The Bending Spoons Screen, Applied: N-able and the Ten-Year Sponsor Hold

N-able is the first name in this series where the answer to "who would do this deal" is already on the share register. Silver Lake and Thoma Bravo own 59% of the company between them, have owned the asset since they took SolarWinds private in 2016, and ran a sale process for it in 2024 when the equity was reported at $2.3–2.5 billion. At a $4.15 close the equity is worth about $784 million. The screen still has to be run lever by lever, but the structural question comes first this time: a control block ten years into its hold, at roughly a third of the value it declined two years ago.

This is the fourth pass. Rapid7 scored as the richest fit, Tenable as the control case, and Trend Micro as the first company already paying the compute bill the thesis assumes away. N-able adds the channel case: a vendor that sells almost entirely through managed service providers, whose customers are themselves labor businesses.

The screen, briefly

Five levers, described in full on the value-creation page: buy mature recurring revenue at a depressed multiple; replace most of the acquired cost base with a shared platform; reprice a captive installed base; convert labor-delivered revenue into software economics; and finance a permanent hold out of the cash flows. Same scoring language as the first three passes, zeros included.

Lever 1 — entry price: cheap on every basis, for a reason

188.9 million shares at $4.15 is $784 million of equity. Add $398 million of term-loan principal and the $64 million still owed to Adlumin's sellers, which is cash out the door within twelve months and belongs in the bridge, and subtract $116 million of cash: enterprise value of about $1.13 billion. That is 2.1× the $540 million FY2026 revenue guide, 2.1× the $545 million of ARR, 7.1× the $160 million adjusted EBITDA guide and 9.6× the $118 million unlevered free cash flow guide. Against a public-cyber median near 5× revenue, only Rapid7 has screened cheaper.

Recurring quality clears easily: subscription is 99% of revenue. What does not clear is the reason for the price. On August 10, N-able cut its revenue and ARR guidance, disclosed that renewal rates in its largest cohort had come in in the mid-80s against a plan in the high-80s, concentrated in unified endpoint management (UEM) and EDR, and reported constant-currency net retention of 103%. The stock fell 36% on the day. An acquirer at 2× is not paying for growth it does not need. It is paying for a base under pressure in two of its product lines and compounding in one: Cove data protection, now above $200 million of ARR and leading net new ARR.

Lever 2 — the cost base: the widest gap yet, and management has started

About 2,000 employees against a $540 million guide is $270,000 of revenue per head, below Trend Micro's $288,000 and Rapid7's $329,000. The gap to Bending Spoons is 9.5×, the widest in the series. On a non-GAAP basis for the first half, gross margin ran 80%, sales and marketing 28% of revenue, R&D 18% and G&A 11%: total operating expense of 57% and an operating margin of 23%.

The modeled version, labeled as modeled: hold revenue at the guide, hold gross margin at 80%, and set operating expense at 45% of revenue, as for the three prior names. Operating income becomes about $188 million, a 35% margin, and the entry multiple on it is 6.0×, between Rapid7's 3.6× and Trend's 7.5×. One adjustment the adjusted figures hide: stock compensation runs about $44 million a year, 8% of revenue. Count it as the cost it is and the modeled margin is 27% and the multiple 7.8×.

Management has conceded the direction. The August call announced a 6% reduction in headcount in the second half, $11–13 million of annualized savings, and a new engineering center in Bengaluru. It also disclosed that 47% of committed code in the quarter was AI-generated. A 6% cut is incremental; the modeled bridge implies roughly $65 million of opex out on the non-GAAP base. The distance between those two numbers is the lever, and a public board with a guidance reset and a new CRO is not going to close it.

Lever 3 — repricing: near zero, and the renewal data says so

The argument for a score here is real. RMM and endpoint-management tools sit deep inside an MSP's operations, carrying its scripts, automation policies and ticketing integrations, and ripping one out is a quarter of disruption to the partner's own business. That is a genuine switching cost. It has not translated into pricing power. The Q2 renewal miss was attributed partly to pricing pressure in EDR, with customers renewing at lower price points or leaving, and N-able amended its SentinelOne agreement specifically to protect its endpoint pricing. The MSP channel is also a market with credible alternatives at every layer and partners who compare vendors professionally. Mid-80s renewal in the largest cohort describes a base being contested, not a captive one. Score it at or near zero.

Lever 4 — labor conversion: the lever sits at the customer

N-able has little labor-delivered revenue of its own: a managed detection and response SOC acquired with Adlumin and a new managed-EDR and incident-response offer, neither disclosed separately. Scored on the company's own book, this is a small partial.

The more interesting version is one step down the channel. N-able's 500,000 end customers are served by MSPs whose economics are technician hours. Pricing is largely per managed device, not per technician, so an agent that lets one technician run twice the endpoints does not shrink N-able's billing unit. It enlarges the MSP's capacity to sell. That is the right side of the automation trade for a tooling vendor, and management framed its roadmap that way: "begin monetizing agents" in 2027. The failure mode is sharper here than in any prior pass. An autonomous remediation error inside an RMM platform does not hit one customer; it propagates through every tenant the MSP manages, and the 2021 Kaseya VSA incident showed what a compromise of MSP tooling does downstream. E&O on agentic response delivered through a multi-tenant channel has to be underwritten before the revenue is counted. Partial score, with the liability flagged.

Lever 5 — structure: no forcing maturity, but a forcing calendar

The debt is not the catalyst. The term loan was upsized to $400 million and extended to November 2032 last year; net leverage is about 1.8× and there is nothing current. In Q2 the company added a $75 million delayed-draw facility on the same terms "as we evaluate capital allocation strategies," alongside a $45 million remaining buyback authorization. The balance sheet can carry a buyer.

The catalyst is the register. Silver Lake and Thoma Bravo have been in this asset since early 2016, through the SolarWinds take-private, the 2018 relisting and the 2021 spin. The 2024 process drew strategic and sponsor interest at an equity value about three times today's and did not transact. A 40% premium to the current price is $5.81 a share, about $1.10 billion of equity and $1.44 billion of enterprise value, or 9.1× guided adjusted EBITDA and 2.7× revenue. At 5× leverage that is roughly $800 million of debt against $160 million of EBITDA, a conventional level for recurring software at 30% EBITDA margins, before the spread the diligence flags below will add. Two diligence flags: a material weakness identified in Q2 2026 and a $1.3 million downward revision to Q1 revenue. Neither is disqualifying; both widen the spread. The situation is pre-configured, for the controlling holders more than for anyone else: the question is whether they sell the block, take it private themselves, or keep waiting on a recovery that the August guide says is not arriving in 2026.

The verdict, and the queue

Scored honestly: entry price, a full card on every basis. Cost base, the widest gap in the series, with management moving at a fraction of the modeled pace. Repricing, near zero; the renewal data settles it. Labor conversion, small on the company's own book and more interesting in the channel, with the multi-tenant liability named. Structure, no forcing maturity, but a controlling block a decade into its hold with a failed process behind it. The bet is retention again, as at Rapid7: whether the mid-80s UEM and EDR renewal rate stabilizes while data protection keeps compounding, or whether N-able becomes a backup company carrying an endpoint business in decline.

At about 9.6× unlevered free cash flow, a buyer is paying a normal cash multiple for a business that already earns 30% margins, and receiving the option on the cost math and the channel-agent roadmap without paying for either. That is the best option-to-price ratio since Rapid7. It also belongs, in the first instance, to the people who already own 59% of it. Next through the screen: a return to Rapid7 as its March 2027 converts go current, then a consumer-security name to test the one lever that has scored above zero only once.