M&A Case Study: Cisco buys Splunk for $28 billion

A good strategic fit for Cisco, but Splunk may have left money on the table.

In 2024, Cisco closed on their largest acquisition ever: a $28 billion all-cash offer to buy Splunk, a SaaS company in the Observability and Cybersecurity sectors. At the time, I was a Splunk shareholder. I was quite happy with the company’s performance and was caught off-guard by the sudden proposal from Splunk to sell the company. Given my interest in M&A and my own personal ownership stake, I followed the developments closely. The Splunk Board of Directors unanimously recommended the sale, and shareholders voted roughly 80% in favor. I was one of the 20% that voted against the sale. The reason came down to valuation (i.e. the price Cisco offered to pay). Let me explain why and also expand on some lessons in this M&A case study for those interested in buying or selling a business.

The companies

Cisco Systems was founded in 1984 and was (prior to the Splunk acquisition) known for their leadership in networking technology. They designed, manufactured and sold hardware, software and services. Key products included Routers, Switches and other Networking Equipment. In 2015, under CEO Chuck Robbins, the company made a major strategic pivot towards higher margin software and a subscription based business model. The software would integrate with their legacy software business and Cisco built strong capabilities in enterprise cybersecurity. In this way, they could serve enterprises “end to end” in their information flows.

Splunk was a San Francisco based software company highly specialized in cybersecurity and observability solutions with a strong focus on real-time analytics capabilities. The Splunk platform enabled enterprise customers to search, monitor and analyze massive volumes of machine-generated data, often unstructured in raw form, and provide insights in real-time. As the amount of machine generated data grew, so to did the attractiveness of Splunk’s technology. Their software was very popular among customers, who were extremely “sticky” once Splunk’s platform was adopted. Originally selling traditional “perpetual software licenses”, the company pivoted to a subscription model in 2017. By 2023, their Annual Recurring Revenues (ARR) were in around $3 billion (a roughly 10x increase over the previous 8 years).

M&A is about strategy

Cisco’s interest in Splunk was no accident. In fact, there were good reasons to think Splunk’s products would fit well into Cisco’s wider portfolio.

1. Cisco would increase the breadth and depth of their product offerings. Splunk was a market leader in cybersecurity and observability markets. Cisco had capabilities in this space via previous M&A, but Splunk would be a major boost.

2. Cisco would achieve faster growth and higher market valuation. Cisco’s pivot to higher margin, higher growth, subscription software businesses was no accident. These types of business command higher valuation multiples in the market as compared to Cisco’s legacy hardware business. Splunk fit the profile of what Cisco was looking for: double digit revenue growth, strong free cash flows and a subscription based business model.

3. Splunk would increase its growth potential as part of Cisco’s portfolio. Splunk had achieved roughly 10x revenue growth over the prior 8 years. They built their own sales channels in the United States, and were increasingly looking to international markets for growth. However, the road ahead was a long one and could be dramatically shortened if they could leverage Cisco’s large sales teams that already had significant international presence.

4. Both Cisco and Splunk would benefit from combined AI capabilities. AI was already changing the enterprise software markets, and both companies had been investing in AI capabilities. Cisco’s acquisition would effectively allow these teams to “combine forces” precisely when scale and speed were paramount in capturing AI-based opportunities

But the deal was not without some potential risks. The list below highlights two related to Cisco’s post-merger integration (PMI) risks, but it is by no means exhaustive.

1. The “conglomerate” vs. “pure-play” risk. Part of the rationale for the deal was that Splunk could more quickly penetrate high growth international markets leveraging Cisco’s established sales teams. Sounds good in theory, but practice can be a different matter altogether. Pure-play businesses tend to be highly focused vs. conglomerates, and selling a highly technical software service requires considerable focus. Splunk’s major competitors (e.g. DataDog) remain pure-play businesses. If Cisco’s sales network was unable, or less willing, to focus on Splunk’s offering (as it would be part of Cisco’s wider portfolio), then sales could stagnate or even lose market share. This would have to be a major focus of Cisco’s management team once the acquisition was complete.

