A hypergrowth SaaS business flying under the radar
I’d like to share some thoughts about Dropsuite (DSE AU), an ASX listed software business. While it has been a tough year for markets (especially the tech sector), Dropsuite has been a relative outperformer. I’m excited to share some of my perspectives on Dropsuite and why I’m bullish about their future.
What is Dropsuite?
Dropsuite is a global cybersecurity SaaS business that operates within the cloud backup and recovery market, which is an industry that has been growing at 24% annually and is expected to reach US$22b by 2025. Dropsuite mainly sells data backup and archiving solutions for productivity applications such as Microsoft 365 (M365), Google Workspace and email. Dropsuite’s products are targeted at the SMB segment, and they sell their product entirely through channel partners such as managed service providers (MSPs) and IT distributors.
Why Dropsuite?
What makes Dropsuite such an attractive investment is its strong financial profile. Dropsuite is one of the fastest growing SaaS businesses globally, having grown annualized recurring revenue (ARR) organically at a 75% CAGR over the last 3 years. In addition to being a hypergrowth business, Dropsuite is also profitable with a 5% net operating margin in 1H22 (inclusive of SBC) and expectations for margin expansion going forward.
Prior to expanding on Dropsuite’s attractive business qualities, I’d like to address one of the key questions I usually get about the business: why are backups needed in the cloud?
Why do you need backups in the cloud?
It is a common misconception that SaaS solutions do not require backups. While most SaaS applications have disaster recovery measures in place from a platform delivery perspective, they do not guarantee the recovery of their customer’s data. Microsoft’s Service Agreement Clause 6b notes the following:
‘…online services suffer occasional disruptions and outages and Microsoft is not liable for any disruption or loss you may suffer as a result. In the event of an outage, you may not be able to retrieve Your Content or Data that you’ve stored. We recommend that you regularly backup Your Content and Data that you store on the Services or store using Third-Party Apps and Services.’
The major cloud vendors operate under the “shared responsibility model”, which is a framework that helps separate the vendor’s responsibilities from the user. As shown in the exhibit below, customers are still responsible for their own data, even in fully managed SaaS environments. A helpful analogy of the shared responsibility model is the relationship between a landlord (SaaS or cloud vendor) and a tenant (user). The landlord is responsible for providing and maintaining the home and associated infrastructure, while the tenant is responsible for their own personal content within the home. In the same way that a landlord is not responsible if a tenant were to damage or misplace a personal item within their property, cloud providers are not responsible for the customer’s personal information and data within the cloud. Therefore, this is a critical reason why third-party cloud/SaaS backups are needed and recommend by the major cloud/SaaS providers.
Because of this misconception around SaaS applications and backups, data loss within the cloud is a common occurrence. In a 2019 survey by Veeam (exhibit below), 80% of respondents indicated that they experienced data loss while in the cloud. The businesses that do not backup their SaaS applications put themselves at risk of data loss, which can have financial, reputational and/or regulatory ramifications.
In addition to providing protection against data loss, backups are critical for defending organizations against cybersecurity threats such as ransomware. Ransomware is a form of malware that takes control of an organizations critical files or systems, encrypts them and renders them useless. The bad actors then demand payment from the victim organization, forcing them to pay a ransom to decrypt their data to prevent further business disruption. Ransomware has seen tremendous growth over the last few years, with Verizon indicating that ransomware was used in 25% of all breaches in 2021 (see exhibit below). Zscaler cited an 80% year-on-year increase in ransomware attacks as of Mar-22, while Palo Alto state the average ransom payment from their clients increased by 78% to US$541K in 2021. A critical way for organizations to protect themselves against ransomware is to have ongoing cloud-based backup solutions to access uninfected versions of their data so that they can continue to operate undisrupted.
Therefore, in summary, there are three key reasons why you need backups in the cloud:
Because the cloud says so;
To protect yourself against data loss, which is a common occurrence within the cloud; and
To provide protection against ransomware and other cyberthreats.
Now that we have covered the basics of why SaaS backups are critical, I’d like to discuss some of the qualities that makes Dropsuite such an attractive investment.
