NortonLifeLock in Talks to Buy Avast

A deal could be completed this month, assuming talks don’t fall apart, according to people familiar with the matter. Avast has a market value of around £5.2 billion (around $7.2 billion). Assuming a typical deal premium, the deal could value the cybersecurity firm at more than $8 billion.

Avast said NortonLifeLock has until Aug. 11 to make a firm offer according to U.K. takeover code, which prescribes formal timelines.

Avast, which is based in Prague but trades in London, primarily makes both free and premium security software for consumers such as desktop security and server and mobile-device protection. The company says it has 435 million active users and its 2020 revenue was roughly $893 million.

The deal would be a big one for NortonLifeLock, based in Tempe, Ariz. With a market value of $16 billion, the company was known as Symantec Corp. before it closed a $10.7 billion deal to sell its enterprise-security business to Broadcom Inc. in 2019. What is left mainly sells Norton antivirus software and LifeLock identity-theft-protection products to consumers.

The company had attracted takeover interest of its own a few years ago, including from private-equity firms and a corporate suitor, but nothing has come of it.

Avast traces its roots back roughly 30 years to when founders

Pavel Baudiš

and

Eduard Kučera

established the company, then known as Alwil. The founders control roughly 35% of its shares and sit on its board.

The company says on its website that it rebuffed an acquisition offer from rival McAfee in 1997, instead licensing its antivirus software to the company. It became Avast in 2010 and went public in London in 2018, raising $200 million and commanding a market value of around $3.2 billion. In 2014, private-equity firm CVC Capital Partners took a significant minority stake and it held roughly 23% of the company at the time of the IPO.

Activist investor

Starboard Value

LP owns a roughly 3% stake in NortonLifeLock, according to FactSet, and holds a board seat. It first took the position in 2018, arguing the company needed to make operational changes to improve its margins. At the time, the business-facing segment made up about 60% of its revenue and was faring worse than the consumer business.

Software has been a particularly active sector for mergers and acquisitions as companies add more capabilities to their software-as-a-service offerings and compete to become one-stop shops for their customers.

Security has been particularly hot as several high-profile breaches affecting both consumers and businesses have underscored the importance of adequate protection. Microsoft Corp. this week agreed to buy RiskIQ, a small company founded in 2009 that helps companies track their vulnerability to digital threats.

Equifax Inc.’s

2017 breach that exposed the data of nearly 150 million Americans brought into focus how little control consumers have over their personal data and how it is shared. Since then, a steady stream of cyberattacks have interrupted everyday life, including in May, when the 5,500-mile Colonial Pipeline, crucial to the East Coast’s energy infrastructure, was temporarily shut down by its operator, leading to gasoline shortages in some places.

Write to Cara Lombardo at cara.lombardo@wsj.com and Dana Cimilluca at dana.cimilluca@wsj.com