Profit-Pool Theory & Migration

A profit pool is the total profit earned across all the activities in a value chain. The analytical discipline is to map where in the chain the profit concentrates, as distinct from where the revenue flows. In cyber, revenue and profit are not in the same place, and the gap between them shapes much of the deal activity: reading the profit pool indicates which businesses to buy, sell, or avoid even when they are growing.

Accenture's ~$4.18B acquisition (Jun 2026) of a majority of Dragos plus all of runZero and NetRise is best read through the profit-pool lens. The three assets together carried only ~$208M of ARR, so the purchase was less about revenue than about position in a migrating profit pool: from OT/ICS services (where Accenture already operated, at consulting margins) toward OT/ICS software and recurring asset-visibility (where margins are structurally higher and multiples 3–5× richer). It is a profit-pool migration bet — paying a software multiple today to hold the position where the profit is expected to land by 2028. (Accenture, Jun 2026)

What a profit pool is — and why cyber's is lopsided

A profit pool is the sum of profits across every link of an industry's value chain, measured by where the profit sits, not where the activity happens. The classic finding (Gadiesh & Gilbert, HBR 1998) is that profit is almost never distributed in proportion to revenue: a value chain can route most of its revenue through low-margin links while most of its profit concentrates in one or two high-margin links. The strategic question is always the same — which link captures the profit, and is that link's grip durable?

Cyber's profit pool is unusually lopsided for three structural reasons. First, software vendors capture profit out of proportion to their revenue: a product vendor at 75–80% gross margin and 80%+ recurring revenue earns far more profit per dollar of revenue than the services and channel links that move three to five times the dollar volume. Second, the channel moves the majority of the revenue but keeps almost none of the profit — distributors run low-single-digit margins on volume, and resellers earn most of their margin on attached services, not on the product itself (see Distribution). Third, platforms compound the asymmetry: as security consolidates onto a handful of platforms, the platform layer captures an ever-larger share of the pool through bundling and the gross-margin leverage of selling the next module into an already-acquired account. The profit pool is migrating up the stack and toward the platforms — a master trend that organizes much of the sector's deal activity.

Mapping the cyber value chain by profit, not revenue

The exhibit below maps the cyber chain on two axes that almost never agree: the share of revenue that flows through each link, and the share of profit the link actually keeps. The wedge between the two — wide at the channel, inverted at the product/platform layer — is the profit pool, and it drives the deal logic.

The four migrations reshaping the pool

A static profit-pool map is a snapshot; the deal value is in the motion. Four migrations are live in cyber right now, and every one is a thesis an acquirer is paying for.

Tools → platforms. The largest migration: profit is moving from standalone point products to consolidated platforms (PANW, CRWD, MSFT) that capture it through bundling and cross-sell gross-margin leverage. A point product that was a profit pool of its own in 2020 is, by 2026, a feature inside someone else's pool — which is simultaneously the bull case for the aggregator and the bear case for the feature (see Consolidation & Aggregation, Platform Wars).

On-prem → cloud-native. Profit is migrating from perpetual-license/appliance models (Gartner-stagnant, declining gross margins as hardware commoditizes) to cloud-delivered subscription, where gross margins and retention are structurally higher. The appliance vendors that didn't make the jump — the "melting iceberg" of network security — are watching their pool drain into SASE and cloud-native challengers.

Services → recurring/managed. Inside the services world, profit is migrating from project-based, billable-hour work (consulting margins, no recurring revenue) toward managed and recurring delivery (MDR, vCISO retainers), which carries annuity economics and earns a re-rating from EBITDA multiples toward ARR multiples. This is the literal engine of the services roll-up thesis.

Detection → outcome (and toward AI). The newest migration: profit is moving from selling detection tooling toward selling security outcomes — the autonomous/agentic SOC that promises to do the work, not just surface the alert. If it holds, profit migrates again, from per-seat/per-GB tool licenses toward outcome- and consumption-based pricing, and toward whoever owns the AI layer (see Agentic SOC, Pricing & Business Models).

The falsifiable bear case on profit migration

The migration thesis is not a law of nature, and its limits can be stated. The platform-capture migration reverses if (a) regulators or buyers punish bundling hard enough that best-of-breed re-fragments the pool — a real possibility if a Microsoft-style bundle triggers antitrust scrutiny or a high-profile platform breach; (b) the agentic-SOC outcome layer commoditizes into the model providers (OpenAI/Anthropic) rather than the security platforms, in which case the profit migrates past the incumbents entirely and lands with the AI labs; or (c) the services→recurring re-rating proves to be margin mirage — managed-services gross margins compress as labor inflates and AI fails to deliver the promised leverage, collapsing the multiple arbitrage. On balance, the up-stack migration is the base case, but the terminal owner of the agentic layer is unresolved, and that uncertainty is where 2026's largest valuation disagreements sit.

Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.