Quality 1: Hypergrowth
Dropsuite has been able to grow at such a high rate due to the multiple structural trends that are driving overall growth in their end-markets. These include:
Large and growing addressable market
Dropsuite is primarily used to backup M365 environments. M365 is the world’s leading SaaS solution, with Microsoft having close to ~370 million commercial M365 seats as of Sep-22. Despite this large install base, Microsoft are still growing their commercial seats at 14% per annum. This large and growing M365 install base is Dropsuite’s addressable market, and the fact that this large end-market is still growing at 14% presents a nice baseline for Dropsuite’s growth. As of Sep-22 I estimate that Dropsuite has c.0.23% penetration of the total M365 commercial install base, which is up 3.4x in three years.
Low levels of SaaS backup adoption - mostly whitespace
In addition to a large and growing addressable market, the majority of M365 seats do not have 3rd party backups. This is primarily due to the misconception that SaaS products have backups. A recent IDC survey indicated 6 out of 10 M365 users did not backup their email and collaboration environments (i.e., 40% penetration of backup). I believe that IDC’s survey was skewed to enterprise users. In my view, adoption of M365/email backup solutions in the SMB space is even lower than the number IDC stated above. Over the past year I have spoken with numerous SaaS backup vendors, software distributors and MSPs that have indicated that the adoption of SaaS backup within their SMB client base is closer to 15-20%, which indicates significant runway for backup to grow.
Proliferation of cyberattacks and ransomware
A recent survey by ConnectWise indicated that 76% of surveyed SMBs had suffered at least one cyberattack, up from 55% in 2020. Cybersecurity is a data problem, and a critical step for organizations to protect themselves against cyberattacks is to have access to secure, uninfected versions of their data to ensure business continuity.
Growth in the MSP industry
Dropsuite sells their product through MSPs. The MSP industry continues to experience strong growth as businesses increasingly outsource their IT operations to specialists. Independent reports suggest the MSP industry grows at 3-4x the overall IT market as they continue to take share of total IT spend. This acts as an additional baseline for Dropsuite’s growth.
Increased adoption of cloud-based SaaS applications
While M365 seats continue to grow, the strong growth in the hundreds of other non-M365 SaaS apps (i.e., CRM, accounting software, Zoom/Slack) means that businesses are storing an increasing amount of critical data and IP within these cloud environments. This creates a need for organizations to ensure their IP residing within these environments is protected and retained, which will drive further adoption of 3rd party backup solutions.
Increased data related compliance and regulation
Increased complexity with regards to data sovereignty requirements and legislation around data retention and archiving drives adoption of sophisticated backup solutions (like Dropsuite’s) that are fully GDPR compliant and make it easier for account administrators to manage data retention policies.
Quality 2: World-class unit economics and channel program
One of Dropsuite’s key competitive strengths is its world-class channel program that it has fostered over the years. Dropsuite sells its products entirely through its +3,000 channel partners. It is no easy feat to establish a strong channel program, as it takes significant amount of time and investment to build relationships with distributors and partners (i.e., it can take 18 months for new software vendors to get onboarded with a distributor), whilst it also requires extensive product development to ensure product-market-fit both at the end user and the partner level. Dropsuite’s strong channel program and product-market-fit is what powers its world-class go-to-market efficiency.
While many high growth SaaS businesses regularly spend 40-50% of revenue on sales and marketing, my analysis indicates that Dropsuite spent 16% of its revenue on sales and marketing in 2021 and 21% in 2020 (i.e., 25% of employee expenses plus advertising costs, despite sales and marketing staff accounting for less than 15% of total headcount). This efficiency is best measured by CAC payback, which measures how long it takes for a company to earn back the costs spent on acquiring new business. The lower the number, the more efficient the company. In 2021, Dropsuite had a CAC payback of 7.6 months, and I expect their 2022 payback to fall to 6.9 months. The chart below benchmarks Dropsuite against several leading Australian and global SaaS businesses, as well as a select group of leading cybersecurity/infrastructure SaaS businesses. Out of the group below, Dropsuite is second only to WiseTech, which itself boasts some of the strongest unit economics of any software business globally. (Note: For simplicity, CAC payback below is calculated as total GAAP/IFRS sales and marketing spend divided by net new GAAP/IFRS gross profit, converted into months).
With such attractive returns on sales and marketing spend, I’m excited for Dropsuite’s future growth prospects as they continue to invest in the channel and expand into new regions.
