Situation Summary

NortonLifeLock (“NLOK”) is the end result of an eventful past two years at Symantec that included a whistleblower investigation, violations of the company’s code of conduct, a string of disappointing results from a stalled enterprise strategy, activist-led turnover at the board and C-suite levels, a comprehensive review of strategic alternatives, the divestiture of enterprise operations, consequent absorption of significant stranded costs and initialization of substantial footprint reduction, the monetization of non-core assets and the company’s pivot back to focusing upon and investing in its consumer business. In short, the story has been complex and messy, but for those still paying attention, we believe shares today offer ownership in an enviable set of assets to be run by a new CEO with a strong track record of shareholder value creation, and with valuation underpinned by interest from reported financial and strategic suitors and a $0.50 annual dividend. 

In our view, an investment today represents the opportunity to take advantage of a depressed entry valuation into a consumer software business that is not in decline and instead has a path to return to profitable growth and substantial FCF generation.  The board is aligned and controlled by large shareholders. We see a path to substantial upside in shares from conservative operating case assumptions and shareholder-friendly capital allocation; insiders have better info and recent actions signal they agree (given no transactions despite reported interested parties). We believe the stock ex-dividend may be worth up to  ~$30 / share in two years, representing ~100% upside from current levels (ex-special dividend).

Our investment thesis is predicated upon the following: 

1. Earnings estimates are too low and are likely to go higher

1. Debates around whether or not the asset is in structural decline are misplaced. Recent historical growth has been poor, but was driven by a lack of focus and prior management’s decision to walk away from OEM business. Accelerated marketing spend will show accelerating billings and topline growth.

2. NLOK is positioned to win given market leadership and large relative scale in the developed world consumer security market. Consumer security is in the process of being redefined from simple device antivirus to a much more holistic offering that seeks to consolidate digital protection for consumers wherever they need it under one bundle and one brand.

3. ARPU lift from transitioning model to Cyber Safety membership programs (an all-in-one membership that combines LifeLock identity theft protection, Norton cyber security technology and a VPN for online privacy) as cohorts lap year 1 promotional pricing

4. Variant view

1. RemainCo can drive top-line growth and EBITDA multiple will re-rate to smaller discount to peers

2. Leverage + FCF generation can drive substantial EPS and FCFPS growth through buybacks

2. Newly-installed CEO who knows the asset and consumer space well and has a history of enriching shareholders 

3. Compelling valuation on a standalone and relative basis

1. This is a good asset that has suffered from neglect. Nobody on buyside or sellside has focused on the consumer business over the last couple years, while internally it has been underinvested in (cash harvested to invest in enterprise growth strategy).

2. Relative valuation note: Stock trades est’d ~9.7x EBITDA following de-rating vs. peers Avast and Check Point at 12-15x NTM EBITDA (each growing EBITDA low to high single digits, NLOK mgmt. guidance calls for similar topline and EBITDA growth rates medium term). Further upside to growth-adjusted multiple if viewed as a consumer subscription protection business like Frontdoor or Homeserve.

4. Valuation underpinned by financial and strategic suitors

1. Reported bid by Broadcom for whole Co. at $28 / share implies $16 / share of value for consumer biz assigned by Broadcom, who was interested primarily in the enterprise assets. Additional reported interest from PE and McAfee. Assuming board is smart and aligned with equity (we do, given activists and PE interests), Co’s decision to keep consumer biz implies meaningful upside to that $16 / figure post-restructuring / refocus efforts and / or from a different bidder.

Timeline of Key Events

• Jun '16 – Bought Blue Coat for $4.7B, Silver Lake and Bain put money in via PIPE

• Nov '16 – Bought Lifelock for $2.5B

• May '18 – Whistleblower investigation launched after a former employee raised “concerns” about some accounting practices

• Aug '18 – Starboard files a 13D; subsequently put three people on board

• Nov '18 – Exec Depart - President and COO Mike Fey, CMO Michael Williams and SVP of Go-to-Market teams Bradon Rogers resign 

• Feb '19 – New Hire – Chief Marketing Officer Debora Tomlin

• May '19 – Exec Depart - President and CEO Greg Clark resigns; Rick Hill (board member nominated by Starboard, former Chairman and CEO of Novellus) becomes interim CEO

• May '19 – Exec Depart - CFO Nick Noviello resigns (announced in Jan '19)

• May '19 – New Hire - CFO Vince Pilette - Last two companies have meaningfully outperformed market while he was in CFO seat

• July '19 – Broadcom reported to offer ~$28 per share for whole Company per Reuters; offer not accepted by Co. 

