Security Software IPOs: Where'd They Go?

However, the public-offering bar has gotten a lot higher over the past several years, and regulatory costs are among the main concerns.

"Regulatory compliance makes being a small public company difficult," says Peter Christy, co-founder of the Internet Research Group. It "makes it less attractive to go public."

Companies now have to show they are Sarbanes-Oxley-ready, meaning they have gone through a financial audit and have sufficient internal controls, procedures and governance in place. The cost to become compliant typically runs in the millions, experts say.

Enrique Salem, former CEO of Brightmail and now head of Symantec's consumer business, says Sarbanes-Oxley was one of the factors in the company's decision to be acquired rather than go public. "You definitely think about the new scrutiny that SOX puts on a business," he says.

Because of the law, public companies spend more time, more resources and more money on their own governance, Magid says.

"Part of the appeal for a private vendor is that if the original investors can get a payout from their investments in a clean transaction -- without having to deal with all the regulatory burdens and having to deal with Sarbanes-Oxley -- it certainly requires a lot less ongoing maintenance," says Ed Maguire, an analyst with Merrill Lynch. Merrill Lynch does and seeks to do business with the companies it covers.

Another cost-saving factor driving startups toward choosing mergers is the ease of distribution. Salem says this was the case with Brightmail.

"When these companies buy the smaller companies, they can just put them in to their existing channels," says Ken Allen, an investment analyst with T. Rowe Price. Smaller companies don't have to build up their infrastructure, scale and overall capability by themselves.