N-able’s Security Revenue Faces Decline as License Portability Undercuts MSP Margins

[00:00:02] A software company spent two years and $266 million telling the channel it was a cybersecurity company. On Monday, it reported the quarter that tested the claim. This is the Business of Tech. I'm Dave Sobel. Disclosure, I am an Enable shareholder. So we'll start with the press release itself, which looked fine.

[00:00:25] Enable reported revenue of $138.2 million for the second quarter, up 5.9%. Adjusted earnings of 10 cents a share, exactly what analysts expected. Adjusted profit of $39.9 million, a 29% margin. If you stop reading there, you would call that an ordinary quarter. Then look at annual recurring revenue, $544.5 million.

[00:00:55] Three months earlier, it was $548. The number went down. For a subscription business, that is not a slower quarter. That is more money walking out the door than came in. Now the part that explains where it went, and it is management's own breakdown. Security operations, they said, is running ahead of plan. Data protection is growing faster than the company overall. But renewals in two specific lines fell. The chief financial officer put it this way.

[00:01:25] Renewal rates for that cohort moved from the higher 80% range earlier in the quarter to the mid-80% range as the quarter progressed. The two lines were unified endpoint management and endpoint detection and response. 90 days earlier on the first quarter call, the chief executive described the company as delivering a strong quarter driven by improving retention. So the full year outlook came down.

[00:01:52] Revenue guidance from $544 to $559 million down to $539 to $542. Recurring revenue growth guidance cut from 8% or 9% to 4% or 5%. About $20 million taken out of the forecast because a renewal rate moved three points. Management added that the new outlook does not assume renewal rates improve for the rest of the year.

[00:02:18] The market took the stock down 36% in a day from $499 to $319 within 30 cents of its 52-week low. Two lines failed and one didn't. Same company, same quarter, same customers. Something separates them and it isn't the technology. If you're listening to this and you haven't hit follow yet, on Apple Podcasts search business of tech. Takes five seconds and you'll get the next episode automatically.

[00:02:48] The MSPs getting ahead in security aren't adding more tools, they're getting the work off their plate. Guardz consolidates the stack, endpoint, email identity and then puts an autonomous analyst on top of it. Triaging the alerts, correlating the signals, drafting the client reporting, automatically. It's purpose built for MSPs protecting S&B clients, month to month. Real SecOps without hiring a SecOps team.

[00:03:18] Start at Guards.com. That's G-U-A-R-D-Z dot com. The difference between the line that held and the lines that left has nothing to do with what they protect. It has to do with what a customer loses by leaving. Endpoint detection and response at Enable is not Enable's product. It's SentinelOne's resold.

[00:03:44] A customer who walks takes the same logo somewhere else and gives up nothing. A license is portable by design. Now look at what the company bought. In November of 2024, Enable acquired a company called Adlumen for roughly $266 million. $100 million in cash, a block of stock, and $120 million in installments it's still paying off. Adlumen does extended detection and response and managed detection and response.

[00:04:14] The second one is the important one. Managed detection is people. Analysts in a room, watching one customer's environment, learning what normal looks like out there. Enable didn't build that. It couldn't. You can ship a feature in a release. You cannot ship years of an analyst knowing which alerts in a particular company are always nothing. And they committed to it. The following June, they made Adlumen's chief marketing officer the CMO of the entire company.

[00:04:41] And the chief executive said they were shifting, his words, from IT management to becoming the mid-market's most trusted cyber resiliency partner. By April, at their own conference, executives stopped saying the letters RMM on stage and called Enable a global cybersecurity company. The analyst firm Omnia was in the room and wrote it down, along with the number underneath it.

[00:05:07] The acquired security business was nearly 27% of revenue and the fastest-growing thing they had. Without it, Omnia said, the framing would not hold together. So the piece they bought, the one with people in it, grew. The licenses they resell left. And the chief financial officer said where they went, in a phrase worth hearing exactly.

[00:05:31] Customers, he said, are going to get a SentinelOne type of service from a different type of provider. Not a different vendor, a different type of provider. Enable's response was to renegotiate its SentinelOne contract. More SKUs, better pricing protection. A licensing answer to a customer who had just told them, in plain language, that the problem was who was delivering it. Hold on to that phrase, a different type of provider,

[00:05:59] because it's about to stop describing Enable's customers and start describing yours. So bring it into your own business. Start with what's happening to the price of the thing being resold. SonicWall announced this month a single lightweight agent that combines next-generation antivirus with endpoint detection and response. And in the company's own launch announcement, so wait accordingly, it comes two ways. You can buy it as a product, or you can buy it fully managed from SonicWall.

