Four completed sponsor-owned transactions — two in cybersecurity, one in adjacent enterprise software, one in industrials. Each is read for the same question: what actually produced the value, and what does the case fail to prove? The transactions are public. The figures are the parties' own disclosures or the reporting of them, and every derived multiple below is computed from those figures rather than quoted from a summary.
What this page is, and is notThese are third-party transactions used as evidence about a method. They are not El Dorado Capital engagements and no result here is claimed as the firm's own. Where a case is commonly cited as a value-creation success and the evidence does not support that reading, this page says so.
| Case | Entry | Exit or mark | Gross EV or equity multiple | Hold |
|---|---|---|---|---|
| Imperva — Thoma Bravo to Thales Application and data security | ~$2.1B (2018–19) | $3.6B (2023) | 1.7× | ~4.9 yrs |
| SailPoint — Thoma Bravo, re-listed Identity governance | $6.9B (2022) | ~$12.8B market cap at IPO (Feb 2025) | 1.9× — a mark, not a sale | ~2.5 yrs |
| Marketo — Vista to Adobe Marketing automation | ~$1.79B (2016) | $4.75B (2018) | 2.7× | ~2.1 yrs |
| Websense / Forcepoint — Raytheon to Francisco Partners The failure case, and the carve-out that reversed it | $1.9B for 80% (2015), implying $2.375B | ~$1.1B gross proceeds (2021); then one unit at $2.45B (2023) | 0.58× floor for the conglomerate; 2.23× for one unit against the whole entry | ~5.8 yrs, then ~2.5 yrs |
| Roper Technologies — public company Industrials to vertical software | n/a — a portfolio transformation, not a buyout | Software recurring revenue $1.20B in Q1 2026 | +14.3% recurring revenue, year over year | multi-decade |
Multiples are enterprise or equity value ratios computed from the disclosed headline figures. None of these transactions discloses its capital structure, so none of these is an equity return to the sponsor; leverage would raise each of them, and fees and timing would lower them. They are presented as directional evidence about mechanism, not as returns.
Thoma Bravo agreed to acquire Imperva, then a listed application and data security vendor, for approximately $2.1 billion, closing in January 2019. In July 2023 Thales agreed to acquire Imperva from Thoma Bravo for $3.6 billion, a gross enterprise-value multiple of 1.7× over roughly 4.9 years — an unlevered compounding rate near 11.6% before any effect of capital structure.
The instructive number is not the multiple but the basis. Thales stated the acquisition would add close to $500 million of security revenue, which puts the exit at roughly 7.2× revenue for an asset growing in the high single digits. No asset of that growth profile clears seven times revenue on its own merits. It cleared it because Thales was a defence and digital-identity group without an application and data security position, buying into a gap in its own portfolio — and a buyer closing a gap prices against the cost of building, not against the seller's comparables.
What transfers. The identity of the eventual buyer is a value-creation input, not an exit-year discovery. The work is to name, at entry, the two or three strategics whose portfolio gap this asset closes, and then to spend the hold period making the asset fit that gap — the integration surface, the customer overlap, the certification stack. What the case does not prove: that a strategic gap always exists. Thales was an unusually clean fit; many sponsor-owned security assets are sold to another sponsor precisely because no strategic gap was found.
Sources: Thoma Bravo / Thales announcement · TechTarget.
Thoma Bravo took SailPoint private in 2022 for $6.9 billion. In February 2025 SailPoint returned to Nasdaq, pricing at $23 per share above an initial $19–21 range, raising $1.38 billion and reaching a market capitalisation of approximately $12.8 billion — a 1.9× equity-value multiple in about 2.5 years. The prospectus estimated annual recurring revenue of $875–877 million for the year ended January 31, 2025, up roughly 41%, which puts the listing at about 14.6× ARR.
That combination — a mid-teens ARR multiple on forty percent growth — is the operating result, and it is a good one. The discipline the case teaches is in the next sentence: Thoma Bravo held approximately 88.5% of the company after the offering. The $12.8 billion is a valuation event, not cash. Roughly a tenth of the position was monetised and the rest remains exposed to the price at which the market will absorb the balance.
What transfers. When benchmarking a value-creation programme, separate the re-rating from the realisation. A public listing that leaves the sponsor with the overwhelming majority of the equity has proved the asset, not the exit; the underwriting question shifts from operating performance to the depth of the market for the remaining stake. What the case does not prove: the final return, which is not yet knowable.
Sources: TechCrunch on the 2022 take-private · Bloomberg via Yahoo Finance on the IPO.
