Value creation

The value a buyer pays for is built before the process starts.

A buyer's diligence team checks two things: whether the numbers recur and hold, and whether the operations can produce them without the current owner. Both are visible in the data room before a process begins. A seller who has not prepared them pays for the gap in price, timing or the buyer list.

This page sets out six areas where that preparation decides the outcome. Each section states the claim, what we examine, and what good looks like. Where the argument is a number, the number is shown as a visual. Figures are from the sources named on each visual. Figures appear only where the source is named.

1. Revenue quality

Buyers pay for revenue that recurs, is contracted and is retained. Booked revenue sets where the conversation starts. The mix sets which multiple applies.

Cybersecurity revenue arrives through four delivery models: subscription software, appliance plus maintenance, managed service and professional services. Each comps to a different range. A single blended multiple across them is the error a buyer spots first.

What we examine

Revenue by delivery model. Net revenue retention by cohort. Contracted versus usage revenue. Concentration by customer and by channel partner.

What good looks like

Recurring share reported by delivery model. Cohort retention shown for at least three years. No single customer or channel partner above a threshold set before the process starts.

Private cybersecurity companies were priced at 12.5x revenue, about double public peers at 6.3x Bar chart of EV/revenue: public 6.3x, M&A 11.2x, private 12.5x Private cybersecurity companies were priced at 12.5x revenue, about double public peers at 6.3x EV/revenue by valuation regime. 6.3x 11.2x 12.5x Public companies Completed M&A Private companies Source: El Dorado Capital, Cyber Security Wiki — valuation benchmarks.
Figure 1. Bars start at zero.

2. Pricing and packaging

The pricing model decides which multiple a buyer applies. Seat pricing competes for the IT budget. Outcome pricing competes for the labor budget.

A seat contract revenue falls when one agent does the work of five users, while delivered value rises. That leak shows up in renewal cohorts long after the decision to delay was taken. The transition is a timing decision with option value on both sides. It belongs on the board agenda before the cohorts weaken.

What we examine

Price per seat across renewal cohorts. Share of contract value on usage or outcome terms. Inference cost per workflow. Traction of AI capability sold as a separate product.

What good looks like

AI capability sold as a separately priced product, not given away as retention insurance. Contribution margin tracked by customer, not only at company level.

Seat pricing competes for the IT budget; outcome pricing competes for the labor budget Two-model diagram: seat model versus outcome model, with a hybrid transition arrow Seat pricing competes for the IT budget; outcome pricing competes for the labor budget Seat model Sells access per user Competes for the IT budget Revenue = seats x price x retention Outcome model Sells completed work Competes for the labor budget Revenue = workflows x value x usage x retention, less inference cost Hybrid transition: keep the subscription base, add separately priced AI SKUs Source: El Dorado Capital, Value creation in the AI age, sections 1 and 3. No figures on this diagram. The page gives no figure for the labor budget.
Figure 2. Diagram, not to scale. Carries no numbers because the pricing shift has no sourced figure on the page.

McKinsey finds that incumbents commercializing standalone AI products see two to three times higher traction. The practical implication is to price AI as its own product, not to bundle it into the subscription at no charge.

3. Route to market

The channel sets the speed limit. A pricing or product change the channel cannot sell does not ship.

Cybersecurity sells through partners at a scale that few other software sectors match. Two-tier distribution, deal registration and margin stacking decide how far a vendor can discount and how fast it can move its installed base onto a new commercial model. A pricing migration designed without the channel in the room does not reach customers.

What we examine

Share of bookings through channel. Deal registration rules and whether they cover the new product. Partner concentration. Partner margin stack against the new pricing.

What good looks like

Partners trained on the commercial model before it changes. Deal registration rules that do not block the new SKU. Partner economics modeled before any price change is announced.

4. Cost and margin structure

Margin by delivery model is the number a buyer tests first. AI changes the cost of each layer, and most of the change is in how inference is priced and managed.

Gross margin in software is structurally high. Services carry lower margins because the cost is people. AI adds a variable cost that traditional software did not carry, so the margin has to be earned on every workflow, not assumed at company level. A sponsor should also expect the AI-native margin to start low and recover through management.

