Thoma Bravo
Thoma Bravo is the largest software-focused private-equity firm in cybersecurity and the most active sponsor in the sector's take-private and consolidation activity.
Who they are
Thoma Bravo is the largest software-focused private-equity firm in the world, managing more than $172B in assets (as of Mar 31, 2026, per the firm; the firm separately stated >$183B as of Dec 31, 2025 in its Apr 15, 2026 Google Cloud–partnership release), with cybersecurity as its flagship vertical. Its model is narrow and repeatable: buy scaled software companies — overwhelmingly via take-private — install a disciplined operating model, grow through bolt-on M&A, and exit 4–7 years later via re-IPO, strategic sale, or secondary. Its cyber portfolio alone aggregates roughly $8B in revenue. In June 2025 it closed $34.4B across three funds, its largest raise, providing capital to continue acquiring through the 2026 reset.
The cyber portfolio (take-privates that defined the category)
| Asset | Entry | Sub-segment | Status / playbook note |
|---|---|---|---|
| Proofpoint | 2021, $12.3B | Email / data security | Largest cyber take-private; bolt-ons (Tessian, Normalyze) |
| SailPoint | 2022, $6.9B | Identity governance (IGA) | Re-IPO'd 2025 (~$12.8B) — the model's proof of exit |
| Darktrace | 2024, $5.3B | AI/network detection | UK take-private; 3rd CEO in ~18 months (see 13) |
| Sophos | 2020, $3.9B | Endpoint / MDR | Acquired Secureworks (~$859M, 2025) — services scale + Taegis |
| Ping Identity | 2022, $2.8B | Identity (access) | Merged ForgeRock ($2.3B, 2023) in — consolidation within the portfolio |
| Imprivata | 2016 | Healthcare identity | Long-held vertical identity leader |
| Exabeam + LogRhythm | 2024 | SIEM / SecOps | Merged two SIEM assets into one — legacy-SIEM consolidation play |
| Delinea (Thycotic + Centrify) | 2018–21 | PAM | Built a PAM leader by merging two acquisitions |
TB frequently builds category leaders by merging assets it already owns (Ping+ForgeRock, Exabeam+LogRhythm, Thycotic+Centrify), internalizing the consolidation thesis.
The operating model
TB relies on a standardized operating playbook run by a dedicated operating group, rather than financial engineering alone: - Pricing & packaging discipline — re-rate under-monetized products (a classic first move post-close). - Go-to-market efficiency — rationalize sales coverage, focus on net revenue retention and the Rule of 40. - Cost & margin — centralize back-office, lift operating margins toward best-in-class (40s). - Bolt-on M&A — tuck in capabilities below the platform multiple (accretive on entry); see the value bridge in 06 and 30. - Leadership — install proven operators (and replace them decisively — Darktrace's CEO churn). - Operating platform, industrialized. On Apr 15, 2026 TB announced a strategic partnership with Google Cloud (release) giving portfolio companies streamlined access to Google's Gemini / agentic-AI platform, teams of forward-deployed engineers, and new routes to market via Google Cloud Marketplace + co-sell. It extends the operating playbook to the fund level: the AI-tooling-and-distribution capability is built once, centrally, and amortized across the portfolio rather than at each company alone. It is a partnership, not an acquisition.
Exits
- Re-IPO: SailPoint returned to the public markets in 2025 at a materially higher value than the 2022 take-private — the cleanest demonstration of the take-private → improve → re-list loop.
- Strategic sale / secondary: the other routes when the IPO window is shut (Deal Structures).
Risks
- Leverage in the reset: TB deals carry significant debt (09); a frozen exit market or growth slip pressures returns (31).
- AI disruption: several TB assets (SIEM, email, network detection) sit in pools being reshaped by AI — the operating model has to navigate, not just optimize.
- Execution / leadership risk: the Darktrace CEO turnover shows the operating model is hands-on and not frictionless.
→ Cross-references: Private Equity, Value Creation, Deal Structures, Key People.
Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.