Vista Equity Partners took Marketo private in 2016 for approximately $1.79 billion. Adobe acquired it in September 2018 for $4.75 billion — a gross multiple of 2.7×, a gain of about $2.96 billion, or 165%, in roughly 2.1 years. It is the shortest hold of the five cases and the highest multiple, which is the point worth extracting.
Hold period and multiple are not positively correlated, and the assumption that a longer hold permits more value creation is the wrong way round for a scarce asset in a contested category. Adobe was competing with Salesforce and Oracle for a marketing-automation position it had decided it needed. Contest compresses timelines and raises prices simultaneously. The operating work Vista did — pricing discipline, go-to-market rebuild, cost structure — mattered because it made the asset creditable at the moment two large buyers were forced to act, not because it had years to compound.
What transfers. In a consolidating sub-segment, the value-creation plan and the timing of the process are the same decision. Readiness that arrives after the contest is over is worth materially less than the same readiness delivered into it. What the case does not prove: that speed alone works. Vista's operating programme was substantive; the short hold amplified it rather than substituted for it.
The adjacent case is deliberately not a buyout. Roper Technologies spent two decades converting itself from a diversified industrial products company into a portfolio of vertical software businesses. In the quarter ended March 31, 2026, application and network software together accounted for roughly 77% of revenue, and software-related recurring revenue reached $1.2045 billion, against $1.0536 billion a year earlier — growth of 14.3%. Recurring revenue is now more than half the company.
Roper did not cut its way to a software multiple. It changed what fraction of revenue was recurring, and the market re-rated the mix. That is the single most transferable observation on this page for a security platform, because the security industry contains a great deal of revenue that is described as recurring and is not: multi-year perpetual-plus-maintenance appliance revenue, project-based professional services, and reseller-mediated renewals with no direct customer relationship behind them.
What transfers. Before a value-creation plan targets margin, it should establish honestly what proportion of revenue is genuinely recurring, contracted and direct — because the mix, not the margin, is what the exit multiple is set against. What the case does not prove: that the transformation is quick. Roper's took decades and a very large number of acquisitions; the mechanism transfers, the timescale does not.
Source: Roper Technologies segment disclosures (SEC filings).
The cases above all worked. This one did not, and it is the most instructive on the page because the assets barely changed while the outcome changed three times.
Vista Equity Partners bought Websense in 2013 for $906 million. In April 2015 Raytheon acquired 80% of it for $1.9 billion, which implies a whole-company value of $2.375 billion — a 2.62× step-up on Vista's entry in about two years. Raytheon renamed the business Forcepoint, added acquisitions to it, and bought Vista's remaining 20% in 2019 on undisclosed terms. In January 2021 it sold the whole company to Francisco Partners for approximately $1.1 billion in gross proceeds. Against the 2015 purchase price of the 80% tranche alone that is 0.58×, a shortfall of at least $800 million before counting the 20% stake or any bolt-on. Two and a half years later, in July 2023, Francisco agreed to sell one of the two businesses — Forcepoint Global Governments and Critical Infrastructure — to TPG for $2.45 billion, and kept the commercial business. One unit realised 2.23× the price paid for the entire company.
The mechanism. Nothing in the technology accounts for a 2.62×, then a 0.58×, then a 2.23× on substantially the same assets. What changed was ownership fit and structure. A defense prime bought a business whose government unit fitted its franchise and whose commercial unit did not — different buyers, different sales motion, different capital cycle — and ran them as one. The sponsor that followed separated them, which let the government and critical-infrastructure business be priced by the buyers who wanted precisely that capability rather than blended with a commercial security business competing against platforms. The value was released by disaggregation, not by operating improvement.
What transfers. A platform assembled from parts that do not share a buyer will be priced by the weaker part. Establishing early which units have distinct natural buyers — and whether they can be separated cleanly — is a value-creation question, not only an exit question. What the case does not prove: the figures are not like for like. The $1.1 billion is whole-company gross proceeds to a seller; the $2.45 billion is one unit's transaction value. Neither is a fund return, and neither is stated net of leverage, fees, or capital invested during the hold. Raytheon's total invested capital is not disclosed, so 0.58× is a floor on the shortfall rather than a measurement of it. Nor does the case isolate operating value creation from the 2023 bid environment for government-security assets, which may account for part of the carve-out price. And it is one observation: it does not establish that conglomerate ownership of commercial security fails generally.
Sources: Washington Technology — TPG to buy Forcepoint's public sector unit for $2.45B (July 10, 2023) · Francisco Partners to acquire Forcepoint from Raytheon Technologies (October 26, 2020) · Francisco Partners completes acquisition of Forcepoint (January 2021).
Read together, the five cases point at four things a security platform can act on during a hold period, and one it should stop doing.
