Corporate Development Advisory · Cybersecurity
Strategy, sourcing, diligence and execution — and we stay on between transactions. Cybersecurity only, supported by a research practice maintained daily.
Each engagement sharpens the next
The function itself, run from outside: an acquisition mandate executed end to end for companies with no internal corporate development team.
Where growth is available and which assets no longer earn their place: adjacency, portfolio review, carve-out candidates, and the thesis that decides what to buy.
Target identification, outreach and a maintained pipeline — retained programs for acquirers and sponsor-backed platforms.
The decision before the deal: whether a capability is better built, acquired or partnered for, and what each path costs in time and money.
Market, competitive and customer diligence grounded in a continuously maintained view of the sector.
Precedent transactions, trading comparables, sub-segment maps and buyer universes — maintained daily, not assembled per engagement.
The practice is supported by senior operating advisors across go-to-market, fintech and enterprise AI — see About.
Also
Positioning, buyer identification across strategics, sponsors and adjacent acquirers, and negotiation to signing.
Investor identification across growth, strategic and sponsor capital — positioning, materials and negotiation to close.
Evidence
Seven completed public transactions — Imperva, SailPoint, Marketo and Roper on the success side; Websense/Forcepoint, At-Bay and Trustwave read as failures — for the mechanism that produced or destroyed the value rather than the headline return, with every multiple computed from the disclosed figures. The pattern across the successes: the revenue mix decided the multiple, the eventual buyer's portfolio gap decided the price, and none was won on cost. The failures share a different pattern: ownership fit that reversed, a category error in what kind of business was being priced, and a strategic parent's decade of disclosed decline. Each case states what it fails to prove.
Practice
Building the value a buyer or an investor will pay for, before a process begins. Cybersecurity only — the work rests on operating experience inside the sector and on a research practice maintained daily, not on a generic playbook applied to a security company.
ARR composition, gross and net retention, contract length and the customer concentration a buyer will discount: what the recurring line is actually worth, before anyone argues about the multiple.
Tiering, entitlements and list-to-net discipline across direct, MSP and channel routes — the place security vendors most often leave margin unclaimed.
Direct, channel, MSP and OEM economics set side by side: cost to acquire, cost to serve, and which motion has earned further investment.
Gross margin by product line, cloud and delivery cost, and the operating leverage available now — separated from the leverage that only arrives with growth.
A sequenced plan with owners, milestones and a financial bridge from current run rate to target, built to hold up under board, sponsor and lender scrutiny.
The equity story a buyer will underwrite and the evidence behind it: metrics pack, reporting cadence and a data room assembled before it is asked for.
How it runs
Retained engagements, typically alongside a transaction mandate or well ahead of one. Where the outcome is a sale, the same work becomes the sell-side position.
Timing is the part most boards get wrong. The evidence a buyer underwrites — retention cohorts, a pricing migration that has actually held, a metrics pack with history behind it — accumulates over quarters and cannot be assembled in the weeks before a process. The work is worth most when there is still time for it to show up in the numbers. Start a conversation.
Deep dive
AI is rewriting how software is built, sold, serviced and administered — and what the market pays for the result. The published evidence on where the value actually lands: the valuation ladder from 13× to 31× revenue, the honest engineering-productivity range against the vendor claims, the gross-margin reset, and the migration from seats to outcomes. Read for cybersecurity companies, with the delivery-model distinctions — software, appliance, managed service, channel — that decide how any of it applies to a security vendor.
Research
Search Fund
El Dorado Capital is looking for one founder-owned cybersecurity services, compliance or testing business, with $1.5M to $4M of EBITDA, to grow through add-on acquisitions over the next decade. The firm funds the search itself.
