First Union Securities Changes Price Target for CHKP
03/29/01 07:59 AM
Source: First Union Securities
Company Notes:
Visit the CNET Brokerage Center for daily reports from the top Wall Street analysts.
Check Point Software Technologies Ltd. (CHKP-NASDAQ)
Target Price Change
CHKP: Getting Aggressive In Firewall/VPN Appliance Market
Rating: 2
Price: $50.50
52-Wk. Rng.: $119-39
Shares Out.: (MM) 264.0
Market Cap.: (MM) 13,332.0
Key Points
We expect Check Point to meet or slightly exceed our Q1 2001 estimates of $142MM in revenue and EPS of $0.28. Expect company
to reaffirm prior guidance of 50% revenue growth in 2001.
Demand for VPNs is holding up extremely well, despite deteriorating market conditions in other technology segments.
Check Point's recent announcement regarding its next-generation architecture is a crucial step toward capturing a larger percentage of
the high-growth, high performance firewall/VPN appliance market.
Check Point will leverage its strategic partnerships with Nokia, Broadcom, Intel, and others to drive faster throughput and performance
for its firewall and VPN appliances.
As VPN technology becomes increasingly embedded within network infrastructure, speed, performance, and scalability will become
critical purchasing criteria.
This next-generation architecture will allow Check Point to successfully compete against faster performance products from Cisco and
Netscreen in the high-end firewall/VPN appliance market. CHKP currently trades at only 40 times our 2001 EPS estimate of $1.28,
below what we believe is its sustainable growth rate of 45-50%. We reiterate our Buy (2) rating.
Company Description
Check Point Software Technologies Ltd. develops, markets and supports Internet security solutions for enterprise networks and service
providers including Virtual Private Networks, firewalls, intranet and extranet security and Managed Service Providers.
Discussion
DEMAND FOR VPN REMAINS STRONG
Despite the overall slowdown in technology spending, our recent checks confirm that demand for VPN solutions continues unabated.
The demand for VPNs is holding up extremely well in the midst of deteriorating capital spending environment for several reasons: 1) the
high ROI generated by VPNs through bandwidth cost savings, 2) relatively easy deployment which reduces implementation costs, and
3) the incremental nature of VPN deployments which gives companies the flexibility to make small, repeat purchases of VPN
equipment as they scale their VPNs.
While obviously not immune from a protracted downturn, we believe the VPN market, as the highest growth segment within the
security market, carriers less relative risk than other IT end markets. Thus far, the VPN market has been unscathed, and as a result,
we fully expect Check Point will meet our 1Q? estimates. There is growing concern, however, that if conditions deteriorate further, the
rate of VPN deployment may slow somewhat from current levels.
SERVICE PROVIDER MARKET REMAINS A WILDCARD
One of the fastest growing channels for Check Point in the last year has been the network service provider market (telecom carriers,
web hosters, ISPs, ASPs, etc.) with roughly 20% of revenue derived from this channel today. While network service providers are
experiencing robust demand for VPN managed services, one wildcard is the extent to which the negative capital spending environment
in the telco market is likely to impact the rate of VPN deployment among service providers. Our view is that VPN demand should
remain quite strong within this segment because it doesn't require additional network build-out, but rather serves as an overlay to
existing network capacity, allowing service providers to earn higher-margin revenue streams through outsourced VPN services.
CHKP ANNOUNCES NEXT GENERATION ARCHITECTURE TO IMPROVE VPN/FIREWALL PERFORMANCE
Earlier this week, Check Point announced a new architecture that will enable a 10-fold increase in VPN and firewall speed and
performance. This will enable Check Point to ultimately provide gigabit VPN/firewall security solutions to its high-end enterprise and
service provider customers. While the release dates of the announced products were not disclosed, we believe they should begin
shipping over the next several quarters.
Check Point is partnering with both hardware and semiconductor vendors to provide faster throughput and performance for its
VPN/firewall solutions. Initial partners include Nokia, Broadcom, Intel, Compaq, Intrusion.com, and RapidStream. These initial partners
encompass three broad categories:
1. Semiconductor vendors. Check Point is partnering with Broadcom and Intel that offer ASIC-based acceleration. Broadcom offers a
network processing unit (via Sibyte acquisition) and an IPSec cryptographic accelerator card (via the Bluesteel Networks acquisition).
Check Point will utilize Broadcom™s BCM5840 IPSec processor, which delivers security encryption and authentication algorithms at
multi-gigabit speeds. The BCM5840 sustains OC-48 wirespeed performance (2.4 Gbps) for DES, 3DES, HMAC-SHA-1, and
HMAC-MD5 IPSec processing. The BCM5840 will not likely ship until late 2001/early 2002. In an unrelated announcement, Check
Point also recently began shipping a VPN gateway utilizing Broadcom™s BCM5805 lower-end accelerator card that provides 300
Mbps throughput at 3DES. 4 Check Point will utilize Intel™s IXP 1200 network processing unit to accelerate packet processing to
improve its firewall throughput. However, as we understand it, Intel has had difficulty integrating and implementing its IXP 1200 network
processor (NPU) with software from other networking vendors. We do not expect any shipment of firewall appliances utilizing the IXP
1200 chip in the near-term.
