thoma Bravo, said the people, who were granted anonymity to discuss a confidential matter.

A lawsuit would show that DOJ’s antitrust head Jonathan Kanter is forging ahead with his aggressive stance against mergers, despite a rocky track record in a series of recent lawsuits.

It would also be a brushback to the private equity industry, which relies heavily on a so-called roll-up strategy of buying multiple competing companies in a sector before merging and ultimately selling them as one business. The investment firms have historically escaped antitrust scrutiny, but both DOJ antitrust chief Jonathan Kanter and Federal Trade Commission Chair Lina Khan have cast a skeptical eye on their business model.

ForgeRock specializes in customer identity and access management, or CIAM, which helps companies like banks and insurers verify their customers' identities. Thoma Bravo bought Ping last year, a key rival to ForgeRock. The plans for ForgeRock and Ping have not been disclosed, but it’s expected they will be combined, according to some of the people. Thoma Bravo also last year bought SailPoint, which operates in an adjacent but separate part of the market for managing the identities of employees.

Thoma Bravo and ForgeRock inked their deal last October, and DOJ opened up an in-depth probe in late December. The companies agreed to give DOJ until July 26 — though that can always be extended — to decide whether to sue, some of the people said. The companies’ lawyers are expected to meet with antitrust division leadership, including Kanter, this Friday in a final attempt to secure approval of the deal, those people also said.

The DOJ has yet to make a final decision on whether to challenge the merger and could elect to not bring a case. However, prosecutors remain concerned based in part on internal Ping and ForgeRock documents that describe each other as close competitors, some of the people said.

The deal would increase competition and provide its customers with more choice, Liz Micci, a Thoma Bravo spokesperson said in a statement. “The acquisition of ForgeRock will create a stronger vendor in the market that is better prepared to compete with the likes of Microsoft and Okta.“ A DOJ spokesperson declined to comment. A spokesperson for ForgeRock did not respond for comment.

The DOJ’s review is focused largely on the overlap in the CIAM market between ForgeRock and Ping, which are both smaller than the sector leader Okta. SailPoint meanwhile is focused on companies’ internal management of their employees' identity and access, in which ForgeRock and Ping also compete. The DOJ has also asked questions about SailPoint in its review of the ForgeRock deal, some of the people said, but the extent of the focus there is unclear.

Central to the companies’ defense, some of the people said, is that Microsoft is also expanding its presence in the market, which the companies point to as evidence of fierce competition. The companies argue that discounting competition from Microsoft would be at odds with the Federal Trade Commission’s stance in its case against Microsoft’s takeover of Activision Blizzard, which is based on fears that the software giant is illegally monopolizing the video game market.

Still, the DOJ has concerns, including that the deal would give too much power to the combined company, in part because they have been the primary bidders for a small subset of lucrative contracts for large companies in sectors including health care, financial services and telecom, some of the people said.

The companies are also pointing to a dynamic market in which large customers often use multiple providers at once, which can include IBM, Oracle, Broadcom and Salesforce, according to a document summarizing the companies’ arguments seen by POLITICO. Depending on how the market is defined, Ping and ForgeRock’s combined share is as little as 9 percent, according to the document. That percentage increases if only large customers are included, though the companies argue that is an inappropriate way to define the market.

Software mergers in particular can be difficult for the government to challenge, especially when it comes to defining a relevant market, said Renata Hesse, an antitrust attorney at the Sullivan & Cromwell law firm, who while at the DOJ helped supervise the failed challenge to Oracle’s takeover of PeopleSoft. Antitrust cases typically hinge on market definition, or the playing field on which the companies compete.

“The demands of customers will vary so much that it can be difficult to define a market around any specific group,” said Hesse, who is not involved in the ForgeRock deal. “Additionally, the government is depending on companies they are saying can’t compete, to agree with them in court, and they typically won’t do that.”

A private equity test case?

Thoma Bravo has focused its investment strategy on “boring” but lucrative enterprise software companies, its founder Orlando Bravo recently told The Information, which said the firm's strategy typically involves raising prices, layoffs and acquiring competitors.

Micci said Thoma Bravo focuses on creating “strong, operationally sound companies“ and “prioritizes sustainable, profitable growth over ‘growth at all costs.’“

Both the DOJ and Federal Trade Commission during the Biden administration have expressed concerns about acquisitions by private equity firms, which have historically been viewed as safer from antitrust enforcement because they are not direct competitors. Among the issues are investment firms’ roll-up strategy of merging competing companies.

Also on the DOJ’s radar are so-called interlocking directorates, where one person sits on the board of one or more competing companies. That is common among private equity firms, and Thoma Bravo has agreed to remove directors from several different competing companies to resolve other investigations.

The DOJ and FTC’s recent focus on the private equity market has led several companies to reject acquisition overtures from Thoma Bravo over potential antitrust concerns. Survey Monkey owner Momentive also recently ruled out Thoma Bravo as a potential buyer since the firm also owns Medallia, a competitor, which could raise antitrust issues, according to one of the people. Momentive did not respond for comment.

The FTC has also reached two settlements in the past year requiring divestitures in a private equity firm’s purchase of veterinary clinics, in addition to setting an onerous process for future related acquisitions.

“[P]rivate equity firms can be fundamentally different than other market participants,” senior DOJ antitrust official Andrew Forman said in a speech last summer. “It is also for these reasons that the division often looks more favorably on a market participant as a buyer of assets than a private equity firm.”