Why We’re Avoiding Sumo Logic Stock
Table of contents
IPOs are coming out of the woodwork in a heated market that defies the imagination. There has been an unprecedented loss in productivity around the globe, yet the markets continue soaring to new highs. In the words of Mr. Dickens, “it was the best of times, it was the worst of times.”
It’s always a challenge figuring out which IPOs are worth writing about when you consider that it’s probably worthwhile to let the dust settle before investing in any of them. Today, we’re going to look at Sumo Logic’s proposed initial public offering as they seem to be doing something similar to Splunk (SPLK), a stock we’ve said some pretty favorable things about.
About Sumo Logic
Founded in 2010, Silicon Valley startup Sumo Logic raised $340 million in funding from big names like Sequoia, DFJ, and Franklin Templeton (one of our core dividend growth stock holdings). The first two sentences of Sumo Logic’s S-1 filing should tell us what this company does, but fail miserably in that respect.
Sumo Logic empowers organizations to close the intelligence gap. Sumo Logic is the pioneer of Continuous Intelligence, a new category of software, which enables organizations of all sizes to address the challenges and opportunities presented by digital transformation, modern applications, and cloud computing.
The only people who might be able to interpret this buzzword bonanza are the same type of people who wrote it – MBAs. Let’s start at the top.
Classifying Enterprise Software
Enterprise software is what it says on the tin – software that businesses sell to other businesses. Right now, the fastest-growing category of enterprise software is robotics process automation (RPA). The appeal of RPA is that it saves organizations a tremendous amount of money, something that’s an easy sell in bull markets and an even easier sell in bear markets. Since the investment thesis makes sense, we can then turn to the MBAs over at Gartner who do nothing but evaluate vendors to establish who the leaders are. If there’s a publicly traded pure-play stock in the leadership square for Gartner’s RPA Magic Quadrant, we would look to invest in it – which we did.
So, let’s review the steps we take when evaluating various types of enterprise software as an investment thesis.
- Find category of enterprise software that’s compelling
- Establish who the leaders are
- Select the most appealing publicly-traded leader
- Dollar-cost-average our way into a position
Let’s walk through these same set of steps for another category of enterprise software – security information and event management (SIEM).
Security Information and Event Management
Our previous article on Splunk talked about their “data to everything platform” which can collect and index petabytes of machine data daily, irrespective of format or source. This falls squarely in the SIEM domain, something Gartner defines as having three primary use cases:
- Automated threat detection
- Basic security monitoring
- Investigation and incidence response
Anyone who has served hard time in some of the world’s most infamous large corporations would recognize this nomenclature.
The first two use cases largely serve to provide some CYA (an acronym for cover your ass) so that your firm doesn’t end up on the cover of tomorrow’s Wall Street Journal because some Eastern European hacker group is selling your customer list on the dark web.
The third use case provides more CYA so that you can provide sufficient detail to senior management when something goes pear-shaped. Splunk accomplishes all of this by processing something called “machine data,” basically the data exhaust that results from running loads of enterprise apps in an organization.
Now that we understand the usefulness of SIEM, here’s where Splunk sits relative to other SIEM vendors according to the MBAs over at Gartner.
In that same report, Gartner talks about how the SIEM market is mature and competitive:
The SIEM market is characterized by a relatively small number of vendors that have large customer bases, and others with smaller, but rapidly increasing customer bases.
We’re risk-averse investors, so we prefer the small number of vendors with large customer bases and high retention rates. Splunk fits that bill. Consequently, Splunk would be our preferred way to invest in the SIEM theme.
A Second Opinion
Additional support for our Splunk investment thesis comes from ARK Investment Management, a leading institutional disruptive technology investor. Splunk is the 21st of 47 holdings in the ARK Disruptive Innovation ETF. Back in 2015, Ark published a research piece on Splunk which we’re shamelessly leveraging five years later to avoid having to do the analysis ourselves. The piece talks about how big data is increasing exponentially, and the proportion of that data that’s useful is also increasing. That’s because hardware is becoming more affordable and software is becoming more sophisticated. (Using machine learning for predictive analytics would be a good example of the latter.) Says the piece:
Splunk’s addressable market will be in the hundreds of billions of dollars by 2020. Its revenue and market share growth, despite premium pricing, speaks to the value of its platform. Splunk is on pace to surpass $2.5B annual revenue in 2020, a five fold increase above its 2015 projections, while only penetrating 1% of its addressable market.
Credit: ARK Investment Management
That’s a pretty good prediction when you consider that five years later, Splunk’s actual 2020 revenues came in at 2.36 billion.
If this same analyst is correct regarding a $250 billion total addressable market, then Splunk has lots of room left to grow.
(You’re probably wondering why an article about Sumo Logic hasn’t really said anything about Sumo Logic. You’ll see why in a second, promise.)
What Would You Say, You Do Here?
Getting back to the Gartner report on SIEM vendors, we see a blurb that mentions Sumo Logic along with a handful of other vendors that “didn’t meet the inclusion criteria for the research.” Now we can understand why Sumo Logic defines what they do as “a new category of software,” though the closest class of enterprise software they belong to would probably be SIEM. Since we already see Splunk as a leader in SIEM and a compelling stock to invest in, we don’t see the need to even consider investing in Sumo Logic stock.
One might argue that holding stock in both Sumo Logic and Splunk would provide some diversification benefits. Indeed it would. While we’re constantly preaching the merits of diversification, we’re more interested in taking active bets when it comes to building the Nanalyze Disruptive Tech Stock Portfolio (coming soon for Nanalyze Premium subscribers). We want to pick the leaders in their space with business models that we can understand, strong revenue growth, and lots of room for future growth. We want to keep that list of names short so we can easily track our portfolio’s constituents.
Conclusion
Investing in a SIEM vendor is essentially an investment in machine learning and big data. An ever-increasing amount of data exhaust emanated by organizations can be mined for actionable insights. Similar to how we assessed the RPA vendor space, we want to find the most compelling leader in the SIEM vendor space, and then dollar-cost-average our way into a long position. Based on our findings, we would avoid investing in Sumo Logic stock and look at buying Splunk stock instead.
Share
SIEM represents a small part of revenue although it’s growing fast. Log analytics is where the bulk of $ comes from. In the case of Sumo Logic, they just entered SIEM by buying Jask last year …
Thank you for taking the time to comment. This is a good distinction you’ve raised. The below was taken from Sumo Logic’s article on the difference between log analytics and SEIM (https://www.sumologic.com/glossary/siem-log/)
“SIEM software tools combine the functionality of three types of legacy security monitoring tools: SEM, SIM and SEC. Log management systems are very similar to SEM tools, except that while SEM tools were purpose-built for cyber security applications, LMS tools are more geared towards the needs of someone in a systems analyst role who might be reviewing log files for a purpose besides maintaining security.”
Your comment about Sumo Logic’s growing SEIM revenues implies that they may eventually end up on the Gartner SEIM Quadrant. Unless they’re ranked higher than Splunk, our thesis would still hold.
We just checked and to see if there’s a separate Magic Quadrant for log management (or something close to that) and didn’t find anything. While researching this piece, we didn’t find any other quadrant that Sumo Logic appeared on which is why we used the SEIM quadrant for our analysis.
Thank you again for raising this.