• Aug '19 – Enterprise sale to Broadcom announced

• Sep '19 – Permira and Advent reported to be considering competing bid per WSJ

• Nov '19 – Norton completes sale of Enterprise business to Broadcom leaving standalone consumer business

• Dec '19 – McAfee (co-owned by TPG, Intel and Thoma Bravo) reported to be considering a combination with NLOK per WSJ

• Jan '20 – NLOK announces sale of ID Analytics business to LexisNexis

Business Overview and How We Got Here 

• NLOK is a provider of consumer security and identity protection software and services; and is the RemainCo from Symantec following its announced sale of its Enterprise segment to Broadcom. The company is a pure-play consumer security business operating under the Norton and LifeLock brands.

• Product overview

• Norton: Products protect desktop/mobile devices from spam, advanced attacks, phishing, malware and other infections.

• LifeLock: Consumer identity and protection products. Co. monitors consumer activity (applying for a car loan or home mortgage, making a credit inquiry) for signs of unusual behavior and evidence of stolen personal data and issues prompts to subscribers to verify activity.

• Annual Retention Rate: 85% 

• Channel: Direct (91%); Channel Partners (service providers (e.g. Comcast) and retailers) (9%)

• Highlights

• Largest player in consumer security market by wide margin (more than McAfee (#2) and Avast (#3) combined); Scale advantage matters both in marketing / customer acquisition and product development (greater installed base to cross-sell new products to)

• Management has indicated that the TAM of the company’s three core pillars (Endpoint Security/Anti-virus, Identity Protection, and Privacy) is $12B and growing at ~7% annually  

• Strong brand awareness

• High margin business (mgt. guiding ~50% EBIT margins) with attractive FCF profile (~70% conversion)

• Aligned investors have meaningful representation on board; expected to steer Co. towards maximizing shareholder value (have already announced sale of Enterprise, increased dividend and increased share repurchase program)

• Renewed focus and investment in standalone Consumer business; previously cash flow was redirected out of the Consumer segment to fund growth in the Enterprise business. Mgmt. believes investment in sales / marketing and R&D to build the product pipeline should drive topline revenue growth

• Stock initially de-rated last year following a whistleblower investigation launched in May ’18 after a former employee raised “concerns” about some accounting practices, prompting the company’s board to hire an independent counsel and other advisers to assist in the probe. The audit committee identified certain behavior inconsistent with the company’s code of conduct, though the Co. said it would not restate previous financial results except for a specific $13 million transaction

• Return of capital

• Buyback: Buyback plan increased by $1.1B to $1.6B

• “additionally, we are committed to continued return of shareholder capital as the cash flows of the Company permit.”

• Stranded Costs – $1.3B of stranded costs from sale of enterprise assets (costs do not support any remaining revenues) will create noise for next couple quarters in earnings results

• Monetization of non-core assets expected to fund unwind of stranded costs

• Financial Profile From Here: Mgmt is projecting low- to mid-single digit revenue growth, operating margin of ~50%, EPS of $1.50 growing faster than revenue, FCF of $900M per year, and ~3.5x adjusted leverage

Operating Targets – Mgmt Targets and Considerations Around Viability

1. Mgmt Targets

Source: Symantec Corporation

2. Antivirus Market – TAM, Growth, Market Share, Pricing trends, retention, and competitive landscape

1. TAM trends

1. Based on discussions with IR, former employees, and analysts, we believe the TAM for SYMC’s “three core pillars” (being antivirus, identity protection, and privacy (VPN)) is between $10B-$12B, and growing at high-single digits (overall)

1. Antivirus: $4-$5B TAM; growing at 0-2%

2. Identity Protection: $3.5-$4B TAM; growing at ~8-12%

3. Privacy: $0.5-$1B TAM; growing 10%+

4. Other markets that SYMC may target in the future include Home & IoT protection

2. Norton AntiVirus business is by far the largest player in the PC security software market, with only McAfee close. Growth per Gartner data has been weak; indicating share loss.

