Cybereason reportedly has ditched its initial public offering (IPO) plans and instead is looking for a buyer. One analyst says it’s a good acquisition target and could draw interest from a number of potential suitors.

According to The Information, citing a person with direct knowledge of the matter, the Israel-based company has hired JP Morgan Chase to find a buyer. Cybereason is valued at $2.5 billion by investors including Google, SoftBank and ex-Treasury Secretary Steve Mnuchin’s private equity firm.

According to a Cybereason spokesperson, the company has a policy of not commenting on market rumors.

Early this year, Cybereason reportedly filed for an IPO at a valuation of $5 billion. It reportedly finalized underwriters for its IPO and expected a launch during the second half of this year.

However, in June, Cybereason announced layoffs impacting 10% of its workforce in Israel, the United States and Europe. At the time, the company said “as the bullish tech market conditions have turned and the tech IPO market has essentially closed, companies like us must now exercise more strict financial discipline and prioritize profitability over top-line growth.”

Cybereason Acquisition Could Be Advantageous to Many

Rik Turner is principal analyst at Omdia, which shares a parent company with Channel Futures (Informa). He said Cybereason would be a good acquisition target.

Omdia’s Rik Turner

“Cybereason was among the first trailblazers in endpoint detection and response (EDR), the so-called three Cs and an S, i.e. Carbon Black, CrowdStrike, Cybereason and SentinelOne,” he said.

CrowdStrike and SentinelOne already IPOed “quite successfully” and appear to be going from strength to strength, Turner said. And VMware acquired Carbon Black. That left only Cybereason as a privately-held, dedicated player.

“Though of course it has made moves in the direction of extended detection and response (XDR) … it’s still definitely an EDR vendor with broader ambitions rather than an established XDR player,” he said.

Someone that has extensive, complementary detection and response capabilities in network (NDR) and/or cloud would make sense as the buyer, Turner said.

“Folks like Gigamon or ExtraHop, though I’m not sure either of them has the war chest needed for such an acquisition,” he said. “Perhaps a cloud security pureplay wanting to add an endpoint dimension? Neither Orca nor Wiz are particularly acquisitive vendors. But that might be a useful marriage of technologies. Palo Alto Networks is very acquisitive, but not sure they would be interested in buying further endpoint security technology, given that they already have the Traps technology, even though I still think this is a bit of an underperforming part of their portfolio.”

Open XDR Vendors Could be Among potential Suitors

Cisco, too, is already far too invested in its own endpoint security for a Cybereason acquisition, Turner said. Maybe Check Point Software Technologies or Fortinet, each of whom have endpoint security technology, but are “hardly in the market-leading category.”

“Alternatively, it could be someone from the open XDR world, i.e. a vendor that has the back-end brain of the octopus, but none of the tentacles, as Cybereason would enable it to offer its own endpoint security agents for collecting the telemetry, thereby starting to move towards a more hybrid XDR stance,” he said. “Not sure any of the open XDR players have the cash to make such an acquisition, however, as I don’t think Cybereason will come cheap.”

From Cybereason’s perspective, an acquisition would obviously be an exit route for the company’s venture capitalists, while technologically it could represent a way to “turbo-charge its journey from EDR to XDR and, who knows, even further in the world of broad-based security portfolios,” Turner said.