Seven completed transactions — five in cybersecurity and cyber insurance, one in adjacent enterprise software, and one public-company portfolio transformation in industrials. Ownership varies deliberately across the set: sponsor buyouts, a conglomerate carve-out, a strategic telecom's single decade-long hold, and a venture-backed insurtech sale — because the cases with no financial sponsor in the chair are the ones that show most clearly what ownership structure does and does not explain. Each is read for the same question: what actually produced the value, and what does the case fail to prove? The transactions are public. The figures are the parties' own disclosures or the reporting of them, and every derived multiple below is computed from those figures rather than quoted from a summary.
What this page is, and is notThese are third-party transactions used as evidence about a method. They are not El Dorado Capital engagements and no result here is claimed as the firm's own. Where a case is commonly cited as a value-creation success and the evidence does not support that reading, this page says so.
| Case | Entry | Exit or mark | Gross EV or equity multiple | Hold |
|---|---|---|---|---|
| Imperva — Thoma Bravo to Thales Application and data security | ~$2.1B (2018–19) | $3.6B (2023) | 1.7× | ~4.9 yrs |
| SailPoint — Thoma Bravo, re-listed Identity governance | $6.9B (2022) | ~$12.8B market cap at IPO (Feb 2025) | 1.9× — a mark, not a sale | ~2.5 yrs |
| Marketo — Vista to Adobe Marketing automation | ~$1.79B (2016) | $4.75B (2018) | 2.7× | ~2.1 yrs |
| Websense / Forcepoint — Raytheon to Francisco Partners The failure case, and the carve-out that reversed it | $1.9B for 80% (2015), implying $2.375B | ~$1.1B gross proceeds (2021); then one unit at $2.45B (2023) | 0.58× floor for the conglomerate; 2.23× for one unit against the whole entry | ~5.8 yrs, then ~2.5 yrs |
| At-Bay — venture-backed to Munich Re The second failure case: a cyber MGA priced as insurance distribution | $1.35B post-money (Jul 2021) | $575M enterprise value (agreed Aug 2026) | 0.43× — a 57.4% decline | ~5.1 yrs |
| Trustwave — Singtel to Chertoff Group's fund The third failure case: a strategic telecom's decade-long hold, sold via a seller-financed note | $770M for 98% (closed Sep 2015), $786M implied 100% | $205M for 100% (closed Jan 2024) | 0.26× — a 73.9% decline | ~8.3 yrs |
| Roper Technologies — public company Industrials to vertical software | n/a — a portfolio transformation, not a buyout | Software recurring revenue $1.20B in Q1 2026 | +14.3% recurring revenue, year over year | multi-decade |
Multiples are enterprise or equity value ratios computed from the disclosed headline figures. None of these transactions discloses its capital structure, so none of these is an equity return to the sponsor; leverage would raise each of them, and fees and timing would lower them. They are presented as directional evidence about mechanism, not as returns.
Thoma Bravo agreed to acquire Imperva, then a listed application and data security vendor, for approximately $2.1 billion, closing in January 2019. In July 2023 Thales agreed to acquire Imperva from Thoma Bravo for $3.6 billion, a gross enterprise-value multiple of 1.7× over roughly 4.9 years — an unlevered compounding rate near 11.6% before any effect of capital structure.
The instructive number is not the multiple but the basis. Thales stated the acquisition would add close to $500 million of security revenue, which puts the exit at roughly 7.2× revenue for an asset growing in the high single digits. No asset of that growth profile clears seven times revenue on its own merits. It cleared it because Thales was a defense and digital-identity group without an application and data security position, buying into a gap in its own portfolio — and a buyer closing a gap prices against the cost of building, not against the seller's comparables.
What transfers. The identity of the eventual buyer is a value-creation input, not an exit-year discovery. The work is to name, at entry, the two or three strategics whose portfolio gap this asset closes, and then to spend the hold period making the asset fit that gap — the integration surface, the customer overlap, the certification stack. What the case does not prove: that a strategic gap always exists. Thales was an unusually clean fit; many sponsor-owned security assets are sold to another sponsor precisely because no strategic gap was found.