What we examine

Gross margin by layer: application, model inference, cloud. Contribution margin by workflow and by customer. G&A as a share of revenue. Cost per accepted unit of product work.

What good looks like

Inference cost tracked as a variable cost of delivery, with model routing, caching and usage controls in place. G&A at or below the private software median, with a defined path to lower it.

AI-native application gross margins start at 0 to 30%, against 80%+ for traditional software Range chart of gross margin by layer, traditional versus AI-era AI-native application gross margins start at 0 to 30%, against 80%+ for traditional software Gross margin by layer, %. Application, traditional Application, AI-native (initial) Model inference Cloud infrastructure 0255075100 80%+ 0 to 30% 30 to 60% ~60% Source: Battery Ventures, The State of AI Report, December 2025.
Figure 3. Bars run from zero on a 0 to 100 scale.

Support unit economics

Support is the clearest near-term economics in the program. Gartner-cited figures put a self-service contact at about $1.84 and an agent-assisted contact at about $13.50. The deflected interaction is about seven times cheaper. That is why support leads the sequence in section 5.

5. The value creation plan

A plan with an owner, a date and a conversion mechanism is the only plan a buyer credits. Time saved does not count until it reaches the P&L.

Every initiative needs a baseline, a target, an owner and a named mechanism by which the saving reaches the income statement, such as avoided hiring, vendor consolidation or a repriced contract. Savings that stay as hours saved are the reason most programs fail diligence. A scale-or-stop gate at 30 and 90 days forces the decision.

Sequence

Support and the IT service desk first, because the unit economics are clearest. Engineering assistance with a validation layer second. Finance close, contracts and HR third. Go-to-market redesign next. AI-native product and pricing last, with discovery running in parallel from the start and shipping inside twelve months.

Value is realized in five sequenced workstreams, each with one owner and one gate Sequenced plan diagram with owners and milestones, and a financial bridge concept Value is realized in five sequenced workstreams, each with one owner and one gate 1. Support and IT service desk Owner: Head of Support Gate: 30/90-day scale-or-stop 2. Engineering with validation layer Owner: CTO Gate: lead time and change-failure baseline 3. Finance close, contracts, HR Owner: CFO Gate: savings enter the bridge only when realized 4. Go-to-market redesign Owner: CRO Gate: hybrid pricing on the existing book 5. AI-native product and pricing Owner: CEO with CPO Gate: shipped within 12 months Financial bridge (concept; not to scale) Baseline + realized support + realized engineering + realized G&A / run-rate Owners are roles, not names. Sequence per Value creation in the AI age, section 8. Only realized conversion enters the bridge; no theoretical time savings. Sources: El Dorado Capital, Value creation in the AI age, sections 5 and 8. Bridge values are entered from each company's baseline.
Figure 4. Plan diagram. The bridge is a concept until a company baseline is supplied.

6. Exit readiness

A buyer tests the evidence and the buyer universe at the same time. The same company is worth different amounts to different buyers, and timing changes which buyers are active.

Exit readiness is the state in which every number a buyer will ask for is already verified, the data room reflects the current business, and the list of likely acquirers has been worked before the first call. A seller who starts the list after the process begins loses the leverage that comes from having more than one interested party.

What we examine

Verified financials by delivery model. Data room completeness. Buyer universe by strategic rationale. Timing against the current deal market.

Market context

MeasureValuePeriodSource
Cybersecurity M&A, deal count4042025 (full year)Momentum Cyber
Cybersecurity M&A, total deal value$97B2025 (full year)Momentum Cyber
Cybersecurity M&A, deal count117Q3 2026 (quarter)Momentum Cyber
Transactions, disclosed value$8.9BOctober 2026 (month)Momentum Cyber, October 2026 review

Annual and quarterly figures are not directly comparable and are not charted together. Other published counts differ: SecurityWeek records 426 deals and $92.5B for 2025; Wall Street research records 339 deals and $84.1B. Momentum Cyber governs for market counts under the project's figures of record. Momentum's October components sum to $9.0B against its stated $8.9B total, which is a rounding difference in the source.

What good looks like

Every figure in the data room traced to a source and a period. A buyer list worked and ranked before launch. A timetable set against the deal calendar, not against the seller's cash need.