Quality 3: Market leading product
My discussions with several Dropsuite users, partners and competitors indicate that Dropsuite has a market leading M365 backup solution within the SMB space. Dropsuite was preferred for several reasons:
Industry leading cloud email backup and archiving features (i.e., highest number of daily backups, highest data capacities)
Superior UI for both users and partners
Seamless integrations and ease of implementation
Superior discovery and search capabilities
Strong compliance features due to archiving capability
Very easy to use and simple
A cloud native backup solution
Strong customer support at both the account management and technical support level
Simple à la carte pricing
Dropsuite has also been ranked as the market leading email backup solution by SoftwareReviews for three consecutive years, beating out well-funded, enterprise-grade competitors such as Veeam, Mimecast, Commvault (Metallic) and OpenText (CloudAlly).
Quality 4: Strong financial profile
Dropsuite’s product strengths and structural tailwinds results in an attractive financial profile. A key metric that neatly demonstrates Dropsuite’s financial strength is the Rule of 40. The Rule of 40 is a popular SaaS metric which adds a company’s revenue growth to its free cash flow margin, with 40% being a key benchmark. It is a metric that shows the delicate balance between reinvestment and growth. For instance, if a SaaS business has 0% revenue growth, it should be generating at least 40% free cash flow margins in order to achieve the Rule of 40. As shown in the comps sheet below, the average Rule of 40 for the leading infrastructure software and cybersecurity companies is 40. In 2022, Dropsuite will operate on a Rule of 81 (2021: Rule of 68), with 77% revenue growth and a 4% underlying free cash flow margin.
In addition to the Rule of 81 and strong unit economics, I’d like to highlight a few other financial features of the business and present a financial model below:
Capital-lite business: As Dropsuite highlighted in their recent investor day, they are a very capital-lite business. Dropsuite has raised a total of $35m in capital since inception but have only spent $12.7m of this capital ($22.3m in cash as of Sep-22). Dropsuite now has a $102m enterprise value with only $12.7m of external capital deployed to-date.
Low churn: Dropsuite’s annual revenue churn has remained consistently below 3%. Churn of sub-3% is considered excellent for an enterprise SaaS business, so it is quite impressive considering Dropsuite services the SMB sector.
Net Revenue Retention (NRR): Dropsuite could not achieve this type of hypergrowth without a solid NRR (revenue generated from existing partners). At their AGM, they indicated that their partner NRR was >125%, which is close to world-class.
Gross Margins: Given Dropsuite must store extensive amounts of data, its gross margins are lower than typical SaaS businesses, with 66% gross margins as of Sep-22. As Dropsuite continues to scale, we see a pathway for them to reach margins in the mid-70s, similar to backup/infrastructure peers such as Datto, Box Inc and Dropbox. Dropsuite can achieve this from further scale benefits and adopting multi-cloud and/or hybrid cloud architectures.
My forecasts assume a moderate slowdown in ARR growth (CY15-21 +77% CAGR; CY22-25 +40% CAGR) due to a meaningful slowdown in the rate of Dropsuite’s net-new user adds (chart below). I also forecast little success from Dropsuite’s new products, despite the indications from management that they would launch 1-2 new products per year. There’s further upside if Dropsuite can continue to scale their net-new-adds growth at historical levels, conduct value accretive M&A, and launch new products.
Valuation - potential 3-4x within the next few years
With such a strong financial profile (plus 18% of its market cap in cash) and attractive structural tailwinds, I think the business is significantly undervalued on its current valuation of 3.9x ARR or 0.1x growth-adjusted ARR. Looking out two years to CY25, I forecast Dropsuite will generate +$70m of ARR. If you assume a 25% normalized FCF margin and a 4-5% FCF yield, I believe the business will be worth 3-4x its value today (Note: comps average FCF yield of 3.2% with 23% growth). The 3-4x scenarios imply EV/ARR multiples of 5.0x-6.3x for a profitable business growing +30%, which I believe isn’t excessive given recent M&A transactions (i.e., Datto acquired for 9.3x trailing revenue, with only 18% growth).
Potential catalyst: accretive acquisition on the horizon
In Aug-21 Dropsuite raised A$20m of equity for the purpose of conducting acquisitions. Since then, technology valuations have declined materially and Dropsuite have still not completed an acquisition. While most investors are generally wary of acquisitions and synergies (rightfully so), I believe software acquisitions can be highly value accretive. A key reason why a potential acquisition by Dropsuite could be value creative is because Dropsuite already has global distribution with +3,000 partners that will allow it to accelerate the growth of the acquired products.
