Teardown: Ping Identity, ForgeRock and the Two-Cloud Merger
This analysis uses only public SEC filings: the annual and quarterly reports of Ping Identity and ForgeRock, both merger proxies, and the closing press release filed as an exhibit to ForgeRock's August 23, 2023 Form 8-K. I have no affiliation with Ping Identity, ForgeRock or Thoma Bravo, and no non-public information about either company or either transaction. Where I estimate, I say so.
The New Relic teardown was about one company's cloud migration. This one is about what a buyer inherits when it puts two companies together, and it is the more common problem in private equity. Platform-and-add-on is the standard software playbook, and almost nobody prices the cloud side of the add-on.
Within about a year, Thoma Bravo bought two identity software companies and combined them. One ran its SaaS product entirely on Amazon Web Services. The other ran its SaaS product on Google Cloud. Both were in the middle of moving customers from software they ran themselves to software the vendor hosts, which is the shift that puts the cloud bill on the vendor's income statement. And one of them had just signed cloud commitments sized to a plan that ran exactly to the end of the forecast it gave bidders.
The deals
- August 2, 2022: Ping Identity signs a merger agreement with Thoma Bravo at $28.50 per share in cash. The proxy puts the total funds required at about $2.8 billion.
- October 10, 2022: ForgeRock signs with Thoma Bravo at $23.25 per share. Thoma Bravo later valued the transaction at about $2.3 billion.
- October 18, 2022: the Ping Identity deal closes.
- December 22, 2022: the Department of Justice issues a second request on the ForgeRock deal, extending its antitrust review.
- August 23, 2023: the ForgeRock deal closes, and Thoma Bravo announces that it has combined ForgeRock into Ping Identity.
ForgeRock signed eight days before Ping closed. Each proxy's projections cover that company alone, so neither says anything about what combining them would cost.
What the filings show
Both companies report on calendar years. Dollar figures are in millions.
Ping Identity
| Period | Revenue | Cost of revenue | GAAP gross margin | SaaS revenue | Purchase commitments |
|---|---|---|---|---|---|
| 2019 | $242.9 | $55.7 | 77.1% | — | $29.6 |
| 2020 | $243.6 | $68.2 | 72.0% | $38.1 | $16.3 |
| 2021 | $299.4 | $94.9 | 68.3% | $57.6 | $189.2 |
| H1 2022 | $156.7 | $58.5 | 62.7% | $42.9 | $175.6 |
ForgeRock
| Period | Revenue | Cost of revenue | GAAP gross margin | ARR | Purchase commitments |
|---|---|---|---|---|---|
| 2020 | $127.6 | $21.3 | 83.3% | $135.9 | — |
| 2021 | $176.9 | $32.9 | 81.4% | $183.1 | $60.3 |
| 2022 | $217.5 | $39.5 | 81.8% | $229.6 | $50.9 |
| H1 2023 | $121.4 | $24.9 | 79.5% | $251.3 | $37.7 |
Purchase commitments are non-cancelable future payments at period end. Both companies describe them as primarily related to third-party cloud hosting and data services, plus IT operations and marketing events. Ping did not report SaaS revenue separately for 2019, and ForgeRock's filings here do not give a 2020 commitment figure. ARR is each company's annualized recurring revenue at period end.
Finding 1: Ping's shift to SaaS moved the hosting bill onto its own books
Ping did not have data centers to leave. Its margin story is different from New Relic's and, for a software buyer, more common. When a customer runs a vendor's software on its own infrastructure, the customer pays for the servers. When the customer moves to the vendor's SaaS product, the vendor pays. Every dollar of revenue that moves from a self-managed license to SaaS brings a hosting cost with it that the license never carried.
Ping's SaaS revenue grew 51% in 2021 and 69% in the first half of 2022. GAAP gross margin fell from 77.1% in 2019 to 62.7% in the first half of 2022. Part of that decline is amortization of acquired technology and capitalized software, which Ping reports inside cost of revenue. Excluding that amortization, margin still fell from about 80.3% in 2020 to about 77.3% in 2021.
The filings name the cloud piece directly. Cloud-based hosting and management costs added $7.1 million to subscription cost of revenue in 2021 and $3.1 million in the first half of 2022. In the second quarter of 2022, cloud hosting costs also added $1.6 million to research and development, for building and configuring the cloud products.
The diligence point: in a business moving to SaaS, the hosting bill is spread across cost of revenue and R&D, and it grows with the mix shift rather than with revenue. Rebuild gross margin at the plan's future SaaS mix, not at today's. Get the whole cloud bill, by account, and map every line to production, development or something else before trusting any margin that comes out of the income statement.
Finding 2: A commitment sized to the plan
Ping's purchase commitments went from $16.3 million at the end of 2020 to $189.2 million at the end of 2021, for periods through 2026. In the same year, the language describing its AWS agreement changed. The 2020 annual report said AWS could terminate on 30 days' notice. The 2021 report said Ping had agreed to terms with AWS that "would prevent the termination of our agreement in virtually all circumstances." Both changes point to a long-term committed agreement with its only cloud provider, though the filings do not say so outright, and the commitments also include non-hosting items.
