The Bending Spoons Screen, Applied: Trend Micro at 2.1× Revenue

On August 13, Trend Micro held its revenue guide and cut its operating income guide by ¥12 billion. The reason given was not a lost deal or a pricing war. It was the cloud bill: GPU capacity, AI token consumption and sovereign-cloud build-out, which nearly doubled year over year to ¥12.7 billion in the June quarter alone. That makes Trend Micro the most useful name yet through this screen. The AI-acquirer thesis says a new owner replaces an expensive, people-heavy cost base with a shared intelligent platform. Trend is running that experiment on itself in public, and the first invoice has arrived.

It is the third pass. Rapid7 was the broken asset and scored as the richest fit; Tenable was the control case, well run and priced for it. I queued Trend as the name with a lapsed auction behind it. In February 2025, Reuters reported that Bain Capital, Advent, EQT and KKR had expressed interest in taking the company private at a time when the equity was worth ¥1.32 trillion (about $8.5 billion). Nothing transacted. Today the equity is worth about ¥849 billion, roughly 36% lower.

The screen, briefly

Five levers, described in full on the value-creation page: buy mature recurring revenue at a depressed multiple; replace most of the acquired cost base with a shared platform; reprice a captive installed base; convert labor-delivered revenue into software economics; and finance a permanent hold out of the cash flows. The same scoring language as the first two passes, including the zeros.

Lever 1 — entry price: cheap on revenue, ordinary on cash

At a ¥6,541 close, the 129.7 million shares outstanding are worth about ¥849 billion ($5.4 billion at ¥156). Trend carries no debt and reported ¥214.2 billion of cash at June 30, which puts the enterprise value near ¥634 billion — 2.1× this year's revenue guide of ¥301.5 billion and 2.4× the $1.7 billion of total ARR. Against a public-cyber group median near 5× on the same basis, that is the second-cheapest entry in the series after Rapid7.

The cash deserves a second look before anyone nets it. Trend's own investor materials track "holding cash" after deducting deferred revenue, and that figure has fallen from over ¥120 billion in FY22 to ¥4.0 billion at the end of June. Deferred revenue ran ¥236 billion at December 31. In plain terms, almost all of the cash on the balance sheet is customers' prepayments for service not yet delivered; it funds the obligation, not the purchase price. An acquirer who treats it as working capital rather than excess cash pays about 2.8× revenue and roughly 20× trailing free cash flow, not 2.1× and 15×. And the free cash flow itself is moving the wrong way: ¥42.6 billion over the twelve months to June, but only ¥0.2 billion in the June quarter. Recurring quality is high and the revenue multiple clears. The cash-flow multiple does not, and it is getting worse while the cloud bill grows.

Lever 2 — the cost base: the widest gap in the series, and the platform is already sending an invoice

Trend employs 6,711 people and guides to $1.93 billion of revenue this year: about $288,000 per employee, below Rapid7's $329,000 and well below Tenable's $501,000. The gap to the $2.57 million Bending Spoons disclosed in its prospectus is 8.9×, the widest yet. The mix is what you would expect of a company that grew up selling endpoint licenses through a global channel: sales and marketing about 35% of staff, R&D 31%, technical support 23%, administration 11%, with 54% of the workforce in APAC and the Middle East. On FY2025 Japanese-GAAP figures, cost of sales ran 23% of revenue and SG&A — which carries R&D under Japanese GAAP — 56%, for an operating margin of 21%.

The modeled version, clearly labeled as modeled: hold revenue at the ¥301.5 billion guide, hold gross margin at 73% (cost of sales was 27% of revenue in the June quarter), and set total operating expenses at 45% of revenue, the same assumption applied to Rapid7 and Tenable. Operating income becomes about ¥84 billion against the guided ¥44.4 billion, and the entry multiple on the modeled number is about 7.5× — between Rapid7's 3.6× and Tenable's 10.3×. Stock compensation is negligible here (¥1.4 billion in FY2025), so unlike the US names there is no GAAP-to-adjusted gap flattering the comparison.

