Summary
This summary highlights selected information contained elsewhere in this prospectus. This summary does not contain all the information that you should consider before deciding to invest in our ordinary shares. You should read the entire prospectus carefully, including “Risk Factors” and our consolidated financial statements and notes to those consolidated financial statements, before making an investment decision. In this prospectus, the terms “Tufin,” “we,” “us,” “our” and “the company” refer to Tufin Software Technologies Ltd. and its subsidiaries.
We are pioneering a policy-centric approach to security and IT operations. We transform enterprises’ security operations by helping them visualize, define and enforce a unified security policy across complex, heterogeneous IT and cloud environments. Our products govern how individuals, systems and applications are permitted to communicate and provide policy-based security automation, enabling customers to reduce the time to implement complex network changes from days to minutes. Our solutions increase business agility, eliminate errors from manual processes and ensure continuous compliance through a single console. Since our inception, our solutions have been purchased by over 2,000 customers in over 70 countries, including approximately 15% of the Global 2000.
Cybersecurity is critical for enterprises of all sizes. As enterprises embrace digital transformation and adopt new technologies such as cloud-based services, software-defined networks, microservices and containers, the IT and cloud environments become increasingly complex and vulnerable to attack. In response to the heightened threat environment, lack of a defined network perimeter and a constantly changing attack surface, enterprises continue to implement additional firewalls, endpoint security, identity and access management and other security solutions. However, we believe most enterprises lack effective and comprehensive security policy management, which results in a trade-off between the necessary security posture and business requirements for speed, agility and innovation.
We believe a new approach to enterprise security is necessary: a data-driven framework centered on policy management and operationalized through policy-based automation, enhancing compliance and security while improving operational efficiency. To address this need, we have developed highly differentiated technology with four main pillars:
We offer five products that comprise the Tufin Orchestration Suite: SecureTrack, SecureChange, SecureApp and, most recently, Orca and Iris. SecureTrack, SecureChange and SecureApp enable enterprises to visualize, define and enforce their security policy across heterogeneous networks, both on premise and in the cloud. SecureTrack serves as the foundation of SecureChange and SecureApp. SecureTrack provides visibility across the network and helps organizations define a unified security policy and maintain compliance. SecureChange provides customers with the ability to automate changes across the network while maintaining compliance with policy and security standards. SecureApp provides application connectivity management and streamlines communication between application developers and network engineers. Our newest products, Orca and Iris, provide cloud-based security automation solutions in response to the growth of containers and cloud-native environments.
We sell our products and services through our sales force, including our field sales team and our inside sales team, which works closely with our global network of approximately 140 active channel partners. Our channel partners include distributors and resellers, as well as service delivery partners that help customers successfully deploy, configure, customize and maintain our products and services.
We have experienced strong growth. For the years ended December 31, 2017 and 2018, our revenues were $64.5 million and $85.0 million, respectively, representing year-over-year growth of 31.7%. For the years ended December 31, 2017 and 2018, our net loss was $2.8 million and $4.3 million, respectively.
Enterprises that lack a comprehensive security policy are facing challenges in balancing the necessary security and risk posture with their business requirements, leaving security, network and compliance professionals overwhelmed. Several industry trends contribute to operational challenges in managing risk, as set forth below:
Our solutions enable our customers to visualize, define and enforce a security policy that dictates how users, systems and different organizational functions across the enterprise should be allowed to communicate. We automate our customers’ security policy management, allowing them to accelerate application deployment time without introducing non-compliant changes that could lead to vulnerabilities, and giving better visibility and control over all of their IT and cloud environments. This approach drives business agility and cost reduction while facilitating continuous compliance across hybrid, multi-vendor, multi-platform and heterogeneous environments. Our customers use our products to:
We believe the majority of enterprises lack effective and comprehensive security policy management, which is critical to controlling network change. As digital transformation creates more complexity within IT and cloud environments, we believe our policy-centric, automated solutions will garner a growing share of enterprise security spend. In its September 14, 2018 publication Forecast Analysis: Information Security, Worldwide, 2Q18 Update, Gartner estimated that worldwide spending on information security products and services will reach more than $133 billion in 2019. In addition, 451 Research LLC’s VotE Information Security: Workloads and Key Projects 2018 study, covering 550 organizations of different sizes across 10 industry verticals, found that 83% of the companies surveyed did not have security automation and orchestration technologies in place, but 54% of those companies planned to deploy such technologies within the next 24 months. We believe increased security spending and adoption of security automation and orchestration technologies represent a significant opportunity for us.
