Corporate Development Advisory · Cybersecurity
Strategy, sourcing, diligence and execution — and we stay on between transactions. Cybersecurity only, supported by a research practice maintained daily.
Each engagement sharpens the next
The function itself, run from outside: an acquisition mandate executed end to end for companies with no internal corporate development team.
Where growth is available and which assets no longer earn their place: adjacency, portfolio review, carve-out candidates, and the thesis that decides what to buy.
Target identification, outreach and a maintained pipeline — retained programmes for acquirers and sponsor-backed platforms.
The decision before the deal: whether a capability is better built, acquired or partnered for, and what each path costs in time and money.
Market, competitive and customer diligence grounded in a continuously maintained view of the sector.
Precedent transactions, trading comparables, sub-segment maps and buyer universes — maintained daily, not assembled per engagement.
Also
Positioning, buyer identification across strategics, sponsors and adjacent acquirers, and negotiation to signing.
Investor identification across growth, strategic and sponsor capital — positioning, materials and negotiation to close.
Practice
Building the value a buyer or an investor will pay for, before a process begins. Cybersecurity only — the work rests on operating experience inside the sector and on a research practice maintained daily, not on a generic playbook applied to a security company.
ARR composition, gross and net retention, contract length and the customer concentration a buyer will discount: what the recurring line is actually worth, before anyone argues about the multiple.
Tiering, entitlements and list-to-net discipline across direct, MSP and channel routes — the place security vendors most often leave margin unclaimed.
Direct, channel, MSP and OEM economics set side by side: cost to acquire, cost to serve, and which motion has earned further investment.
Gross margin by product line, cloud and delivery cost, and the operating leverage available now — separated from the leverage that only arrives with growth.
A sequenced plan with owners, milestones and a financial bridge from current run rate to target, built to hold up under board, sponsor and lender scrutiny.
The equity story a buyer will underwrite and the evidence behind it: metrics pack, reporting cadence and a data room assembled before it is asked for.
How it runs
Retained engagements, typically alongside a transaction mandate or well ahead of one. Where the outcome is a sale, the same work becomes the sell-side position.
Timing is the part most boards get wrong. The evidence a buyer underwrites — retention cohorts, a pricing migration that has actually held, a metrics pack with history behind it — accumulates over quarters and cannot be assembled in the weeks before a process. The work is worth most when there is still time for it to show up in the numbers. Start a conversation.
Deep dive
AI is rewriting how software is built, sold, serviced and administered — and what the market pays for the result. The published evidence on where the value actually lands: the valuation ladder from 13× to 31× revenue, the honest engineering-productivity range against the vendor claims, the gross-margin reset, and the migration from seats to outcomes. Read for cybersecurity companies, with the delivery-model distinctions — software, appliance, managed service, channel — that decide how any of it applies to a security vendor.
Evidence
Four completed public transactions — Imperva, SailPoint, Marketo and Roper — read for the mechanism that produced the value rather than the headline return, with every multiple computed from the disclosed figures. The pattern across them: the revenue mix decided the multiple, the eventual buyer's portfolio gap decided the price, and none of the four was won on cost. Each case also states what it fails to prove.
Research
A living map of the industry as an economy — transaction log, valuation benchmarks, investor coverage and weekly market updates, verified daily against primary sources.
