Economics of the Cybersecurity Industry
Market size & growth
| Metric | Figure | Source window |
|---|---|---|
| Worldwide information security end-user spending (2025) | $213B | Gartner, Jul 2025 |
| Worldwide information security spending (2026E) | $244B, +13% YoY | Gartner, 2026 forecast |
| Enterprise security software + network security (2025) | $118.5B, +14% | Gartner |
| Broader "cybersecurity market" (incl. services/hardware, 2025) | ~$228–302B (varies by definition) | MarketsandMarkets / Precedence |
| Long-run forecast | ~$352B by 2030 (~9% CAGR) to ~$878B by 2034 | MarketsandMarkets / Precedence |
The spread across estimates reflects definitional differences (software-only vs. software + services + hardware). Gartner's ~$244B (2026E) information-security spend is the conservative, software-and-services-weighted figure most commonly used as an anchor.
Fastest-growing line items (2026)
- Managed security services — +11% (fastest in the services segment); the engine behind the MDR roll-up thesis.
- ZTNA — +23% in 2026, ~$6.4B by 2030.
- Cloud workload protection (CWPP) — $6B (2025) → $16B (2030).
- GenAI security — net-new category created by enterprise AI adoption.
Drill-downs under this chapter: Unit Economics — the metrics that price a cyber business (ARR/NRR/Rule-of-40/CAC); Profit-Pool Theory & Migration — where profit concentrates in the value chain (as distinct from revenue) and the four migrations reshaping it; Pricing & Business Models — the five pricing models and how each maps to a different multiple; The Consolidation & Aggregation Thesis — fragmented supply plus structural demand driving platform aggregation; Capital Markets & Macro — how rates, public multiples, the IPO window, and dry powder set the price and volume of deals.
How the money flows
Vendor business models & unit economics
| Model | Description | Typical gross margin | Valuation lens |
|---|---|---|---|
| SaaS / subscription | Recurring ARR, seat- or consumption-based | 75–85% | EV/ARR, Rule of 40 |
| Term license + maintenance | Legacy on-prem | 70–80% | EV/EBITDA |
| Usage / consumption | Data-volume or event-based (SIEM, cloud) | 60–75% | NRR-sensitive |
| Managed services (MSSP/MDR) | People + platform, recurring contracts | 40–60% | EV/EBITDA, EV/Revenue |
| Professional services / consulting | Project-based (IR, pen-test, advisory) | 30–45% | EV/EBITDA |
Key metrics that drive value: ARR and ARR growth rate (the single most important number — a $10M ARR company growing 40% is valued completely differently from one growing 10%), Net Revenue Retention (NRR) (>120% is elite), Rule of 40 (growth % + FCF margin % ≥ 40), gross retention, CAC payback, and magic number. Each of these — with 2026 benchmarks, how they interact, and how to read them in diligence — is treated in depth in Unit Economics.
Why valuations carry a premium
Cybersecurity commands a premium to general software because: (1) demand is non-discretionary and regulation-driven; (2) NRR is high (land-and-expand within accounts); (3) the threat landscape guarantees recurring demand; and (4) strategic scarcity — platforms will pay up for category leadership. See Valuation Benchmarks for the multiple stack.
The economics of the channel
The channel (distributors, VARs, MSPs) intermediates the majority of enterprise security sales. Distributors earn thin margins on volume; VARs/MSPs capture margin on services and managed offerings layered on top of vendor products. This is why services businesses are roll-up candidates — recurring managed revenue at services scale, acquired at EBITDA multiples well below the product-vendor ARR multiples. See Channel.
Capital markets context
- 2025 M&A: ~$84–96B disclosed across ~400–426 deals; eight deals >$1B (~$75B of the total). See Deals.
- PE dry powder: Thoma Bravo alone raised $34B across three funds (Jun 2025); software/cyber is a core private-credit and PE theme.
- Private credit: LBO financings hit a record $81B in 2025; software companies acquired at ~20x EBITDA with high leverage. See Lenders.
Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.