[00:06:29] And read who that managed tier is sold to, because it isn't the client, it's you. SonicWall's pitch is that MSPs shouldn't have to choose between enterprise-grade protection and margin. Which means the offer on the table is that their analysts do the watching, and you resell it. That's the whole trade. The one part of your stack that wasn't portable turned into a SKU that is. Then the other number, and this one is the whole episode.

[00:06:56] Enable carries about a billion dollars of goodwill on its balance sheet. The accounting value of what's bought, $160 million of that from AdLumen. After Monday, the entire company is worth roughly $600 million on the open market. The things they bought are carried on the books for more than the market now thinks the entire company is worth. Underneath sits $400 million in term debt, and about $60 million still owed on the AdLumen purchase itself.

[00:07:23] And its own filing back in May, the company wrote the warning. A continued and sustained decline in our stock price could require an interim goodwill impairment analysis. They described the condition in the spring, and met it in August. Consider what that money was for. $266 million, a billion in goodwill, and a stock cut by a third in a single day. To acquire a group of people who watch client environments and know what normal looks like there.

[00:07:53] You have that. You've had that the entire time. And you've been putting it on the invoice as a line item called Endpoint Protection at a markup, sitting at a list next to four other logos. So here's the choice, and it arrives at your next renewal, not eventually. Recut your security lines so every one of them names something a person did and something the client received. A review that happened, the thing that got contained, the report somebody actually read.

[00:08:19] Or keep handing over a list of logos, and lose them one at a time to whoever quotes those same logos cheaper. Which is precisely what just happened to the company that sells you your console. What sounds like a positioning exercise right up until you have to write the number down. Every MSP has watched an enterprise vendor announce a channel program and then quietly walk away from it. So here's one worth watching.

[00:08:47] Proofpoint is updating their managed services offering with a platform built MSP-first from the ground up. Proofpoint 365 Total Protection brings Microsoft 365 Security, Backup & Compliance, into a single multi-tenant console, built on the proven Hornet Security platform. Now backed by Proofpoint's global cybersecurity resources. Enterprise capability. Channel native delivered.

[00:09:13] Take a look at Proofpoint-Total-Protection.com. Why do we care? Because the moment you separate the license from the work, you have to put a number on the work. And most providers have never priced it because it's always been buried inside the endpoint fee. Pull one client agreement and try to write the service line as its own figure with its own basis. If you can't defend that number without pointing at the license underneath it,

[00:09:41] you've just found the line your competitor under quotes first. So what to consider? Find the residual before you name it. Take your total per endpoint security revenue for one client. Subtract what you actually pay for the license underneath it and look at what's left. That number is your entire security services business. And right now it has no name, no basis, and no line on the invoice. Which is why nobody has ever had to defend it.

[00:10:08] Get off the seat as your pricing basis. Enable security revenue was indexed to endpoints, which is a product basis. And the moment a manufacturer offers the same endpoint cheaper, seat indexed revenue has no defense. That's not a strategy failure, it's arithmetic. If your detection and response line is quoted per device, you've adopted the losing basis. Price it against what your people commit to instead.

[00:10:34] Coverage hours, response time, environments reviewed, so your number doesn't move every time a license price does. Price the manufacturer's managed tier before you resell it. SonicWall now sells a fully managed MDR tier out of its own sock, two MSPs, and it will not be the last. Get that quote and decide deliberately whether you are buying capacity you can't stab, or quietly outsourcing the only liner in your invoice a client can't get anywhere else.

[00:11:02] Both can be right, but the second one needs to be a decision, not a default. If this trend continues, within 12 months, the opening question in a competitive security bid stops being, what's in your stack, and becomes, what does your team do that the manufacturer's managed tier doesn't? And that is a question the provider who kept their own analysts can answer in one sentence,

[00:11:26] while the one who can only answer with a logo finds themselves bidding against the vendor whose logo it is. This is the business of tech. The hardest part of running an MSP? Doing it alone. The Small Biz Thoughts community has been the room where independent operators compare notes for nearly 20 years. Real peers, real numbers, real answers from people running businesses just like yours.

[00:11:54] Pull up a chair at smallbizthoughts.org. Interested in advertising? Head to mspradio.com slash engage. The Business of Tech is written and produced by me, Dave Solt, under ethics guidelines posted at businessof.tech. Thanks for listening. I'll see you on the next episode. Proud member of the MSP Radio Network.