Having seen a couple of posts about Sumo Logic it seems nobody really has an understanding about what they do so I thought I’d help break things down for the common layman. There has been enough commentary about the conservative multiple so I will instead try to discuss the market dynamics and technology shifts. I hope this helps bring awareness to this segment of the market and look forward to a discussion around these points.
Disclosure: I work in enterprise software and am long 10,000 shares @ $22
TLDR: In a future where an infinite amount of machine data is being generated, only Sumo has the architecture that makes sense.
Overview of the logging market
Let’s begin by understanding what logs are. All digital machines generate data, everything from status updates from a server, traffic levels on the network, battery levels of your phone, and even temperature readings from your HVAC system. The amount of machine data generated will continue to grow exponentially, particularly as more and more IoT devices come online (smartwatches, cars, fridges, etc.).
All of these logs need a central repository to be stored, upon which analysis can be performed. Historically logs have mostly been from on-prem systems like firewalls, routers, databases, etc. however as more and more systems migrate to the cloud, these new cloud environments are generating logs as well.
These logs are important to the IT organisation of any company, to be able to track and answer questions such as:
- How are traffic levels trending on my website?
- Is my AWS instance still alive? How is the application performing?
- Are my Windows machines patched and up to date?
- Is there any unusual activity on my network?
This culminates into a single pane of glass, where companies can monitor the health and status of all their systems in one place. In addition to that, large companies are mandated to store logs for:
- Compliance: Companies need to store immutable logs for a certain period of time as a form of record keeping.
- Security: Logs are reviewed during threat forensics after a cybersecurity breach. The security team needs to inspect their firewall/access logs to identify how and when they got breached. ie. who accessed this file and when?
As a result, we can expect the logging market to continue to exist over the long term. The only question is, who is best positioned to meet this need for the future?
The current players
While there are many nuances and buzzwords around SIEM, observability, APM, IoT, etc. I will keep things simple and talk only about a relatively established and mature market – logging. It is a crowded market with a lot of players including LogRhythm, Loggly, Logz.io, Rapid7, IBM, Exabeam, etc. I will look specifically at the companies built for serving the Fortune 500, as this enterprise segment is where the greatest share of wallet is. Datadog deserves a mention, however their core competency is APM. Their log solution was through a startup acquisition and has a pretty negligible run-rate so we’ll ignore them in this discussion.
| Company | Founded | Type | Multitenant | Market Cap (as of 02/21) |
|---|---|---|---|---|
| ArcSight | 2000 | On-prem (1st gen) | No | Acquired |
| Splunk | 2004 | On-prem (2nd gen) | No | 28B |
| Elastic | 2012 | Open Source | No | 15B |
| Sumo Logic | 2010 | Cloud SaaS (1st gen) | Yes | 4B |
The original pioneer of the logging market is ArcSight, who were then acquired by HP and subsequently spun off to Microfocus. They are now dying a slow death, while Splunk is the current de-facto solution for most companies.
A CIO today has 2 main choices when wanting to implement a logging solution, they can either Buy or Build.
- Buy: Pay Splunk to help deploy in your datacentre. And then pay them professional service fees every year to help maintain and manage the software. And pay them based on the amount of data you send to them.
- Build: Get a bunch of your developers to build a solution inhouse using an open source Elastic stack (ELK). They then have to actively manage the system themselves to keep it alive and manually scale it up and down accordingly.
Architecture matters
The shift from on-prem to cloud
A lot of the latest high-flying SaaS companies haven’t really been that innovative. They are solving the same age-old problems, except doing it in the cloud instead. A few examples are shown below. In fact, a lot of these are done by the exact same people. Crowdstrike was founded by ex-McAfee guys, Zoom was founded by ex-Webex, and so on. No different with Sumo, which was founded by ex-ArcSight guys. The reason for this phenomenon is because these people understand their industry inside out and have experienced the challenges first-hand. They see where things are headed and want to do things a better way. Another common trend amongst all of these new hot stocks is that they were founded AFTER the inception of the cloud (AWS began in 2006).
