The Sponsor Landscape

Beyond the mega-platforms Thoma Bravo and Vista, the cyber buyout market includes a deep bench of large-cap, carve-out, and cyber-specialist sponsors. Each plays cyber differently: a carve-out specialist, a growth-crossover firm, and a large-cap generalist run different deal cadences.

The contenders at a glance

The large-cap generalists

KKR — a top global large-cap sponsor with a cyber-relevant book. Owns Barracuda (network/email security; an active consolidation platform in email and SMB security — 03j), backed Optiv (the largest pure-play cyber solutions provider / MSSP — 04a), and co-owns NetSPI (offensive security / PTaaS — 04f) with Carlyle. KKR plays cyber as scaled-platform control bets it can support with its balance sheet, capital-markets reach, and operations group (KKR Capstone). Barracuda is an active platform for bolt-on acquisitions.

TPG — large-cap with a security book that includes Forcepoint (DLP/SASE, with Francisco lineage) and Checkmarx (AppSec, co-owned with Hellman & Friedman). TPG plays opportunistically across the stack; its checks are large and its holds patient.

Advent International — global large-cap; cyber exposure via McAfee consumer (with Permira) and identity-adjacent assets. Advent brings deep international reach and carve-out experience.

Bain Capital and Carlyle round out the generalist tier — Carlyle co-owns NetSPI and holds government-adjacent security (ManTech). These firms underwrite cyber as a durable, cash-generative software/services vertical rather than a thesis-defining specialty. In July 2026 Carlyle formalized a dedicated middle-market Aerospace, Defense & Government and Industrials platform — reported to be raising up to $3B — and made its first investment through it: the acquisition of Secturion Systems (announced Jul 27, 2026; terms undisclosed), a provider of high-speed, NSA-certified hardware encryption used to protect classified data across airborne, maritime, and ground systems for customers including the US Navy and Boeing. Sean Berg — former CEO of Everfox, the government-cyber business carved out of Forcepoint — was named Secturion CEO. The move stands up a mid-market pool of capital aimed at cyber-adjacent defense hardware, a segment distinct from the software/services vertical the generalist tier usually underwrites. (Carlyle · Washington Technology)

The cyber-fluent growth & crossover firms

Warburg Pincus — arguably the most cyber-native of the global growth/buyout firms, with 25+ years in the sector. Its book is unusually broad: Claroty (OT/ICS — 03h), Nord Security (~$3B valuation, consumer-privacy turned acquisitive), Bitsight (security ratings/TPRM), Contrast Security (AppSec), eSentire (MDR — 04b), Infoblox (DDI/DNS security), A-LIGN (compliance/assessment), Aura (consumer), and an early CrowdStrike position. In 2025 Warburg hired former Google Cloud CISO Phil Venables as a senior advisor — a senior security hire that typically precedes increased deployment (Key People).

Insight Partners — the most prolific crossover firm in cyber, operating from growth equity into buyout. Origination is a strength: early/scaling stakes in Wiz, SentinelOne, Armis, Recorded Future (→ Mastercard, ~$2.65B), and dozens more. Insight is both a funding source for the "graduating class" of scale-ups (VC, 25) and, increasingly, a buyer itself. A company on Insight's cap table is typically on the consolidation path.

PSG Equity — growth equity with a TPRM/ratings tilt (Bitsight, where it installed an operator-CEO in 2026 — 13). Growth firms like PSG, General Atlantic, Summit, TA Associates, and Accel-KKR (see 06) take minority/majority stakes in profitable scale-ups with lighter leverage — the bridge tier between venture and control buyout.

The carve-out and cyber-specialist shops

Crosspoint Capital — a cyber-and-privacy specialist founded by ex-Symantec/McAfee executives (Greg Clark, Hugh Thompson). Holdings include Forescout (device visibility/OT), Absolute Security (endpoint resilience), and RSA-adjacent assets. Crosspoint's edge is a deep operator network inside cyber — it buys what it knows and runs it with people who have operated it.

Symphony Technology Group (STG) — the carve-out machine. STG extracted Trellix and Skyhigh Security from the McAfee Enterprise / FireEye breakup — the lineage that turned one conglomerate's security division into multiple independent platforms. Carve-outs are operationally hard (stranded costs, TSAs, separation) and that difficulty is STG's moat.

Francisco Partners — a tech/carve-out specialist that straddles generalist and specialist. Prolific and opportunistic in security: Jamf ($2.2B), Sumo Logic ($1.7B take-private, SecOps/observability — 03e), Forcepoint (with TPG), and a long tail of carve-outs. Francisco's tempo is closer to Thoma Bravo's than to a generalist's.

Permira — European tech buyout with Mimecast (email security — 03j) and McAfee consumer (with Advent). In 2025 Permira returned €12.6B to LPs and has been hiring Thoma Bravo veterans for AI-era dealmaking, indicating an intent to increase its software/cyber control-deal activity.

The European software specialists

Hg — Europe's largest software-focused sponsor, with a GRC/compliance roll-up thesis (03i) and a serial buy-and-build cadence in regulatory/TPRM software. Hellman & Friedman (co-owns Checkmarx with TPG) and Clearlake (software-heavy, value-oriented) complete the large-cap-with-software-depth tier.

Why the differences matter

The sponsor type predicts the deal cadence and the M&A activity of a portfolio company: - Carve-out shops (STG, Crosspoint, Francisco) create newly independent companies that must rebuild corporate development from scratch. - Crossover/growth firms (Insight, Warburg, PSG) signal a company is graduating onto the consolidation path — earlier in the cycle, but an indicator of future acquisitiveness. - Large-cap generalists (KKR, TPG, Advent) run scaled platforms that typically buy in year 2–5 of hold (06).

→ Cross-references: Private Equity, Thoma Bravo, Vista, PE Operating Model, Key People, Buy-Side Prospect Framework.

Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.