The Business of Cyber Security

Capital Markets & Macro Context

Cyber's demand is structural (see Demand Engines), but the price at which that demand trades, and the volume of M&A it generates, is set by the capital markets: interest rates, public-equity multiples, the IPO window, and the supply of private capital. The same company is worth a different number in a 2021 zero-rate boom than in a 2023 rate shock than in the 2026 easing cycle, even with identical revenue. The transmission runs from macro conditions → public multiples → private valuations → deal volume, so a deal can be read in the context of the regime it occurs in, not only the asset.

In late 2025 the cyber leaders traded at historically high multiples — CrowdStrike above ~100× forward earnings, Zscaler near ~80×, Palo Alto near ~70×. By mid-2026 those had compressed to roughly ~90× / ~35× / ~55× respectively, even as the businesses kept growing 20%+. The change was not in the companies but in the cost of capital and risk appetite, and every private valuation and deal multiple in the sector re-anchored off the new public comps. In cyber valuation, the asset is only part of the price; the regime is the other part. (Windsor Drake Cyber Valuation Report 2026; Motley Fool, Mar 2026)

The transmission mechanism — from rates to deal volume

Capital-markets conditions reach a cyber deal through a four-link chain, and every link is observable:

  1. Cost of capital (rates & risk appetite). When rates fall and risk appetite returns, the discount rate on future cash flows drops, so long-duration growth revenue is worth more today. Cheaper debt also lowers the cost of an LBO. The 2026 easing cycle — rates drifting down, buyers deploying before valuations climb — is the macro backdrop driving the current deal acceleration. (Windsor Drake)
  2. Public multiples (the comp set). Listed cyber names set the visible benchmark. As of mid-2026 the sector trades at roughly a 25% premium to broader software (median SaaS ~6.0–6.5× NTM revenue), with platform leaders well above that: CrowdStrike ~18–19× NTM revenue, Zscaler ~14–15×, Palo Alto ~11–13×. The market now discriminates sharply: AI-native, high-retention revenue commands ~15–20× while legacy/low-growth revenue commands ~4–6×. (Windsor Drake; TIKR, 2026)
  3. Private valuations (the markdown/markup). Private rounds and M&A price off the public comps with a lag and a liquidity discount — but the direction tracks the public tape. When public multiples compress, late-stage private rounds reprice (the 2022–23 down-rounds); when they recover, private marks and acquisition multiples follow.
  4. Deal volume & mix (the output). The net effect shows up as transaction count and, especially, mix. The 2026 market is heavy on fewer, larger, strategic deals: Q1 2026 cyber M&A was anchored by two strategic megadeals — Google–Wiz ($32B) and Palo Alto–CyberArk ($25B), ~$57B combined — with strategics representing >90% of value, and cyber VC funding hit ~$3.8B in Q1 2026, +33% YoY — capital flowing back in as the regime turned. (Lyrie Research, 2026; GlobeNewswire, Apr 2 2026)

The IPO window — an episodic regime, not a constant

Public exits in cyber open and close in windows governed by the same macro forces. The window was effectively shut from 2022 into 2024, cracked open in 2024 (Rubrik IPO, priced Apr 24 2024, $32/share, ~$5.6B), and thawed meaningfully in 2025 — SailPoint's re-IPO (priced Feb 12 2025, $23/share, ~$12.8B) after Thoma Bravo's 2022 take-private, and Netskope (priced Sep 17 2025, $19/share, ~$7.3B, NASDAQ: NTSK). Whether 2026 sustains a steady stream is genuinely contested: some read the late-2025 thaw as the start of a 2026 listing pipeline (Cato Networks and others are bankered up); others argue no new pure-play cyber IPOs are likely in 2026, leaving PE and strategic M&A as the only viable exits. On balance, the window is open but narrow and selective, and most liquidity is still flowing through M&A. (CNBC, Sep 17 2025; Strategy of Security) (See Exits — M&A vs IPO.)

The supply of private capital — dry powder is the other accelerator

The volume of available private capital is itself a macro variable. Global private-equity dry powder sits near ~$3.7T, with buyout dry powder >$1.1T — an enormous overhang that must be deployed within fund lifecycles, creating structural buy-side pressure independent of any single deal thesis. Combined with the maturing DPI problem (LPs demanding distributions, see Fund Structures & LP Dynamics) and abundant private credit to finance take-privates (see Lenders), the supply side of capital is primed — which is why a cost-of-capital easing translates so quickly into cyber deal flow.

The multiple reset

The regime shift is clearest in the forward-earnings compression in the listed leaders from their late-2025 peaks to mid-2026. The businesses kept compounding; the multiples did not. This macro re-rating is the anchor off which private cyber valuations in 2026 are set.

The 2026 reset: multiples compressed while the businesses kept growing Forward P/E, approximate late-2025 peak vs mid-2026 — a cost-of-capital re-rating, not a fundamentals break. 0 25 50 75 100 Forward P/E (×) ~100× ~90× CrowdStrike ARR ~$5.5B, +24% ~80× ~35× Zscaler ARR ~$3.5B, +25% ~70× ~55× Palo Alto NGS ARR ~$8.1B, +60% Late-2025 peak Mid-2026 Source: Windsor Drake Cyber Valuation Report 2026; Motley Fool Mar 2026 (forward P/E approximate). Exhibit: The Business of Cyber Security.
The re-rating in one picture: forward multiples fell 10–55% from late-2025 peaks while revenue kept compounding 20%+. For M&A, the *regime* prices the asset as much as the asset does; each comp should be read against the macro window it printed in. See Public Trading Comps and The Bear Case.

Limits of the macro lens

The capital-markets frame is essential but has failure modes. (1) Multiples mean-revert, but not uniformly. The 2026 compression hit the most expensive names hardest; treating "the sector re-rated" as one number hides that quality revenue held its premium while low-growth names were gutted — the dispersion widened. (2) Cheap capital can fund bad deals. A dry-powder overhang and easy credit are buy-side pressure, not buy-side discipline; the same conditions that accelerate good roll-ups also fund overpriced ones that destroy value (see Why Most Acquisitions Fail). (3) The window can slam shut. IPO and financing windows are regime-dependent and can close in a quarter on a rate surprise or a risk-off shock, stranding assets that were priced for a liquid exit. The macro tailwind is real in 2026 — but it is a tailwind, not a floor.

Cross-references: Economics, Unit Economics, Public Trading Comps, Valuation & Benchmarks, Exits — M&A vs IPO, Fund Structures & LP Dynamics, Lenders & Private Credit, The Bear Case.


Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.