Measured against the business it served, the commitment was large. $189.2 million was about 3.3 times Ping's 2021 SaaS revenue of $57.6 million. Spread evenly over five years, it is about $38 million a year. For comparison, the entire hosting cost increase the company reported for 2021 was $7.1 million.
A commitment that size makes sense only against a growth plan, and the proxy shows the plan. The projections given to bidders, including Thoma Bravo, ran through 2026 and took ARR from $385 million in 2022 to $1 billion in 2026, 2.6 times in four years. The commitments end in 2026 too.
The diligence point: a cloud commitment is a bet on the plan, placed by management, that the buyer inherits. If growth comes in below plan, the shortfall is a cost with no revenue against it. Ask what usage forecast each commitment was sized against, run it at the buyer's case, and price the expected shortfall as a debt-like item.
Finding 3: Two clouds, two commitments, one company
Ping's 10-K says its SaaS offerings are hosted solely in AWS. ForgeRock's 10-K reports a $2.4 million increase in Google Cloud expenses in 2022, driven by more customers using its SaaS product "on Google's platform." Its commitments were $60.3 million at the end of 2021 and $50.9 million at the end of 2022: $25.9 million due in 2023 and $25.0 million in 2024. By June 30, 2023, they had fallen to $37.7 million.
A buyer combining these two companies has three choices.
Run both. Two clouds, two operations teams, two security and compliance scopes, and two sets of commitments, indefinitely. This is the cheapest choice in year one and the most expensive one over a hold period.
Consolidate the infrastructure. Move one product onto the other company's cloud. Identity is close to the worst workload to move. It sits in the login path of every customer application, so downtime is visible to end users immediately. It holds credentials, sessions and policy state for every user. And many identity customers are regulated, which brings data residency and audit requirements into every migration plan. On my Integration Complexity Scorecard, that profile points to a parallel run: both environments operating at once, at roughly 1.4 to 1.6 times the cost of a single cutover.
Consolidate the product. Move customers from one product to the other. This is the largest prize, because it eliminates a whole platform, and also the slowest and riskiest, because every customer migration is a renewal risk.
The commitment calendar matters to all three. ForgeRock's commitments ran off by the end of 2024, while Ping's ran through 2026. On contract terms alone, consolidating onto AWS strands less committed spend. But ForgeRock's 10-K names Google Cloud as a strategic partner, so moving off it carries a go-to-market cost on top of the hosting one.
The diligence point: in a platform-and-add-on deal, the add-on's cloud is an integration decision with a price, not an operating detail to settle after close. Model all three paths, put the commitments of both companies on one calendar, and decide which one the plan assumes before signing.
Finding 4: Neither plan shows what the margin does
ForgeRock's projections assumed increasing cloud infrastructure and hosting costs as its revenue mix shifted toward SaaS. Its non-GAAP gross margin falls from 82.7% in 2022 to about 81% in 2024, and the extrapolation to 2032 holds gross margin at the 2023 and 2024 levels. That is the same flat-margin assumption as in the New Relic plan, held for eight more years.
Ping's disclosed projections show ARR, revenue and adjusted EBIT, but no gross margin at all, even though its gross margin had fallen more than fourteen points in two and a half years.
The diligence point: if the plan does not show gross margin, build it. In a business whose mix is moving to SaaS, it is the line most likely to be wrong and the one that tells you whether the operating profit in the out years is real.
What the cloud decision was worth here
The two companies' projections together reach about $1.5 billion of revenue in 2026 ($925 million at Ping and $575 million at ForgeRock), and nearly $200 million of operating profit before stock-based compensation ($137 million and $60 million).
Against that, every $10 million a year of duplicated or stranded cloud cost is about 5% of combined 2026 operating profit, and every point of gross margin is about $15 million a year. I cannot see from outside how big the overlap actually was. But a second cloud platform, a second operations team and two overlapping commitments are easily in that range for companies of this size, and none of it appears in either company's projections.
The questions I would have taken into the data room
- What does the full cloud bill look like at each company, by account and service, split between production SaaS, development and everything else?
- What is hosting cost per dollar of SaaS revenue, by quarter, and how does it change as customers move from self-managed licenses to SaaS?
- What usage forecast was each company's commitment sized against, and what is the shortfall under the buyer's case?
- Which commitments can be re-tranched, moved between services, or applied to the other company's workloads after close?
- Which combination path does the investment case assume, what does it cost, and how long do both platforms run in parallel?
- Which customers have contractual hosting, data residency or regional requirements that constrain where their identity data can move?
What the outside view cannot tell you
A lot. Neither company breaks hosting out from the rest of cost of revenue, and both include non-cloud items in their commitments. I do not know how the commitments were negotiated, whether they were renegotiated at change of control, or which integration path Thoma Bravo chose. Both companies are private now, and I have no view of their performance since.
None of this says either deal was mispriced. It says the cloud side of a combination was visible from public documents before either deal closed: two providers, two commitment calendars, one plan with no gross margin line and one with a flat one. That is enough to know what to ask, and in a deal like this one, which questions to ask is most of the work.
Teardowns like this one use only public information. For a target you are actually evaluating, including an add-on to an existing platform, the same analysis is done from the data room, with both cloud bills side by side. Related reading: Translating Cloud Infrastructure into Valuation Multiples, and the Integration Complexity Scorecard for scoring the combination. Book a free discovery call.