Sources: Thoma Bravo / Thales announcement · TechTarget.
Thoma Bravo took SailPoint private in 2022 for $6.9 billion. In February 2025 SailPoint returned to Nasdaq, pricing at $23 per share above an initial $19–21 range, raising $1.38 billion and reaching a market capitalization of approximately $12.8 billion — a 1.9× equity-value multiple in about 2.5 years. The prospectus estimated annual recurring revenue of $875–877 million for the year ended January 31, 2025, up roughly 41%, which puts the listing at about 14.6× ARR.
That combination — a mid-teens ARR multiple on forty percent growth — is the operating result, and it is a good one. The discipline the case teaches is in the next sentence: Thoma Bravo held approximately 88.5% of the company after the offering. The $12.8 billion is a valuation event, not cash. Roughly a tenth of the position was monetized and the rest remains exposed to the price at which the market will absorb the balance.
Eighteen months of post-listing reporting now allow the operating half of the case to be checked rather than assumed, and it has held. For the quarter ended 31 July 2026 SailPoint reported annual recurring revenue of $1.231 billion, against the $875–877 million estimated in the prospectus — growth of 40.5% over the eighteen months, or about 25.5% compounded. Two further disclosures describe how the second phase is being built. First, the company has continued to buy capability rather than only build it, and the prices are small relative to the asset: its filings put the Entro Security purchase at $122.6 million in cash and the earlier Savvy asset purchase at $18.4 million, so roughly $141 million of capability acquisition since listing. Second, it now reports a dedicated AI-driven ARR line, disclosed at above $70 million and targeted at at least $800 million by fiscal 2029, with existing customers who adopt one of those modules raising annual spend by more than 60%. What this does not establish: the AI line is not attributable to the acquisitions — the company built the underlying platform itself — so the $141 million cannot be credited with the $70 million, and no such attribution is made here.
What transfers. When benchmarking a value-creation program, separate the re-rating from the realization. A public listing that leaves the sponsor with the overwhelming majority of the equity has proved the asset, not the exit; the underwriting question shifts from operating performance to the depth of the market for the remaining stake. The eighteen months since add a second transferable point: where a platform can attach a new module to seats its customers already hold, the expansion rate on the installed base is the cheapest growth available to it, and it is bought at capability prices rather than at platform prices. What the case does not prove: the final return, which is not yet knowable — the sponsor's remaining stake has still not been sold.
Sources: TechCrunch on the 2022 take-private · Bloomberg via Yahoo Finance on the IPO · SailPoint Form 8-K, Exhibit 99.1, 9 September 2026 · SailPoint Form 10-Q, quarter ended 31 July 2026.
Vista Equity Partners took Marketo private in 2016 for approximately $1.79 billion. Adobe acquired it in September 2018 for $4.75 billion — a gross multiple of 2.7×, a gain of about $2.96 billion, or 165%, in roughly 2.1 years. It is the shortest hold of the seven cases and the highest multiple, which is the point worth extracting.
Hold period and multiple are not positively correlated, and the assumption that a longer hold permits more value creation is the wrong way round for a scarce asset in a contested category. Adobe was competing with Salesforce and Oracle for a marketing-automation position it had decided it needed. Contest compresses timelines and raises prices simultaneously. The operating work Vista did — pricing discipline, go-to-market rebuild, cost structure — mattered because it made the asset creditable at the moment two large buyers were forced to act, not because it had years to compound.
What transfers. In a consolidating sub-segment, the value-creation plan and the timing of the process are the same decision. Readiness that arrives after the contest is over is worth materially less than the same readiness delivered into it. What the case does not prove: that speed alone works. Vista's operating program was substantive; the short hold amplified it rather than substituted for it.
The adjacent case is deliberately not a buyout. Roper Technologies spent two decades converting itself from a diversified industrial products company into a portfolio of vertical software businesses. In the quarter ended March 31, 2026, application and network software together accounted for roughly 77% of revenue, and software-related recurring revenue reached $1.2045 billion, against $1.0536 billion a year earlier — growth of 14.3%. Recurring revenue is now more than half the company.
