The Business of Cyber Security

Pricing & Business Models

The metrics that price a cyber business are generated one level upstream, by the pricing and packaging model. How a company charges is not merely a billing detail — it determines net revenue retention, gross margin, predictability, and therefore the multiple. Two companies with identical ARR can trade two turns apart purely because one charges per seat and the other charges on consumption. In diligence, the pricing model is among the first things to interrogate, because it determines how the revenue behaves after a change of ownership.

When a SIEM buyer migrates from a per-GB-ingested legacy contract (Splunk's historical model) to a platform-subscription model (the cloud-native challengers), the vendor's revenue does not merely change level — it changes character. Per-GB pricing penalizes the customer for sending more data, capping expansion and inviting churn when a cheaper tier appears; platform-subscription pricing aligns vendor and customer and enables land-and-expand. The market pays for the second behavior, which is why the "per-GB tax" is the explicit bear case on legacy SIEM and the bull case on the disruptors repricing it (see SecOps & SIEM). The pricing model is a leading indicator of NRR, and NRR is a leading indicator of the multiple.

The five pricing models in cyber, and what each one does to the financials

Cyber pricing has consolidated into roughly five models. Each drives a different retention and margin profile — and therefore a different valuation — so naming the model first indicates the financials it will produce.

Model How it charges Expansion behavior (→ NRR) Predictability Typical home
Per-seat / per-user Price × employees or identities Expands with headcount + module attach; clean, capped by org size High — easy to forecast Identity, email, awareness training, EDR
Per-asset / per-endpoint / per-workload Price × devices, endpoints, cloud workloads Expands as the estate grows (cloud especially) — strong in growth accounts High Endpoint, cloud security, OT/asset visibility
Consumption / usage Metered (data ingested, scans, API calls, compute) Expands and contracts with usage — high ceiling, real downside Lower — usage is volatile SIEM/SecOps, cloud-native data, some AppSec
Platform subscription (tiered) Bundled tiers / credits across modules Expands by tier-up + module cross-sell; the land-and-expand engine High Platforms (PANW, CRWD, MSFT, Zscaler)
Outcome / managed (recurring service) Fixed retainer or per-outcome (per incident, per protected asset) Expands by scope + coverage; annuity-like High (retainer); variable (per-outcome) MDR, MSSP, vCISO, IR retainers, agentic SOC

The table describes a causal chain, not just a taxonomy. Per-seat and per-asset models produce forecastable, durable revenue that the market rewards with high gross-retention multiples — but their expansion is capped by the size of the customer's org or estate, so NRR rarely runs explosive. Consumption offers the highest expansion ceiling (revenue grows with the customer's own data/compute growth, which compounds) but carries genuine downside: when the customer optimizes usage or the macro tightens, consumption revenue contracts without a churn event, which is why consumption-heavy vendors saw NRR whipsaw in 2023–24 and why the market now discounts pure-usage models for volatility. Platform subscription is the model the market pays the most for, because it combines high predictability with a structural cross-sell engine — every new module sold into an existing account is near-100%-gross-margin expansion. Outcome/managed trades a lower gross margin (it carries labor) for annuity-grade predictability, which is exactly the property that lets a services roll-up re-rate from an EBITDA multiple toward an ARR multiple as its recurring mix climbs.

The model determines the multiple

The exhibit ties the model to the price the market pays for it. The driver is not the model's name but the two financial properties it produces: predictability (how forecastable the revenue is) and expansion (how much it grows inside an existing account). The models that score high on both — platform-subscription, then per-asset — command the richest revenue multiples; pure consumption pays a volatility discount despite its high ceiling; managed/outcome trades off the product multiple for annuity durability.

Packaging as a value lever

Pricing is how much; packaging is how it's bundled — and packaging is where the quiet value is created or destroyed. The platform playbook is a packaging move before it is a product move: lead with a "platform" SKU or a credit pool that lets the customer consume across modules, so that adding the next module is a packaging decision (turn it on) rather than a new procurement (a new sales cycle). This is what makes platform NRR structurally higher — expansion is frictionless because it was packaged in from the start. The inverse failure mode, common in tuck-in targets, is à-la-carte sprawl: dozens of separately-priced SKUs that make every expansion a negotiation, cap NRR, and inflate sales cost. In diligence this is a concrete, fixable value lever — a fragmented price book that an acquirer can repackage into tiers post-close is a source of synergy, not a red flag, provided the underlying retention is sound.

The AI repricing — from seats to "base + consumption" (2026 state of play)

The five-model taxonomy above still holds, but AI is actively re-weighting it, and the destination is now visible in shipped price lists rather than theory. Three forces drive the shift, and they explain why the emerging standard is a hybrid — a committed base plus metered consumption — rather than a clean jump from seats to pure usage.