2. Talent retention. Top software talent can be finicky. Splunk’s employees had been compensated with company stock in a company that had seen >10x revenue growth over the prior decade. Moreover, as Splunk switched to a subscription model, their high growth rate and free-cash-flow margins were poised to command a premium in the market. In other words, Splunk employees were in for a lucrative ride. They would now be “converted” to Cisco stock for compensation. Would top employees stay? This would also have to be a focus for Cisco’s post-merger integration (PMI) plan. …

Background of the merger

Nov. 15 2021: Splunk CEO, Doug Merritt abruptly steps down. No reasons are immediately given in the news, and Splunk’s share price drops ~18% on the news. Graham Smith, Chairman of the Board, becomes Interim CEO until a new permanent CEO is found.

Nov. 19 2021: Chuck Robbins, CEO of Cisco contacts Splunk’s Interim CEO regarding a potential interest in acquiring Splunk. I suspect Splunk had been on Cisco’s M&A radar for some time. They had a track record of growing through M&A and decided to take advantage of Splunk’s leadership void to make an offer and see if they could close a deal quickly. Hence the two day gap between Splunk’s CEO departure and the opening bid.

Dec 17, 2001: Splunk receives an unsolicited non-binding indication of interest to buy the company for $165 to $175 per share. This offer was subject to customary due diligence. Cisco requested access to certain non-public diligence information in order to allow continued due diligence. It seems that Splunk did not agree to the non-public disclosures, but did provide Cisco access to certain Splunk employees to discuss publicly available information about Splunk’s operations.

Jan 14, 2022: Cisco makes another non-binding offer to buy Splunk for $175 to $190 per share, again subject to further due diligence. Note that at this point, only publicly available information has been provided, but the Cisco’s price has gone up despite only 28 having passed since the first offer.

Jan 23, 2022: Splunk engages an external advisor to evaluate the sale of the business, including the valuation of Splunk’s business.

Feb 4, 2022: Cisco makes another non-binding offer to buy Splunk for $193 per share.

Feb 6, 2022: The two CEO’s speak over the phone, and Cisco’s CEO verbally offers $212 per share. At this point, Cisco’s offer has gone up from $165-$175 to $212 per share in only 51 days. Splunk does not accept the offer, citing the need for finding a permanent CEO and for their advisor to complete a study of strategic alternatives and valuation of the business. Later that day, Cisco withdrew its non-binding offer

Key lessons (so far):

1. Splunk remained committed to a formal and professional process. They knew they needed an external M&A advisor and a solid leadership team in place. Without these, they would be at a serious disadvantage in any sale despite Cisco’s increasingly priced offers.

2. Cisco was prepared to walk away. Buyers (and sellers) should be prepared to walk away if the conditions are not right. Splunk was not in a position to commit, and Cisco was not prepared to raise their offer much further. They likely had a “price at which to walk away” already in mind before they made the first bid.

3. Just because the first round “fails” does not mean all is lost. Cisco remained patient, and was able to re-engage later (as we will see)

4. Market timing can impact the price paid. From Dec 17, 2021 until April 4, 2023 there was a contraction in Spunk’s market. Splunk’s financial guidance was lowered and their stock price declined 15% while the overall Nasdaq dropped 19% and the S&P software and services index dropped 25%.

Apr 4, 2023: Cisco’s CFO contacts Splunk’s CEO (in place for ~12 months by this point) to evaluate whether the two companies could further explore an acquisition. With their leadership team now fixed, Splunk was in fine position to trigger a formal and professionalized process, and a confidentiality agreement is signed within two weeks. Splunk prepares their information memorandum and business plan, including financial projections for further analysis.

May 3, 2023: to Jun 19, 2023: Representatives of both companies engage in information sharing meetings to advance discussions on Splunk’s business, technology, operations and outlook (including financials and forecasts).

Jun 19, 2023: Based on their information memorandum and materials shared to date, Cisco makes a non-binding offer for $130 per share. At this point, Splunk’s share price had dropped to $108 per share (Cisco’s offer was a 20% premium). Note how much lower this is than the $212 verbal offer in Feb 2022.

Jun 21, 2023: Splunk’s Board of Directors meets to formally discuss Cisco’s offer. They reject the $130 per share offer, concluding that Splunk is worth more as a stand-alone business based on their business forecasts. But, they also agree to further explore the potential deal with Cisco. In addition, the Board established a “Transaction Committee” to handle future negotiations, as it is impractical to assemble the full Board of Directors for every offer development. This Transaction Committee also engages two external advisors for formal valuations, and one advisor for a “market check” to see if other bidders could be interested in buying Splunk. Splunk’s advisors now directly engage with Cisco’s financial advisors.