Roper did not cut its way to a software multiple. It changed what fraction of revenue was recurring, and the market re-rated the mix. That is the single most transferable observation on this page for a security platform, because the security industry contains a great deal of revenue that is described as recurring and is not: multi-year perpetual-plus-maintenance appliance revenue, project-based professional services, and reseller-mediated renewals with no direct customer relationship behind them.
What transfers. Before a value-creation plan targets margin, it should establish honestly what proportion of revenue is genuinely recurring, contracted and direct — because the mix, not the margin, is what the exit multiple is set against. What the case does not prove: that the transformation is quick. Roper's took decades and a very large number of acquisitions; the mechanism transfers, the timescale does not.
Source: Roper Technologies segment disclosures (SEC filings).
The cases above all worked. This one did not, and it is the most instructive on the page because the assets barely changed while the outcome changed three times.
Vista Equity Partners bought Websense in 2013 for $906 million. In April 2015 Raytheon acquired 80% of it for $1.9 billion, which implies a whole-company value of $2.375 billion — a 2.62× step-up on Vista's entry in about two years. Raytheon renamed the business Forcepoint, added acquisitions to it, and bought Vista's remaining 20% in 2019 on undisclosed terms. In January 2021 it sold the whole company to Francisco Partners for approximately $1.1 billion in gross proceeds. Against the 2015 purchase price of the 80% tranche alone that is 0.58×, a shortfall of at least $800 million before counting the 20% stake or any bolt-on. Two and a half years later, in July 2023, Francisco agreed to sell one of the two businesses — Forcepoint Global Governments and Critical Infrastructure — to TPG for $2.45 billion, and kept the commercial business. One unit realized 2.23× the price paid for the entire company.
The mechanism. Nothing in the technology accounts for a 2.62×, then a 0.58×, then a 2.23× on substantially the same assets. What changed was ownership fit and structure. A defense prime bought a business whose government unit fitted its franchise and whose commercial unit did not — different buyers, different sales motion, different capital cycle — and ran them as one. The sponsor that followed separated them, which let the government and critical-infrastructure business be priced by the buyers who wanted precisely that capability rather than blended with a commercial security business competing against platforms. The value was released by disaggregation, not by operating improvement.
What transfers. A platform assembled from parts that do not share a buyer will be priced by the weaker part. Establishing early which units have distinct natural buyers — and whether they can be separated cleanly — is a value-creation question, not only an exit question. What the case does not prove: the figures are not like for like. The $1.1 billion is whole-company gross proceeds to a seller; the $2.45 billion is one unit's transaction value. Neither is a fund return, and neither is stated net of leverage, fees, or capital invested during the hold. Raytheon's total invested capital is not disclosed, so 0.58× is a floor on the shortfall rather than a measurement of it. Nor does the case isolate operating value creation from the 2023 bid environment for government-security assets, which may account for part of the carve-out price. And it is one observation: it does not establish that conglomerate ownership of commercial security fails generally.
Sources: Washington Technology — TPG to buy Forcepoint's public sector unit for $2.45B (July 10, 2023) · Francisco Partners to acquire Forcepoint from Raytheon Technologies (October 26, 2020) · Francisco Partners completes acquisition of Forcepoint (January 2021).
The Forcepoint case shows value destroyed by ownership fit. This one shows it destroyed by a mistaken view of what kind of business was being built, and it is the more useful of the two because the error is one a security-adjacent platform can make about itself.
At-Bay was founded in 2017 as a cyber managing general agent: it originates and underwrites cyber insurance on a carrier's paper, and pairs each policy with continuous security monitoring and its own managed detection and response product. In July 2021 it raised a $185 million Series D at a $1.35 billion post-money valuation, having just reported passing $160 million of annual recurring premium on 800% year-on-year growth. On August 19, 2026 Munich Re agreed to acquire the company outright at an enterprise value of $575 million — 42.6% of the 2021 mark, a decline of 57.4% over 5.06 years. The $185 million Series D alone equals 32.2% of the entire enterprise value five years later.