The shift is both a technological one (on-prem -> cloud) as well as a business model shift (license -> SaaS). Sumo is in a similar position to capture this technology lifecycle shift, as workloads shift from on-prem to cloud. Naturally, logging and analysis should also occur in the cloud. This kind of scale is what the cloud was made for.
| Incumbent | Cloud SaaS | Market |
|---|---|---|
| McAfee | Crowdstrike | Endpoint security |
| Siebel | Salesforce | CRM |
| Oracle | Workday | ERP |
| Webex | Zoom | Video conferencing |
| Remedy | ServiceNow | ITSM |
While Splunk no doubt has a more mature product that can serve a broader range of edge cases, Sumo has managed to demonstrate product maturity by gaining a client like Macquarie Bank, a bank in Australia (case study available on YouTube). Anyone who works in enterprise software sales knows that cracking the FSI vertical is the holy grail, as they are super conservative, with lots of red tape and requirements. It’s one thing to convince a forward-thinking cloud native company (like JFrog or PagerDuty) to use your software, it’s another thing to convince a bank to send their sacred data to a third-party cloud.
A structural advantage: Multitenancy and Elasticity
Given the volume heavy nature of this type of business, architecture really matters particularly as the amount of data grows exponentially. The advantage with multitenancy ultimately manifests itself either in the form of better gross margins, or reduced costs to customers.
We know that this is where the market is heading, not just because every other SaaS vendor is multitenant, but also because Splunk is throwing big dollars in trying to reposition for the cloud. Splunk doubled their R&D budget, spending over $600m in R&D alone last year, which is probably more than Sumo has spent in its entire lifetime. They are desperately trying to catch up, but multitenancy is not a feature you can add overnight, as it involves rearchitecting your entire product. It is especially hard when you already thousands of customers using your platform, it gets even harder once you’ve bolted on a few acquisitions over the years. It is akin to trying to convert a regular combustion car into an electric car, while someone is driving it.
It took a long time for Splunk just to achieve the basic separation of storage and compute, a milestone they achieved last year. This is what happens when you’re trying to refactor code written in 2004, and throwing 10x more money doesn’t necessarily accelerate things by 10x. Frank Slootman (Snowflake CEO) had a fairly eloquent way of describing this:
You can put 1000 mothers on the task of creating a baby, but it’ll still take 9 months.
Splunk Cloud in its current form is simply a hosted solution, meaning that instead of hosting the software yourself in your data centre, you’re paying Splunk (who pays AWS) to host it. This is very different from a true cloud native SaaS solution (which is what Sumo is).
Asymmetric risk and incredible upside
Massive TAM
Sumo is backed by the crème de la crème of VCs: Accel, DFJ Growth, Greylock, IVP, Sequoia, Sutter Hill Ventures, Battery Ventures. Usually you see 1 or 2 of these names in any winning company, you almost never see all of them together. And even if you did, you definitely wouldn’t be able to get it at prices close to theirs. These people spend all day thinking about the future, TAM and competitive dynamics. And they allowed Sumo to make a big long term bet and spend 10 years developing the next generation platform. By putting their money where their mouth is, these people have validated the market and investment opportunity for you, and you’re able to participate in the upside at a price not too distant from theirs.
The last VC pricing round in May 2019 for Sumo was at $12 (~3x). For comparison, Snowflake’s last VC price in February 2020 itself was $39, and they are now trading around $300 (~8x). Typically, the majority of the gains are captured by the VCs pre-IPO, but in this case there is still plenty of room for retail investors to participate in the upside. Sumo is also barely scratching the surface with market penetration. Only 15% of their revenue is coming from outside the US, there is so much room for international expansion. Mature software companies usually see around 50% of their revenue from international sources.
Multiple Expansion
Prior to COVID, Sumo had a pretty solid and consistent growth rate. It doesn’t seem unreasonable to expect it could revert to the mean and get back closer to 50% once the macroeconomic outlook improves. There are many notable growth companies that have missed a couple of quarters, I remember when ZScaler had a quarter with 18% billings growth and the stock tanked, presenting an incredible buying opportunity for those who believed in the long-term vision and market opportunity, rather than quarter to quarter execution. Similarly in 2010, people back then were debating whether Apple’s stock was overpriced, based on whether they were going to sell 8m or 10m phones that quarter, which in hindsight seems a little silly and didn’t really matter.
Sumo Revenue Growth Rates:
- FY2019: 53%
- FY2020: 50%
- FY2021E: 30% (COVID)
- FY2022 and beyond: ???