We also believe our policy management and automation solutions overlap with several markets defined by IDC. IDC has estimated that:
We believe that our solutions will attract a meaningful portion of these markets, resulting in a multi-billion dollar addressable market. As we continue to innovate and introduce new products, the use cases for our solutions will expand, which we expect will lead to incremental growth in our addressable market opportunity.
We believe our policy management and automation functionalities define a new market, and we are not aware of any third-party research that accurately defines the scope of our directly addressable opportunity. As such, we estimated the market size using third-party data and, when third-party data was not available, internal estimates. We segment enterprises based on estimates of their network infrastructure size and their need for our solutions across their networks, and apply an average annual billings figure per segment based on an estimated prior five years of inventory, resulting in an estimated directly addressable market of $10.3 billion, which includes on-premise firewalls, private cloud and public cloud orchestration segments, for the fiscal year ending December 31, 2019.
We believe we have several competitive advantages, including:
and our professional services team who develop scripts and extensions on top of the Tufin Orchestration Suite.
Investing in our ordinary shares involves risks. You should carefully consider the risks described in “Risk Factors” beginning on page 12 before making a decision to invest in our ordinary shares. If any of these risks actually occurs, our business, financial condition and results of operations would likely be materially adversely affected. In such case, the trading price of our ordinary shares would likely decline, and you may lose all or part of your investment. The following is a summary of some of the principal risks we face:
We are incorporated under the laws of the State of Israel. Our principal executive offices are located at 5 Shoham Street, Ramat-Gan 52521, Israel, and our telephone number is +972 (3) 612-8118. Our website address is www.tufin.com. Information contained on, or that can be accessed through, our website does not constitute a part of this prospectus and is not incorporated by reference herein. We have included our website address in this prospectus solely for informational purposes. Our agent for service of process in the United States is Tufin Software North America, Inc., located at 2 Oliver Street, Suite 702, Boston, Massachusetts 02109-4901, and its telephone number is +1 (877) 270-7711.
Throughout this prospectus, we refer to various trademarks, service marks and trade names that we use in our business. The “Tufin” design logo is the property of Tufin Software Technologies Ltd. Tufin® is our registered trademark in the United States. We have several other trademarks, service marks and pending applications relating to our products. In particular, although we have omitted the “®” and “™” trademark designations in this prospectus from each reference to Unified Security Policy, Tufin Orchestration Suite, SecureChange, SecureTrack and SecureApp, all rights to such trademarks are nevertheless reserved. Other trademarks and service marks appearing in this prospectus are the property of their respective holders.
The number of ordinary shares to be outstanding after this offering is based on 37,054,542 ordinary shares outstanding as of February 15, 2019. The number of ordinary shares to be outstanding after this offering excludes (1) ordinary shares reserved for issuance under our equity incentive plans, of which there were outstanding options to purchase shares at a weighted average exercise price of $ per share, and (2) 40,000 ordinary shares underlying warrants issued to an Israeli non-profit organization with an exercise price of $2.868 per share.
Unless otherwise indicated, this prospectus:
The following tables set forth our summary consolidated financial data. You should read the following summary consolidated financial data in conjunction with “Selected Consolidated Financial Data,” “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our consolidated financial statements and related notes included elsewhere in this prospectus. Historical results are not necessarily indicative of the results that may be expected in the future. Our financial statements have been prepared in accordance with U.S. Generally Accepted Accounting Principles, or U.S. GAAP.
The summary consolidated statements of operations data for each of the years in the two-year period ended December 31, 2018 and the summary balance sheet data as of December 31, 2018 are derived from our audited consolidated financial statements appearing elsewhere in this prospectus.
For a description of how we use non-GAAP operating profit (loss) to evaluate our business, see “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Key Factors Affecting Our Performance.”
Other companies, including companies in our industry, may calculate non-GAAP operating profit (loss) differently or not at all, which reduces the usefulness of non-GAAP operating profit (loss) as a comparative measure. You should consider non-GAAP operating profit (loss) along with other financial performance measures, including operating profit, and our financial results presented in accordance with U.S. GAAP.