The mechanism, and it has two parts that are separable. The first is growth. Gross written premium was $278 million at December 31, 2025, against the $160 million of annual recurring premium reported at the Series D — about +73.8% over 4.43 years, an implied compound rate near 13.3%. A business growing at low-teens rates cannot hold a valuation set when it was growing at 800%, whatever else is true of it. The second part is the multiple basis, and it is the part that generalises. The agreed value is 2.07× gross written premium — an insurance-distribution multiple. The company sold a security product alongside the policy and was described, correctly, as having software-like fee economics; but when a buyer finally priced it, it was priced as specialty insurance distribution with a technology overlay, not as a security vendor. The premium at the exit went to the strategic logic — the buyer was the reinsurer already carrying the loss, and a shortened incident accrues to it directly — rather than to the software characterisation.
What transfers. A business is priced on the basis its eventual buyer uses, not the one its investors underwrote. Where a platform's revenue is earned as commission, fee, or premium override rather than as license or subscription, the exit comp set is set by that revenue's character, and a technology layer on top raises the multiple within that set rather than moving the asset into a different one. The diligence question is not whether the economics resemble software but whether the buyer universe that would pay a software multiple actually contains a plausible acquirer — here it did not, and the acquirer was the incumbent that had been on the cap table since founding.
What the case does not prove. Premium is not revenue: a managing general agent earns commission and fees on what it originates, so 2.07× gross written premium is not comparable to a revenue multiple and the true revenue multiple is necessarily higher and is not derivable from what was disclosed. The only revenue line in the announcement is $23 million of cyber fee service revenue, at 25.0×, which is too narrow a base to carry a conclusion. The two premium figures are the companies' own and are not stated on an identical basis, so the growth rate is indicative. Most importantly, one transaction cannot separate the 2021 valuation was wrong from the business underperformed a fair 2021 valuation; both are consistent with the evidence, and no view is taken here. Nor is it a fund return — nothing is stated net of leverage, fees, preferences, or the timing of capital, and At-Bay's liquidation preference stack is not public, so the outcome to any individual holder cannot be computed from these figures.
Sources: Munich Re — agreement to acquire At-Bay at a $575M enterprise value (August 19, 2026) · At-Bay — $185M Series D at a $1.35B valuation (July 27, 2021).
Singapore Telecommunications (Singtel) agreed in April 2015 to acquire 98% of Trustwave, a managed-security and PCI-compliance vendor, for $810 million. The price was adjusted at closing on 1 September 2015 to $770 million — a working-capital true-up on an all-cash deal, moving in the opposite direction from the stock-funded megadeals discussed above, where the announced-to-recorded gap comes from a share price fixed months later rather than a balance-sheet adjustment on day one. Normalised to a full equity interest, entry was approximately $786 million on the closing figure, or $827 million on the announced one. Trustwave's own chief executive, Robert McCullen, retained the other 2% and described Singtel at the time as a strategic investor providing access to its Asian customer base — the thesis was distribution, not price, and it is the distribution thesis that failed to materialise.
In the second half of the financial year ended 31 March 2021, Singtel booked a $250 million non-cash impairment charge against Trustwave — a single write-down larger than the entire company would fetch three years later. Seven months after that impairment, in October 2021, Trustwave sold its payment-card compliance division, SecureTrust, to Sysnet Global Solutions for $80 million in cash: a healthy, separable unit carved out and sold in isolation rather than folded into a turnaround, at a price equal to nearly 39% of what the remaining whole company would sell for three years later. On 8 January 2024 Singtel completed the sale of the entire remaining business — 100% of Trustwave — to a fund affiliated with the Chertoff Group, for $205 million, structured as a secured note and cash rather than paid upfront; Singtel's own counsel separately arranged Trustwave's post-closing credit facilities, a $195 million senior secured term loan and a $40 million unsecured facility. A seller financing part of the consideration on its own way out is not the posture of a buyer confident it is getting a bargain at arm's length; it reads as a seller propping up a sale it needed to close.