I think Dropsuite has an opportunity to acquire an adjacent security related solution and scale it across their existing channel base. I have spoken with several of Dropsuite's leading distribution partners that have spoken highly of Dropsuite and have indicated that they would be highly receptive to future product launches by Dropsuite.
Management
Dropsuite is led by a solid and well tenured management team. CEO Charif El-Ansari (ex-Google) has been managing the business since 2013, while COO Ridley Ruth (ex-Cloudflare) has been with the business since 2014. Dropsuite have also recently announced some key hires, with CTO Manoj Kalyanaraman (ex-BitTitan, Intuit) joining in Mar-22 and Eric Roach (ex-Nextiva, Microsoft) joining as SVP of Global Channel in Nov-22.
I am particularly impressed with Charif and how he has been able to build a global business, with a world-class channel program whilst also remaining disciplined with regards to capital allocation. As you’re all probably aware, capital efficiency has not been a term commonly used within the tech sector over the last few years! I am also impressed with management’s ability to manage crisis’ and continue to position the business for growth. In 2018 Dropsuite’s business primarily revolved around providing website backups. At the beginning of 2019, Dropsuite’s largest partner (a domain hosting business) announced it would be launching its in-house backup product, which resulted in 31% of Dropsuite’s revenue being lost in a span of 9 months. Despite this, management were able to accelerate their pivot into the fast-growing and more stable email backup and archiving market and still managed to finish 2019 with ARR growth of 13%.
Risks
As with any investment, there are always risks both known and unknown that may materialize. Some of the risks to Dropsuite's business include:
Microsoft Ecosystem Risks: There is a risk that Microsoft could launch their own SaaS backup service. While I view this as unlikely, it presents some headline risk to Dropsuite. However, even if Microsoft were to launch their own product, I still believe Dropsuite will continue to thrive. The main reason is that in Dropsuite’s end-market, MSPs are the gatekeeper. The MSPs are the ones that decide which products to present to a client and clients generally accept the product mix that MSPs present given they pay MSPs for their technological expertise. So, I don’t think a native Microsoft backup solution will result in the demise of 3rd party backup products. There is already precedent for this scenario, for instance, Microsoft have a native Azure Backup solution, but my discussions with distributors indicate that they mostly sell 3rd party cloud backup solutions because MSPs want to diversify vendor exposure. Also, the channel is incentivized by margins and Microsoft’s product margins are well known to be low. Therefore, MSPs will continue to bundle 3rd party solutions into their product offerings in order to generate better margins.
Point solution: Dropsuite is mostly a point solution, which can present a high deal of risk given they lack revenue diversity from a product perspective. This can present risks as larger vendors aim to consolidate products as part of their go-to-market. Some larger vendors already do this today, but Dropsuite has been able to continue grow thanks to their seamless integrations into MSPs practice management solutions such as ConnectWise and Autotask, which allows MSPs to choose best-of-breed solutions rather than experience vendor lock-in. Dropsuite’s plans for further product launches and acquisitions will allow them to diversify their product mix.
Competition: Dropsuite operates in a competitive market. Dropsuite have been able to grow share within this market due to their product-led growth and strong investments in the channel. Despite this, Dropsuite will need to continue investing in their product and the channel in order to maintain their market position.
Damage to partner relationships: It is critical that Dropsuite maintains strong relationships with their distributors and MSPs. In my discussions with distributors, it is extremely rare that a software distributor kicks a vendor off their pricelist, so I do not think a distributor ceasing to sell Dropsuite is a likely scenario. However, Dropsuite will still need to continually invest in the channel to ensure they meet the channels needs from a product and capability perspective.
Macroeconomic headwinds: A slowing macro environment typically results in growth headwinds like extended sales cycles and higher churn. Depending on how bad the macro picture gets in 2023, this will present some growth risks to Dropsuite. However, the MSP industry tends to be less macroeconomically sensitive than other parts of the economy given IT spending is basically infrastructure for most businesses today. During the GFC many MSPs thrived (source & source).
I hope you found this post insightful. This is my first post and I intend to publish articles on investing, markets, and tech periodically. I’m always eager to have a chat so please comment, or reach out if you have any thoughts/questions, or even if you just wanted to chat on investing & markets more broadly!
This is not financial advice. The opinions expressed are my own.