Key lessons (continued):

5. Both Cisco and Splunk are more disciplined in their approach this time. Splunk has engaged advisors and is following a clear structure. They also establish a dedicated “transaction committee” at the Board level to handle the negotiation process. These advisors support the Board in evaluating the price offered vs. the business value, as well as whether other bidders could be interested. Sellers should always have advisors on hand to ensure they are following a structured process and getting the right price for their business. A “market check” is absolutely critical in this case, as more bidders can increase the price.

6. Market timing changed the dynamic and the price offered. During the first Cisco offers in 2021, the market was higher. With a downturn in 2022 and 2023, Splunk revised their forecasts down to reflect the market changes. Cisco sensed another opportunity. Buyers should always be scouting the market for opportunities, and this should be part of an overall M&A strategy. Both buyers and sellers should be aware that overall market dynamics will impact the price. Financial statements and forecasts will also be updated during the M&A negotiation process.

Aug 27, 2023: After several rounds of discussions between Splunk and Cisco advisors (part of a typical due diligence deep dive), Cisco makes a revised offer to acquire Splunk for $142 per share. Splunk’s Transaction Committee discusses this offer with their advisors and concludes the price is still too low. They quickly discuss with the Board of Directors who then decides to make a counter-offer of $168 per share. Their advisor presents this counter-offer to Cisco’s advisor on behalf of Splunk. At this point both Boards are working through their advisors.

Aug 29, 2023: Cisco increases their offer to $146 per share (this is also done via their advisor to Splunk’s advisor). Splunk counter-offers $160 per share, stating that $146 continues to undervalue Splunk’s business.

Aug 30, 2023: A day of offers and counter offers. Both Cisco and Splunk, working through their advisors are sending offers and counter offers. Cisco offers $152 per share, Splunk counters with $158. Cisco offers $157 and Splunk accepts the offer. On the date of offer, Splunk’s share price closed at $120.28 and Cisco’s offer represented a roughly 30% premium.

Sep 2, 2023: Cisco and Splunk announce the deal, and sign an agreement that moves it towards a shareholder vote. Splunk shareholders would approve the sale roughly 80% to 20%.

Key lessons (continued):

7. M&A is a long process, taking months or years. Cisco first approached Splunk in 2021, but it took 1 year and 9 months before the final offer would be accepted (and more months before the shareholder vote could be completed).

8. Advisors are absolutely critical. They are necessary to be engaged throughout the M&A process. For the seller, it is important to engage an advisor as early as possible, often before an offer has been extended, in order to sufficiently prepare the company for sale. Information memorandums, financial statements, forecasts, business cases, management presentations all need to be prepared. Buyers will expect this as part of their due diligence. They will have advisors that will insist on it.

Management Projections / Financial Forecasts

A critical step is the preparation of financial projections for the business. These are different than typical forecasts, projections and estimates that companies do in the course of their normal business. Essentially, they take the existing management forecasts and extrapolate forward for a fixed period of time (in Splunk’s case, this was 10-years). Extrapolating out that far involves making assumptions about the future performance of the business and market. Sellers should be very diligent here as their assumptions and forecasts will be challenged by the buyer and inform both buyer and seller valuations (and by extension, their negotiating positions). Below we see the Management Projections used by Splunk’s advisors as a basis for valuation.

Generally speaking, this is pretty standard. However, I would actually offer a criticism here in that the forecasts are very conservative. For instance, the Baseline Management Projections were in fact less than the company’s growth performance over the previous 5 years. In one sense, this is prudent as management does not want to be too optimistic. But I would have advised having one projection scenario as an “Optimistic Scenario” rather than the two Sensitivity Projection Scenarios shown - both of which are more pessimistic than the Baseline. This would have been prudent given the increasing demand for Splunk’s services and overall long-term market growth trends. As we’ll see, these projections provide the foundation for subsequent valuations. By being too conservative, Splunk may well have left money on the table.

The valuation

Among the most critical roles an advisor plays is ensuring that the right price is paid for the business. To do this there needs to be a clear structure and logic behind the valuation in order to justify the price being negotiated. As we’ll see below, several different methods were used to advise Splunk’s Board of Directors on whether Cisco’s offer was indeed fair. Each method provides a range of output values. The methods used were (1) Discounted Cash Flow, (2) Comparable Company Multiples, (3) Comparable Transaction Multiples. These are described in detail below.