The mechanism. $205 million against a $770–810 million entry is a gross multiple of 0.25–0.26× — a 74–75% decline over roughly 8.3 years, an annualised value change near −15% a year, before crediting Singtel for any dividend or fee income across the hold, which is not disclosed. This is not an ownership-fit story of the Websense/Forcepoint kind: there was one owner for the entire period of decline, not three, so the mechanism cannot be fit-then-reversed. It reads as sustained strategic misfit left uncorrected — a telecom bought a security-services business for adjacency and distribution, never grew it into either, wrote it down formally, harvested the one clean asset inside it for cash, and eventually sold the remainder to a specialist buyer at a price it had to help finance.
What transfers. A formal impairment, a piecemeal divestiture of the strongest sub-asset, and a seller-financed exit are three separately disclosed signals of a forced sale rather than a clean one, and each was public years before the final transaction rather than visible only in hindsight. A security platform sitting inside a non-specialist strategic parent should be read for exactly this sequence: by the time a whole-company sale is announced, the price has usually already been set by the disclosures that preceded it.
What the case does not prove. Trustwave's own revenue was never publicly disclosed at any point in this sequence, so every figure above is an absolute price level, not a revenue or EBITDA multiple, and none should be read as one. The $205 million exit is a note-plus-cash structure whose cash component is not separately disclosed, so Singtel's actual realized proceeds were lower than the headline and cannot be computed from public information. The 98%-to-100% normalisation assumes the 2% stake Trustwave's founder retained in 2015 was worth its pro-rata share, which is an assumption rather than a disclosed fact. And the case does not extend past January 2024: in August 2025 LevelBlue — the MSSP platform already discussed in §9, led by the same Robert McCullen who founded and ran Trustwave for the seventeen years before Singtel bought it — completed its own acquisition of Trustwave from the Chertoff Group fund, on undisclosed terms, so whether nineteen months under a specialist buyer created value after the fire sale is not answerable from anything public.
Sources: CNBC — Singtel to acquire Trustwave for $810M (April 7, 2015) · eWeek — Singtel completes the acquisition at $770M (September 2015) · Light Reading — Singtel's $250M impairment against Trustwave, FY2021 · Singtel — Trustwave divests SecureTrust to Sysnet for $80M (October 25, 2021) · BankInfoSecurity and Jones Day — the $205M sale to the Chertoff Group, closed January 8, 2024 · LevelBlue — completes acquisition of Trustwave (August 19, 2025).
Read together, the seven cases point at five things a security platform can act on during a hold period, and one it should stop doing.
The connecting thread is that in each case the value came from changing what the business was — its revenue mix, its fit to a specific buyer, its readiness at a specific moment — rather than from changing what it cost to run. Cost programs are faster to execute and easier to measure, which is why they dominate the first year of most hold periods.
A current example of the same logic, offered as a live illustration rather than as evidence. On 1 September 2026 CrowdStrike introduced Falcon Guardian, entering agent-runtime security — a category in which at least a dozen venture-funded independents were already competing — without acquiring any of them. The stated reason was an asset it already held: a sensor deployed across its installed endpoint base that already observes process execution, which is where the enforcement point for an executing agent sits. That is the inverse of the Imperva lesson above and it is worth stating alongside it. Imperva was priced by what it would have cost Thales to build; Falcon Guardian is an incumbent concluding that in this category the build cost was the lower number, because the expensive component was distribution rather than technology and the distribution was already installed. The operative diligence question for a platform is therefore which of its deployed assets a competitor would have to buy — and, in a portfolio company, whether such an asset exists at all, since a platform without one competes on product in a category where the incumbent competes on reach.
What this illustration does not establish, stated explicitly. It is a product launch, not a realized outcome. No revenue, attach rate, customer count or competitive displacement has been reported, none is estimated here, and the announcement itself lists several components in the future tense. It therefore supports the strategic reasoning and proves nothing about the value created — unlike the six completed transactions above, each of which resolves to a disclosed price. It also cuts both ways for a sponsor holding an asset in that category: an incumbent that builds is a bidder removed from the demand side rather than added to it, and where acquirers pay for capability they can cross-sell rather than for standalone ARR, the number of remaining bidders is what sets the price. Source: CrowdStrike, 1 September 2026.
