Description

This will be a short write-up for what is admittedly a tactical trade. 

On Tuesday, Brian Krebs of Krebs security published a whistleblower's account of an earlier disclosed, but downplayed, breach of Ubiquiti Networks. https://krebsonsecurity.com/2021/03/whistleblower-ubiquiti-breach-catastrophic/ We urge members to take a look at some of the accounts published in the tech press including this Arstechnica piece https://arstechnica.com/gadgets/2021/03/ubiquiti-breach-puts-countless-cloud-based-devices-at-risk-of-takeover/. 

We have followed the wireless and wireless ISP market for years with interest and have been bullish or bearish on Ubiquiti and Cambium at different points. UI is the 800lb gorilla in SMB / SME wireless access points, switches and routers for those that are willing to go the more DIY route. They have big presence in hospitality education startups and other markets and have an active evangelist community. Ubiquiti and Cambium also sell gear to wireless ISPs (WISPs) that are basically predominantly rural operators willing to rely on wireless broadband with lower service levels and reasonably frequent outages. The company has grown like a weed and is being rewarded in the markets with a 30x multiple on FY21 estimates, that assume demand stays at astronomical levels from COVID-19 and does not mean revert. There is no corporate access or guidance from the company.   

Cambium, meanwhile, does basically the same thing as UI in WISP and wireless access but caters to larger operators (tens of thousands or hundreds of thousands of subscribers vs thousands) and has higher grade but more expensive equipment. CMBM is more reliable and even pre-breach, viewed as more secure / safe than UI. Its business is smaller because the premium placed on reliability and security by these smaller operators and customers is less than that of larger operators and real enterprises. CMBM has historically played in niche, growing markets rather than the mass market. It similarly trades at around 30x estimates but unlike UI, is growing off of a base of 80m / quarterly sales rather than ~450m so there is more runway here. The estimates also look much more conservative than Ubiquiti's, where a massive surge in channel demand juiced numbers in the two most recent quarters. By contrast CMBM has seen a more measured, linear trajectory from 60m to 83m / q vs UI from 300m to 480m. 

We are positing that the security breach of Ubiquiti will likely become a major branding event for Cambium and could lead to aggressive share gains in the SME and WISP market. This may take some time to play out, but certainly the Street is likely to begin discounting this future success as it is heard of in the marketplace. Simplistically, if just 20% of UI's business shifted to CMBM, it would double quarterly revenues and could make the stock start to look quite cheap quite quickly. 

Of course, this breach may fade and turn into stale news fast. FWIW, we did a channel check with a small SI today that we know from past work in the space and he took the opinion it would blow over. For that reason, we are advocating long CMBM as opposed to short UI (whose stock has already fallen by 20%+ on news of the breach), though the paired trade could likely continue to work in the near term. Online, the community seems quite pissed so we think our contact may have an overly sanguine view on the breach. He also owns CMBM and UI in his PA and says near term demand is off the charts.

We are bearishly positioned UI and long CMBM but are recommending long CMBM, as noted above, as the stock has appreciated in line with the market over the past days but has not seen outsized gains reflecting increased optimism from the breach of its leading competitor.

Submitted as much for feedback as anything...

Catalyst

Magnitude of Ubiquiti breach is severe and customers defect

Regulators go after UI and customers don't want to be associated with the brand

Ubiquiti's evangelist community fractures

Continued beat and raise