Why seats break. (1) The billable unit shrinks: when an AI agent does the work, the thing per-seat pricing counted — the human analyst — is exactly what the product replaces; a mid-2026 Wall Street sector note lists "AI is disrupting the lucrative seat-based pricing model in SaaS" among its structural theses, and its CISO survey found consumption-based pricing the single most-preferred model (research/wall-street-ai-in-cyber-2026.txt). (2) AI features carry real COGS: unlike classic software, every AI action burns metered tokens — frontier-model pricing runs dollars per million tokens, and agentic loops (recon → parse → plan → act, repeatedly) multiply consumption unpredictably. Vendors cannot give away unlimited AI work under a flat seat price without margin destruction, so they must meter — SecurityWeek's framing: security platforms are shifting "from predictable software licensing to volatile, machine-driven consumption economics" with the bill landing on CISOs "with little warning and no ceiling" (SecurityWeek — The AI Token Costs That Can Break Cybersecurity). (3) Value moves from access to work done, which makes per-unit-of-work and outcome pricing possible for the first time.

What's actually shipping — four hybrid variants, all "base + consumption":

Variant Mechanics Live anchors (2026)
Committed credit pool Customer commits a multi-year dollar pool; draws down across modules, services, and AI features as needed CrowdStrike Falcon Flex — $1.69B ending-ARR Flex cohort in Q4 FY26, +120% YoY, >$3.2B cumulative deal value; extended to services ("Flex for Services") for the agentic era (CrowdStrike · press release); Palo Alto platformization credits (Cortex/Prisma credits; XSIAM = per-endpoint base + per-GB telemetry)
Provisioned + overage Reserved capacity billed flat (the base) + metered overage above it Microsoft Security Copilot SCUs — ~$4/hr provisioned, ~$6/hr overage, with E5-embedded allocations (400 SCUs per 1,000 users) (Microsoft pricing · SAMexpert guide)
Per-unit-of-work platform fee Annual platform fee that includes a capacity of AI work; more work = higher tier Dropzone AI — from ~$36K/yr incl. ~4,000 investigations (≈$9/investigation); Prophet Security — ~$50K per 5,000 investigations (≈$10/investigation) (Dropzone pricing · D3 comparison)
Outcome-based Pay per result (resolved incident, validated finding, closed exposure) Still the frontier — pockets in autonomous pentest/validation and MDR SLAs; adoption limited by the verification problem (who certifies "resolved"?) and budget-owner discomfort with uncapped bills

Note what even the "AI-native" pure-plays did: none of them price pure pay-per-use. Dropzone and Prophet both wrap consumption inside an annual committed fee — because the buyer needs budgetability and the vendor needs committed ARR. The hybrid is not a transitional compromise; it is the design point. The committed base preserves the predictability the market pays for (and shields the vendor's multiple from the consumption-volatility discount above), while the metered layer (a) recovers token COGS and (b) converts the customer's growing AI usage into NRR.

The economics underneath — the pricing umbrella. At ≈$9–10 per AI investigation against a human cost typically several multiples of that per alert worked, the AI-native price point sits far below the human-equivalent cost and far above the token cost of producing it — a classic pricing umbrella that funds the land-grab. The strategic question in diligence is durability: as frontier-model costs fall and hyperscalers bundle (Security Copilot inside E5 allocations is the warning shot), does the per-unit price hold, or does AI work get commoditized into platform credits?

The transition risk — the "air pocket." The same Wall Street note flags that the seat→consumption shift creates a revenue air pocket: upfront seat-based cash gives way to usage/outcome billing that builds gradually, so reported growth can dip during a successful model transition. For valuation work this cuts both ways: a target mid-transition can screen worse than it is (relevant to a buyer's read), and the cohort mechanics are worth stating explicitly (relevant to a seller's narrative).

Open question (a live valuation disagreement): does AI-work pricing expand the pool (customers buy results they couldn't staff for) or cannibalize the seat base (one agent replaces ten analyst seats)? The 2026 evidence leans expansionary at the platform level — Falcon Flex's +120% cohort growth is committed-spend acceleration, not seat erosion — but the burden shifts per segment; see Profit Pools, Agentic SOC, and Software Eats Services.

The diligence read

Five questions extract most of the signal — plus two new AI-era ones: what is the AI gross margin (are token/inference COGS passed through in the metered layer, or silently absorbed under a flat price — the latter degrades as usage grows), and what share of revenue is committed vs. metered (the committed base is what protects the multiple through the transition). What model, and is it aligned to a value the customer can see growing? (A model that bills the customer for their own growth — per-workload, consumption — rides a tailwind; one capped by headcount does not.) Does the model expose the vendor to usage downside, and did it show up in the NRR series? How fragmented is the price book — is expansion frictionless (good) or a negotiation (a fixable lever)? Is the revenue contracted/committed or purely usage-metered — committed-spend floors de-risk a consumption model materially. And is there discounting masking a weak model — heavy, accelerating discounting to hit bookings signals that the pricing is not holding and the next renewal cohort will reset down. Read this way, the pricing model predicts how the revenue behaves after close — which is what an acquirer is buying.

→ Cross-references: Economics, Unit Economics, Profit Pools, Consolidation & Aggregation, SecOps & SIEM, Agentic SOC, Valuation by Sub-Segment.

Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.