The connecting thread is that in each case the value came from changing what the business was — its revenue mix, its fit to a specific buyer, its readiness at a specific moment — rather than from changing what it cost to run. Cost programmes are faster to execute and easier to measure, which is why they dominate the first year of most hold periods.
A current example of the same logic, offered as a live illustration rather than as evidence. On 1 September 2026 CrowdStrike introduced Falcon Guardian, entering agent-runtime security — a category in which at least a dozen venture-funded independents were already competing — without acquiring any of them. The stated reason was an asset it already held: a sensor deployed across its installed endpoint base that already observes process execution, which is where the enforcement point for an executing agent sits. That is the inverse of the Imperva lesson above and it is worth stating alongside it. Imperva was priced by what it would have cost Thales to build; Falcon Guardian is an incumbent concluding that in this category the build cost was the lower number, because the expensive component was distribution rather than technology and the distribution was already installed. The operative diligence question for a platform is therefore which of its deployed assets a competitor would have to buy — and, in a portfolio company, whether such an asset exists at all, since a platform without one competes on product in a category where the incumbent competes on reach.
What this illustration does not establish, stated explicitly. It is a product launch, not a realised outcome. No revenue, attach rate, customer count or competitive displacement has been reported, none is estimated here, and the announcement itself lists several components in the future tense. It therefore supports the strategic reasoning and proves nothing about the value created — unlike the five completed transactions above, each of which resolves to a disclosed price. It also cuts both ways for a sponsor holding an asset in that category: an incumbent that builds is a bidder removed from the demand side rather than added to it, and where acquirers pay for capability they can cross-sell rather than for standalone ARR, the number of remaining bidders is what sets the price. Source: CrowdStrike, 1 September 2026.
Each multiple on this page is computed from consideration as disclosed by the parties, and the distinction matters more in 2026 than it used to. The value attached to a transaction in press coverage is struck on the day of announcement; the figure the acquirer records at closing is set months later under accounting rules, and for large stock-funded deals the two diverge. The two biggest security transactions on record are the current illustration. Alphabet announced Wiz at $32.0 billion and records the completed acquisition at $29.5 billion after purchase price adjustments; Palo Alto Networks announced CyberArk at $25.0 billion and records $21.1 billion, because the consideration was roughly 88% stock, the exchange ratio fixed the share count at signing, and the share price was fixed seven months later at closing. The gaps are 7.9% and 15.8% respectively. Alphabet Form 10-Q, quarter ended 30 June 2026 · Palo Alto Networks Form 10-Q, quarter ended 30 April 2026.
The consequence for a value-creation plan is practical rather than technical. A target multiple set from headline comparables is set against a number the acquiring side does not carry in its own accounts, and the error is neither constant nor small — it runs with the stock component of the consideration and with the interval between signing and closing, so it is largest on exactly the deals a platform asset is most likely to be measured against. Where a plan is underwritten to a specific exit multiple, the basis of the comparables should be stated alongside the multiple. None of the four successful cases above was won on cost, and the one failure was not lost on cost either.
A second basis problem sits on the growth rate rather than on the consideration, and it is the one that moves a target multiple most, because growth is the largest single driver of what a platform is priced at. Six listed security companies reported the quarter ended 31 July 2026. Two had made an acquisition material to the reported rate. Zscaler published the adjustment itself, disclosing that Red Canary contributed $141M of ARR and that growth excluding it was 20% against the reported 25%. Palo Alto Networks disclosed the acquired ARR and left the arithmetic, which resolves a reported +63% in Next-Generation Security ARR to roughly 34% organic. Three names needed no adjustment at all. One — Rubrik, at a reported +33% subscription ARR, the second-highest rate on the panel — closed an acquisition inside the comparison window and disclosed neither consideration nor contribution, so its organic rate cannot be computed from public disclosure. The organic rate is recoverable for five of the six, and for only one of them because the company chose to publish it. Zscaler Q4 FY2026 results · Rubrik Q2 FY2027 results.
The consequence is that a comparable set ranked on reported growth is ranked on figures produced differently, and the error is silent: nothing on the face of a screen distinguishes a rate that has been adjusted from one that cannot be. Where a plan is underwritten to a growth-based exit multiple, the disclosure state of each comparable belongs beside its rate — adjusted by the company, derivable from disclosure, not required, or not recoverable. No estimate is offered here for a name in the fourth state. A growth rate that cannot be computed from disclosure is not improved by being guessed at, and a platform whose own reported growth carries an undisclosed acquired component will be read the same way by a buyer's diligence team.
Informational only; not investment advice. Nothing here draws on confidential client information. All transactions cited are public.