Two things make the lever less clean than the arithmetic. First, management has already published most of the answer: a 2028 target of 25–27% operating margin with cost of sales back to 18–20% of revenue. The 45%-opex model lands at 28%, barely above the company's own plan. Second, and more interesting, the cost Trend is adding is not headcount. Headcount fell slightly in the June quarter while salaries and benefits rose 22% and cloud costs rose 87%. SaaS cost-to-serve rose 20% to $0.14 per dollar of SaaS ARR in the first half, reversing a 32% improvement the year before. The Bending Spoons model assumes the shared platform is close to free at the margin. At Trend the platform is metered, and in 2026 the meter is running faster than the payroll is shrinking. Anyone underwriting labor-to-compute substitution in security should put a token-cost line in the model, because this is the first public company where it moved guidance.

Lever 3 — repricing: zero on enterprise, and the first non-zero score in the series

On the enterprise side the answer is the same as at Rapid7 and Tenable. Endpoint, cloud workload and email security sell into professional procurement against Microsoft's E5 bundle and CrowdStrike's platform; Americas ARR declined 1% year over year in the June quarter. There is no captive base to reprice, and the company's own growth engine — Vision One, at 45% of enterprise ARR and growing 49% — runs on consolidation discounts, not price increases. Score it zero.

Trend is different because it also owns a consumer franchise: TrendLife, $374 million of ARR, about 22% of the total. That is the Evernote-shaped asset the playbook was built for — millions of individual subscriptions, low switching friction to stay, high friction to leave — and its fastest-growing product, Digital Life Protection, is up 52% to $137 million. The caution is the channel. A large part of the Japanese consumer book is sold through mobile-carrier shops, and a price set jointly with a carrier is not a price an owner can move unilaterally. A partial score, on a fifth of the ARR, with the carrier as the constraint.

Lever 4 — labor conversion: present, but not disclosed

Trend does have a labor-delivered book: managed detection and response, incident response and a technical-support organization of roughly 1,400 people, about a fifth of the company. Management says customers who attach services adopt 50% more solutions and carry 2.6× the average ARR, and that services adoption rose 21% in the quarter. What it does not disclose is services revenue or services gross margin, so the conversion trade — buy delivery labor at a services price, convert it to platform economics — cannot be sized from the outside. The direction is right; the 325 strategic MSPs now reselling Vision One, with MSP-channel ARR up 92%, suggest part of the labor is already being pushed to partners rather than converted internally. The liability point from the Rapid7 pass applies with more force here, because Trend is selling agentic response into regulated Japanese and European buyers: an autonomous containment error is a legal event, not a churn event, and the E&O has to be underwritten contractually before the margin is counted. Partial score, undisclosed.

Lever 5 — structure: nothing forcing, and nothing to borrow against

There is no debt maturity, no convert and no activist on the register. The co-founder holds about 4% directly; the largest holders are Japanese trust-bank custody accounts. What there is: a lapsed process that reportedly drew four sponsors at a value 36% above today's, a board that paid out ¥96 billion in dividends in 2024, most of it a special distribution, and runs a 70% payout policy, and a guidance cut that has reset expectations for 2026. The constraint on a leveraged buyer is visible in the same "holding cash" chart. With almost no excess cash, the purchase price has to be financed entirely on earnings, and earnings are being compressed by the very investment program a new owner would need to finish. On guided 2026 operating income plus FY2025 depreciation, EBITDA is roughly ¥72 billion, putting the entry near 9× on that proxy. That is financeable. It is not cheap enough to leave room for a token bill that has not yet peaked. Catalysts latent, and the lender's question — what the cloud line looks like in 2027 — is not one the company can answer yet.

The verdict, and the queue

Scored honestly: entry price, a full card on revenue and half a card on cash, because the cash belongs to customers. Cost base, the widest gap in the series, but management has already promised most of the harvest and the replacement cost is compute, not people. Repricing, zero on enterprise and the series' first partial score on the consumer book. Labor conversion, present but undisclosed. Structure, clean and quiet. The bet is not retention this time — Trend discloses 122% net retention on Vision One and 87% gross retention — it is the unit cost of intelligence: whether cost-to-serve per dollar of ARR turns back down by 2028 as the company says, or whether AI-native security turns out to carry a permanently higher cost of goods than the license business it replaces.

Three passes in, the screen has produced something the first two could not. Rapid7 and Tenable tested whether the playbook's levers exist. Trend tests whether the playbook's central assumption holds: that replacing people with a platform lowers the cost base. For one quarter, at one company, it raised it. That is not a verdict on the thesis, but it is the first observation in the public record that anyone modeling an AI-first acquisition in security should carry forward. Next through the screen: N-able, near 2× revenue with a leveraged balance sheet and sponsor control, and then a return to Rapid7 as its March 2027 converts go current.