If Sumo can get back closer to 50% growth rates, the stock could see significant multiple expansion. For perspective, other SaaS companies at 50% growth rates are currently trading closer to a 40x multiple, which would put Sumo closer to a valuation in the 12B range (roughly $120 share price). In addition, the risk reward here is asymmetric, given they are already priced in for a low growth rate. Meaning that if they do deliver a low growth rate, nothing much will happen and the downside is limited. Whereas if they manage to execute, deliver positive surprise during earnings and become the cloud leader for logs, the upside is incredible.
In the current rate environment and frothiness within software stocks, it is not unreasonable to expect that their market cap could easily go from 4B -> 40B within 3 years. What we have is a company that was good enough to go public during a pandemic, but was conservatively priced due to the short-term execution issues. While Sumo has had weak execution over the past 12 months, they are well positioned for the future due to the architecture they’ve spent 10 years building. In investing you want to spend more time thinking about what the future could bring, rather than what happened the past 2 quarters.
So why has the stock been floundering?
This is what I have been asking myself ever since the flopped IPO. In addition to the growth deceleration causing multiple compression, I think the real challenge Sumo has faced is that they may have been too early to the market. It wouldn’t be the first time that VCs were too forward thinking, the reality is that these large companies are relatively slow moving and trends take a long time to play out. Even across the broader cloud story, we are still in the very early innings.
More specifically, Sumo has been struggling with:
- Inability to acquire net new customers
- Competing against vendors with much larger scale
- A less than articulate CEO. Granted he came from a product background as opposed to a sales background, so we’ll cut him some slack. I originally thought he seemed a little burnt out but having watched his older videos, that’s just the way he is.
As they say, you want to be either the number 1 or 2 in any market. Sumo is not that (but has the potential to be).
The bottom line
Splunk is slipping
When your marketing team is busy pushing t-shirts, that’s how you know you’ve hit rock bottom and really have nothing good to talk about. It is also evident that Splunk has become a bureaucratic political beast. Their cloud team has had a different leader every 2-3 years. With those kinds of dynamics, it is very difficult to execute on a long-term vision and see the development through. Execs get paid on short term quarterly performance, and nobody wants to risk cannibalising their cash cow. There has also recently been a massive exodus within their sales team, which began with their CRO leaving, and this is usually a leading indicator that the party is over.
Elastic is a wildcard
The wildcard here is Elastic, as they have demonstrated product market fit and strong momentum within the developer community. They have been taking share from Splunk and may end up becoming the provider of choice, instead of Sumo. However if you zoom out, the idea of every company building and managing their own log solution just seems silly. This simply isn’t the way software was meant to be built, particularly since logging a common requirement across companies, and the devices generating these logs are also the same.
A better way to do things
My view is that any software that requires the buyer to maintain it, is garbage software. This is the case with Splunk and ArcSight where customers have to pay professional service fees every year for consultants to tweak and maintain it. And it’s the same case with Elastic which requires you to provision a team of people on keeping the system alive. With Sumo it’s pretty straight forward, you install connectors which route the logs into Sumo. From there Sumo processes the data and generates dashboards, etc.
Watch out for Q4 earnings in March
The most important thing obviously is that Sumo can actually deliver on the vision. A few important things are happening next month when they announce earnings, here are some things to watch:
- Q4 growth performance – is the chart moving up and to the right?
- FY2022 guidance – how healthy is their pipeline looking?
- Lockup comes off – are VCs dumping the stock?
Sumo needs to demonstrate a reacceleration in growth, and to signal confidence in the future. If they can guide >30% growth for FY2022, then a 10 bagger within 3 years is in sight. Any less than that and it deserves to trade like a donkey. Trade it if you want to bet on positive surprise next quarter, hold it if you believe in the long-term vision.
Final thoughts
I think that companies are going to move from Splunk -> Sumo when they get sick of getting ripped off, and as more of their workloads shift to the cloud. I think that companies are going to move from Elastic -> Sumo, when they get sick of needing to manage a solution, or when it gets too complex. I think that at the end of the day all markets experience margin compression and get commoditised, and that Sumo has a cost advantage due to their architecture. Only a true cloud native, multi-tenant SaaS platform makes sense for a world generating an infinite amount of data.
The One True King: SUMO
Submitted February 07, 2021 at 08:56PM by EnterpriseStonks https://ift.tt/39VS8L1