Each multiple on this page is computed from consideration as disclosed by the parties, and the distinction matters more in 2026 than it used to. The value attached to a transaction in press coverage is struck on the day of announcement; the figure the acquirer records at closing is set months later under accounting rules, and for large stock-funded deals the two diverge. The two biggest security transactions on record are the current illustration. Alphabet announced Wiz at $32.0 billion and records the completed acquisition at $29.5 billion after purchase price adjustments; Palo Alto Networks announced CyberArk at $25.0 billion and records $21.1 billion, because the consideration was roughly 88% stock, the exchange ratio fixed the share count at signing, and the share price was fixed seven months later at closing. The gaps are 7.9% and 15.8% respectively. Alphabet Form 10-Q, quarter ended 30 June 2026 · Palo Alto Networks Form 10-Q, quarter ended 30 April 2026.
The consequence for a value-creation plan is practical rather than technical. A target multiple set from headline comparables is set against a number the acquiring side does not carry in its own accounts, and the error is neither constant nor small — it runs with the stock component of the consideration and with the interval between signing and closing, so it is largest on exactly the deals a platform asset is most likely to be measured against. Where a plan is underwritten to a specific exit multiple, the basis of the comparables should be stated alongside the multiple. None of the four successful cases above was won on cost, and the one failure was not lost on cost either.
A second basis problem sits on the growth rate rather than on the consideration, and it is the one that moves a target multiple most, because growth is the largest single driver of what a platform is priced at. Six listed security companies reported the quarter ended 31 July 2026. Two had made an acquisition material to the reported rate. Zscaler published the adjustment itself, disclosing that Red Canary contributed $141M of ARR and that growth excluding it was 20% against the reported 25%. Palo Alto Networks disclosed the acquired ARR and left the arithmetic, which resolves a reported +63% in Next-Generation Security ARR to roughly 34% organic. Three names needed no adjustment at all. One — Rubrik, at a reported +33% subscription ARR, the second-highest rate on the panel — closed an acquisition inside the comparison window and disclosed neither consideration nor contribution, so its organic rate cannot be computed from public disclosure. The organic rate is recoverable for five of the six, and for only one of them because the company chose to publish it. Zscaler Q4 FY2026 results · Rubrik Q2 FY2027 results.
The consequence is that a comparable set ranked on reported growth is ranked on figures produced differently, and the error is silent: nothing on the face of a screen distinguishes a rate that has been adjusted from one that cannot be. Where a plan is underwritten to a growth-based exit multiple, the disclosure state of each comparable belongs beside its rate — adjusted by the company, derivable from disclosure, not required, or not recoverable. No estimate is offered here for a name in the fourth state. A growth rate that cannot be computed from disclosure is not improved by being guessed at, and a platform whose own reported growth carries an undisclosed acquired component will be read the same way by a buyer's diligence team.
A third basis problem applies at the size most portfolio assets actually trade at, and it is the most severe of the three because there is no document to correct against. Below the threshold at which an acquirer must account for a transaction separately, the only published figure is often a press estimate, and two tests of such estimates have now landed in the same quarter. SailPoint's acquisition of Entro Security was reported at roughly $200M; the Form 10-Q filed 10 September 2026 states cash consideration of $122.6M for 100% of the equity, with an allocation that reconciles to the decimal — the reported figure was 63.1% above what was paid, or, read the other way, the price paid was 38.7% below what the market had been quoting. Zscaler's FY2026 Form 10-K disclosed $40.6M for SPLX, a deal announced without terms in a category whose reported prices run $250–700M; the filed figure is between 6.2× and 17.2× below that band. SailPoint Form 10-Q, quarter ended 31 July 2026 · Zscaler Form 10-K, FY2026.
The consequence for a seller is direct and runs against the comfortable reading. A price expectation anchored on reported mid-cap comparables is anchored above the level at which comparable assets have actually cleared, and a management team that has internalised that anchor will read a credible offer as an insult. The same asymmetry helps a buyer and for the same reason, which is why it belongs in a plan rather than in a negotiation: the question to settle before a process, not during one, is which comparables in the set resolve to a filing and which resolve to a journalist. What these two observations do not establish is a rate. Two filed prices are not a sample; both sit in one segment; one of the two acquirers contributes four of the five filing-sourced mid-cap prices tracked, so acquirer policy cannot be separated from a market effect; and a filed price understates total economics wherever restricted stock is excluded from consideration as post-combination compensation, which on the five observations available ranges from 3% to 41% of the cash price. No direction of error is asserted beyond the two cases, and none is extrapolated to a third.