1. Discounted Cash Flow Valuation

   1. Net Present Value (NPV) of Splunk’s estimates future unlevered free cash flows based on the company’s most recent financial statements and management projections for the next 10 years (the “forecast period”). These projections include a Baseline and two alternative scenarios. A range of discount rates is also applied from 12% to 14%. The Terminal Value projections assume a perpetuity growth rate range of 3.0% to 5.0%.

   2. Net debt was then subtracted from the NPV value above and…

   3. Divided by the total amount of fully diluted shares outstanding. This arrives at a range of values for Splunk’s business for each of the business projection scenarios. The Baseline Management Projection gives an implied value of $132.50 to $196.81 per share [see table below]. The final agreed offer of $157 per share is below the midpoint of the baseline projection, but above the midpoint for Scenario 1 and above the high end of Scenario 2.

      

2. Selected Companies Analysis

   Comparable public companies were identified and their selected financial information with public multiples was compared. The companies were selected based on the advisor’s professional judgement using the following criteria: publicly traded firms in similar lines of business to Splunk and with similar business models and/or financial performance. Where needed, consensus estimates were based on 3rd party research. Using this information, the advisor compiled the following Revenue and LFCF multiples shown in the tables below.

   

   

   From here the advisor selected a representative range Revenue Multiple of 4.0x to 7.0x and a LFCF multiple of 15.0x to 27.0x to be applied to Splunk’s Financial Projections and dividing by the fully diluted shares outstanding to arrive at a per-share valuation for Splunk, summarized below:

   

   Note how the final offer price of $157 per share is much closer to the upper bounds of the EV/Revenue Multiple ranges, and roughly at the midpoint of the Baseline Management Projection for EV/LFCF multiple.

3. Analysis of Comparable Transactions

   68 public company transactions were selected for comparison to Splunk based on similar lines of business involved, similar business models and similar financial performance. For each of these transactions, they evaluated

   1. Enterprise Value as a multiple of consensus revenue targets for “next twelve months” (the “NTM Revenue Multiple”).

   2. Enterprise Value as a multiple of EBITDA consensus estimates for the next twelve months (the “NTM EBITDA Multiple”)

   3. Equity value as a multiple of consensus estimates of Levered Free Cash Flows (the “NTM LFCF Multiple”)

      Here is a list of the 68 transactions included in their analysis.

      

      

      

      

      Based on these 68 comparable transactions, the advisor selected a representative range of multiples to be applied to Splunk’s financial projections. The ranges selected were: NTM Revenue Multiple of 4.5x to 8.0x, NTM EBITDA multiple of 18.0x to 34.0x and an NTM LFCF multiple of 20.0x to 32.0x. This gave the following output estimates for Splunk’s value:

      1. NTM Revenue Multiple: Splunk value range is $97.37 to $178.26 per share

      2. NTM EBITDA Multiple: Splunk value range is $88.22 to $172.96 per share

      3. NTM LFCF Multiple: Splunk value range is $107.27 to $171.63 per share

      Note how the $157 offer is closer to the upper bound in each of these ranges based on prior comparable transactions. By this method, Cisco’s offer seems fair.

Some final thoughts for consideration

In this case, we have analyzed Cisco’s acquisition of Splunk for $28 billion or $157 per share. For Cisco, there was a strong strategic rationale for the deal. Splunk would complement their product offering in the increasingly competitive cybersecurity and observability segments. It would also fit nicely into their strategy of focusing on higher growth software subscription offerings. Splunk would also benefit by rapidly getting access to a global sales team that could boost their presence in international markets. To a large degree, Cisco and Splunk’s customers overlapped and there was a compelling case for these sales synergies.

The deal itself was not easy to close. The process took 21 months from initial indication of interest to final offer and another several months after before shareholders could vote their approval. Several key lessons were learned along the way (summarized in the transaction timeline). Advisors played a strong role for both buyer and seller to ensure a structured and logical process and price were negotiated.

Nevertheless, the Management Projections that were used as the basis for valuation analysis may have been too conservative. Given Splunk’s strong track record (10x revenue growth in prior decade) plus their market leading position in a high growth sector, at least one “optimistic scenario” should have been included in the analysis. By excluding this, they may have left a lot of money on the table. Market timing impacted the price paid. Cisco’s offer, though non-binding, was $212 at its highest point. The final agreed price was $157. Had an “optimistic scenario” been included in the Management Projections, the final price could have been higher.