2. Proprietary appliance vendors. This category includes partners that are implementing Check Point™s SecureXL API directly into
their own proprietary technology, rather than leveraging Broadcom™s or Intel™s technology. Rapidstream and Nokia are initial partners
in this category. Nokia also OEMs the Chrysalis and Broadcom acceleration cards to accelerate the performance of Check Point™s
VPN gateway.
3. Generic appliance vendors. This category includes partners that leverage third party acceleration technology, such as Broadcom™s
or Intel™s technology. Compaq and Intrusion.com are initial partners in this category.
VPN/FIREWALL APPLIANCE MARKET GAINING MOMENTUM
Hardware-based firewall and VPN security appliances are rapidly gaining in popularity given their low cost of ownership, easy
deployment and manageability, and highly scalable performance. According to Infonetics, the worldwide market for dedicated VPN
appliances is expected to grow to $4.2 billion in 2004 from $281 million in 1999, for a CAGR of 72%, whereas the software-only VPN
market is expected to grow to $2.1 billion in 2004 from $122 million in 1999.
Given the faster bandwidth connections available currently, it is critically important that Check Point™s VPN scale appropriately to
accommodate these faster speeds without becoming a processing bottleneck. While the majority of corporate internet connections
today are typically T-1 or T-2 lines, many enterprises are beginning to utilize much faster connections such as T-3 lines (45 Mbps) or
even higher, such as OC-1 (52 Mbps), or OC-2 (155 Mbps). As VPN functionality is increasingly becoming embedded directly into
hardware, Check Point™s challenge as a software-only vendor is to continue to focus on pushing the price/performance curve on its
VPN gateways.
If successful, these new initiatives should help Check Point compete in the very high end of the market against the likes of Netscreen,
Cisco, and Nortel, that are incorporating both firewall and VPN functionality into dedicated ASIC-based security appliances.
ASIC-based security appliances provide exceptional price/performance relative to a software-only solution. By improving the speed and
performance of its VPN/firewalls, Check Point™s security solutions can accommodate faster Internet connections without becoming a
bottleneck in the network.
CHECK POINT™S NEXT GENERATION ARCHITECTURE
An essential element of Check Point™s next generation software architecture is SecureXL. SecureXL is a software API that Check
Point has made available to its partners that enables packet processing to be offloaded onto hardware, significantly improving
performance and throughput. SecureXL™s modular design and APIs enable Check Point™s software to easily integrate with third-party
network processors and IPSec cryptographic accelerators. SecureXL™s open architecture enables easy integration with best-of-breed
appliance products.
End-to-end firewall/VPN acceleration requires two components: the network processor unit (NPU) and the IPSec cryptographic
accelerator. NPUs can be utilized to accelerate firewall performance by offloading the processing, examination, classification, and
forwarding of packets. Both Intel (via the Netboost acquisition) and Broadcom (via the Sibyte acquisition) offer NPU technology.
IPSec cryptographic accelerators are utilized to accelerate VPN performance by offloading processor intensive IPSec cryptographic
operations, such as DES and triple-DES encryption, SHA-1 and MD5 secure hash, random number generation, key generation, and
key management. Broadcom (via the Bluesteel Networks acquisition) offer this technology, but Intel does not, currently.
CHECK POINT ALREADY OFFERS HIGH THROUGHPUT VIA SOFTWARE-ONLY FIREWALL
Check Point currently offers 150-500 Mbps firewall-only throughput without the assistance of hardware acceleration. Nokia is the first
partner to incorporate elements of Check Point™s new performance architecture into its IP530 security appliance. For example, the
Check Point/Nokia IP530 security appliance currently offers 500 Mbps firewall-only throughput in a software-only solution. Nokia has
achieved this high-level of performance via a customized software implementation of Check Point™s SecureXL API. Nokia has tightly
integrated Check Point™s SecureXL API into its proprietary IPSO operating system (essentially, an optimized, high performance
version of free BSD via the Ipsilon acquisition). In addition, in lab tests, Check Point has achieved 400 Mbps throughput on a
software-only Linux platform.
Additional information available upon request.
First Union Securities, Inc. maintains a market in the common stock of CHKP.
This is for your information only and is not an offer to sell, or a solicitation of an offer to buy, the securities or instruments mentioned.
Interested parties are advised to contact the entity they deal with, or the entity that has distributed this report to them. The information
has been obtained or derived from sources believed by us to be reliable, but we do not represent that it is accurate or complete. Any
opinions or estimates contained in this information constitute our judgement as of this date and are subject to change without notice.
First Union Securities, Inc. (icFUSIle), or its affiliates may provide advice or may from time to time acquire, hold or sell a position in the
securities mentioned herein. FUSI is a subsidiary of First Union Corporation and is a member of the NYSE, NASD and SIPC. Copyright
© 2001 First Union Securities, Inc. FUSI is a separate and distinct entity from its affiliated banks and thrifts.
Information contained on this page is provided to CNET directly from the investment firm cited in this report.
investor.cnet.com |