Source: Gartner, Inc.

1. Norton no longer sells to PC OEMs (walked away from business, deemed margins unattractive)…if we aim to size US market share of DTC biz, Norton leadership is even more pronounced (from web traffic to AV vendor websites)

Source: Alexa

3. Identity Protection – TAM, Growth, Market Share, Pricing trends, retention, and competitive landscape

1. Identity Protection: $3.5-$4B TAM; growing at ~8-12%

2. Mgmt. believes they have the largest installed base at ~30% of the market

3. LifeLock identity theft protection competitors include credit bureaus Experian PLC, Equifax Inc., and TransUnion, as well as others including Affinion Group, Inc., Anchor Free, Inc., Credit Karma, Inc., and Intersections, Inc. 

4. Upside from Bundling & Retention?

1. Membership go-to-market repositions security from consumer device to consumer identity (should increase customer stickiness and switching costs)

2. Norton/LifeLock only been offered in a truly integrated basis since April (took time to integrate backends)

3. Higher ARPU and retention from bundling

3. The big structural risk – Windows Obviates Need for Antivirus

1. When did they launch Defender?

1. Windows Defender was first made available to the broader public in Oct. 2006, but Windows Defender as it exists now as an AV program was only made available on Windows 8 (available as of Oct. 2012) and more prominent with launch of Windows 10 (2015). 

2. Antivirus growth has been negative; a bet on low-single digit growth requires improvement (breakout not provided last quarter)

3. Is the worst over or can we expect another hit? – Recent Metrics

1. Recent billings metrics show initial signs of renewed momentum and add credibility to mgmt’s operating case for achievability of mid-single digit revenue growth

Adjusting revenue component of calculation for extra week:

Source: Company Information

4. Is the worst over or can we expect another hit? – Assessing structural risk from Defender

1. Question becomes what % of Windows 10 units still pay for antivirus? If not substantially different than prior Window versions, we should be fine.

1. 2/3rds of market already has Defender installed for Windows PC; would argue sub pressures are less now about availability of Defender (but potentially still face risk from being obviated by improved product / Defender awareness)

Source: https://gs.statcounter.com/windows-version-market-share/desktop/

What is it Worth?

NLOK value is a combination of i) flat but sticky / high margin Norton security software; and ii) growing consumer identity and protection business LifeLock. We believe these products are complementary, and their bundled value proposition remains enduring and highly relevant to the middle-to-upper class developed world consumer that comprises the core of Norton’s customer base. For valuation, we are calculating return profile on stock-ex $12 special dividend (i.e. $27 stock price today is a $15 stub) and assuming that cash costs to unwind stranded costs will be fully offset by sales of real estate and non-core assets. We’re running all cases at 3.5x net leverage (with proceeds to buybacks). 

• Upside: Revenue growth of 3% accelerating to 5% as increased spend on marketing drives topline (2Q’20 already showed 4% billings growth which takes est. 3Q’s to reach P&L); positive growth drives rerating to ~12x EV / NTM EBITDA, which at the low-end of peers Avast and Check Point. Stock has ~100% upside in next 2.5 years.

• Downside: Downside is that Norton AV continues to decline at previous 7% YoY rate (pre-LifeLock acquisition) and LifeLock revenue is flat leading to a 3.5% decline in revenue on a combined basis. 5% dividend yield puts floor on stock at ~$10.00 stub (31% downside to current stub). 

Key Risks:

Stranded Costs: Stranded costs will make next several quarters’ numbers still messy.

Windows Defender is a Risk to Norton AV product: MSFT providing antivirus program for free and comes pre-installed on new Windows 10 computers

Operating System Shift: Apple growing share of desktop computer market; historically lower uptake of AV software

I do not hold a position with the issuer such as employment, directorship, or consultancy.
I and/or others I advise hold a material investment in the issuer's securities.