Search fund
Buying and building a cybersecurity services company.
El Dorado Capital is looking for one founder-owned cybersecurity services, compliance or testing business, with $1.5M to $4M of EBITDA, to grow through add-on acquisitions over the next decade. The firm funds the search itself.
The thesis
Recurring revenue, fragmented ownership, founders approaching retirement
The cybersecurity market has roughly 3,900 vendors and several thousand more services firms. Most of the services firms are owned by their founders, employ 20 to 150 people, and have no succession plan. Their customers renew every year because the work is mandated by regulators, insurers and boards, not because it is fashionable.
That combination is why El Dorado Capital is buying one company rather than advising on a hundred. We have mapped the market in the Atlas of Cybersecurity. We have advised buyers and sellers across it for 20 years. We now intend to own a part of it.
What we look for
One business, chosen on its own merits
- Sector. A cybersecurity services, compliance or testing business headquartered in the United States.
- Size. $1.5M to $4M of EBITDA, profitable for at least 3 years.
- Revenue quality. At least 60% recurring or re-occurring revenue, with gross retention of 85% or better.
- Concentration. No customer above 15% of revenue.
- Ownership. A founder who wants a successor, a partial payout now, and a share in what the business becomes.
- Service lines. Managed detection and response, managed security services, compliance and audit (SOC 2, ISO 27001, PCI, CMMC, FedRAMP), penetration testing, identity implementation, incident response and forensics.
We do not pursue venture-backed software, hardware resale, staffing, or businesses that compete with the clients we advise.
The model
A structure in use since 1984, applied to one sector
A search fund is a structure first used at Stanford in 1984, in which a sponsor backs an operator to find, buy and run one company. The company is held for years rather than for a fund cycle.
El Dorado Capital's version differs in three ways. The firm funds the search itself from its advisory business, so there is no search fund being raised. Atul Tiwary has sourced, structured and integrated more than 30 acquisitions worth over $3B in aggregate, and the firm brings a market map of the entire cybersecurity landscape. And the add-on strategy is in place from day one. Atul Tiwary, Managing Partner, chairs the board. A recruited operator leads the business as CEO.
Process
Five steps from first call to close
- Introduction. A 30-minute call with Atul Tiwary. No materials needed.
- Fit. We share what we would pay and why, in writing, within 2 weeks of receiving 3 years of financials under NDA.
- Letter of intent. Price, structure, the founder's ongoing role and timetable, agreed before diligence starts.
- Diligence and financing. 60 to 90 days. We run it ourselves; the founder deals with one person.
- Close and transition. The founder stays for an agreed period and keeps a stake if they choose to.
For business owners
Thinking of selling
Most founders of security services firms have three choices: sell to a larger competitor and watch the brand disappear, sell to a financial buyer who installs a new team, or keep going. We offer a fourth. We buy the company you built, keep the people who built it, put a CEO in place whom you help choose, and give you the option to keep a stake in the larger company we build around it.
We pay a fair price for a well-run business. We do not pay for projections. If we are not a buyer, we say so at the fit stage and do not take up more of your time.
If you are 2 to 5 years from wanting to step back, the right time to talk is now, not when you are ready to sell.
For operators
One person to lead the company we acquire
The profile: 10 or more years in security operations, managed services or compliance; has run a P&L or a delivery organization of 30 or more people; has sold to mid-market CISOs or IT leaders; wants to own and run a company rather than manage a division of one.
The role begins during the search and becomes the CEO role at close. You will work directly with Atul Tiwary and the company's board. If that describes you, send a note and a CV through the form below.
FAQ
Questions we are asked
Is El Dorado Capital still an advisory firm?
Yes. Advisory is the core business. The search is a separate activity with its own governance and a conflicts policy that keeps the two apart.
Will you buy a company that competes with one of your advisory clients?
No.
What size of company?
$1.5M to $4M of EBITDA, which at typical services margins of 15% to 25% is roughly $6M to $25M of revenue.
Do you buy software companies?
Only as add-ons to a services platform, and only when the software is profitable with real recurring revenue.
Who runs the company after you buy it?
A recruited CEO with a security operations or services background, supported by the founder during a transition period, with Atul Tiwary as chair.
How is this different from private equity?
One company, bought for its own merits; a founder transition rather than a new team on day 1; and a hold measured in a decade rather than a fund cycle.
Can I invest?
El Dorado Capital funds the search from its own resources and is not raising a search fund. We do not offer or sell interests through this website.
Where does your market knowledge come from?
20 years of cybersecurity transactions, the Atlas of Cybersecurity, and the two books Atul Tiwary published in 2026, The Business of Cyber Security and The Agentic Edge.
Contact
Business owners and operators
Atul Tiwary, Managing Partner, El Dorado Capital.
atul@el-doradocapital.com
408-771-8703
Inquiries are read and answered personally.
This page is for information only and is not an offer or solicitation of any kind.