Private Equity Firms Buying Cybersecurity Companies

Cybersecurity is one of the few areas of technology where spending tends to grow even when budgets are tight. Regulators, insurers and customers now expect businesses of every size to protect their data, and most small and mid-sized companies do not have the staff to do it themselves. That has made founder-owned security firms, from managed security providers to consultancies and software makers, attractive to private equity.

The buyers below approach the sector in different ways. Some are building managed security or managed IT platforms and buy service firms that monitor networks, respond to incidents and manage compliance for clients on monthly contracts. Others invest in security software companies with subscription revenue. A third group buys firms that serve government and defense customers, where security clearances and certifications are as valuable as the client list.

Buyers will look closely at recurring revenue and how dependable it is. Monthly managed service contracts, software subscriptions and multi-year agreements are valued well above one-time projects and assessments. Expect questions about client concentration, gross margin by service line, the depth of the technical team, which certifications your staff hold, and whether the company depends on one or two security tools it resells. For firms that serve government clients, contract vehicles and clearances will be reviewed in detail.

Security firms often depend on a small group of skilled people, so owners should expect buyers to focus on keeping them. Ask how key engineers and account leads will be rewarded after the sale, whether you will be expected to stay and for how long, and whether the buyer plans to fold your company into a larger brand or keep it independent.

Greymont is paid by buyers, never by owners. Greymont can help you narrow these firms to the ones that buy security businesses of your size and type, well before you decide to sell.