A fourth problem is more severe than the third and applies to an entire segment rather than to a size band: in security services there is frequently no published figure of any kind, and the rare one that exists is set by a buyer whose economics the rest of the segment cannot reproduce. Of the twelve managed-security and security-services acquisitions recorded in 2026 on the deal log maintained alongside this page, eleven disclose no consideration — 91.7%. Exactly one is priced: Munich Re's $575M enterprise value for At-Bay, examined as a case above. That buyer is a reinsurer acquiring a business whose managed-detection product reduces losses it would otherwise pay itself, so its willingness to pay rests on avoided claims rather than on acquired revenue — a basis unavailable to a software platform or a sponsor bidding for the same asset. The segment's only 2026 price observation is therefore set by its least representative buyer, and the eleven transactions that do reflect how the tier actually trades contribute nothing to a comparable set.
This changes the underwriting rather than qualifying it. For a services or managed-security platform, an exit multiple taken from market comparables is not merely imprecise — the observations required to build one do not exist. What governs price in that segment is the acquirer's own cost of capital and its confidence in synergies it will execute itself, which are properties of the buyer rather than facts about the market, and which a seller can influence only by making the synergy case legible and the integration cheap. Two September 2026 transactions illustrate the point and neither disclosed terms: Quorum Cyber–Ontinue, a sponsor exit of a business twice carved out of a larger parent, and CyberMaxx–Avertium, the sale of a platform assembled by a growth-equity firm in May 2019 from three simultaneous acquisitions and held roughly seven years and four months — two to three years beyond a conventional hold, and sold to a buyer funded by a private-credit facility rather than a strategic balance sheet. Neither is offered here as a value-creation case: with no consideration disclosed, no return can be computed and none is asserted. They are cited only as evidence of how the segment transacts. CyberMaxx, 16 September 2026 · Sunstone Partners, May 2019.
The four problems above all sit on the numerator or on the growth rate. A fifth sits on the denominator, it is the only one of the five that is created by the accounting rather than by disclosure practice, and it runs in one direction for every transaction. At closing, an acquirer remeasures the target's deferred revenue to fair value — broadly the cost of delivering the remaining obligation plus a normal margin — which is nearly always below the amount the seller was carrying. The difference is revenue the customer has already paid for that neither party will ever report: not the seller, because the contract left with the business, and not the acquirer, because the balance was written down before it arrived. Reported revenue for an acquired unit is therefore understated in the first year after close, most heavily in the first two quarters, recovering only as the written-down balance unwinds and is replaced by contracts signed after closing. Cisco's business-combination note for Splunk records $1,854M of deferred revenue written down to fair value across current and non-current portions, against a recorded price of $27.1B — 6.8% of the consideration. Cisco Form 10-K, FY2024.
The consequence for a value-creation plan is that the first year of measurement is not measuring the business. A synergy case underwritten to revenue growth in the acquired unit, and then marked against the acquirer's own reported figures, is marked against a number depressed by an accounting entry made at closing — so the plan appears behind in year one and ahead in year two for reasons that have nothing to do with execution. Where an integration is measured on acquired-unit revenue, the measurement base belongs in the plan: either the target's last standalone revenue, carried forward, or the acquirer's reported figure grossed back up by the disclosed haircut. What this single observation does not establish is a ratio. The haircut is disclosed as a balance-sheet amount, not allocated across periods, so the split between year one and later years cannot be derived from it; and Splunk is the only one of the three largest cyber closes to break the item out separately — the Wiz and CyberArk notes do not, so 6.8% is one deal's figure and not a sector norm. It is cited to establish that the adjustment is material at scale, not to size it for the next transaction.
Informational only; not investment advice. Nothing here draws on confidential client information. All transactions cited are public.
The seven cases above are read for mechanism, not claimed as our own. The same reading applied to your company, with your numbers, is the first step of our value creation work.
atul@el-doradocapital.com · 408-771-8703