The Business of Cyber Security

The Buy-and-Build Math (Worked)

The landing page shows the buy-and-build value bridge in enterprise-value terms. This section works the equity-return model in full: sources and uses, the operating build, the value-creation attribution, MOIC/IRR, and the sensitivity that separates a strong cyber roll-up from a leveraged bet. A key point: in a real buy-and-build, deleveraging is usually not the return driver — operators often lever up to fund bolt-ons, and EBITDA growth carries the deal.

A real-world anchor: Thoma Bravo–backed Sophos bought Secureworks for ~$859M (announced Oct 21 2024; completed Feb 3 2025, $8.50/share) — an MDR bolt-on that took Sophos to ~28,000+ MDR customers (MDR). The model below is a generalized version of that move.

The setup: a cyber services/MDR platform LBO

Consider a profitable, mid-scale managed-security platform — the kind of PE-backed company also relevant to buy-side sourcing (27). Round numbers, chosen to be realistic for the segment (Economics, Valuation):

Entry (Year 0) Value
Platform EBITDA $50M
Entry EV / EBITDA 12.0×
Entry enterprise value $600M
Debt financing (6.0× EBITDA) $300M
Sponsor equity $300M

The leverage (6×) is conservative for software/cyber, where unitranche lenders have stretched toward ~20× in record cases (Lenders); we keep it moderate so the return is earned operationally, not just financially engineered.

The five-year operating build

The sponsor installs the operating model (06d, 30) and runs three levers in parallel:

Lever EBITDA effect How
Organic growth + margin +$30M (→ $80M) Pricing/packaging re-rate, NRR > 100%, GTM efficiency, automation of the SOC (Agentic SOC)
Bolt-on M&A (3 tuck-ins) +$40M (→ $120M) Acquire ~$40M of EBITDA at a blended 7.5× = $300M, funded $150M incremental debt + $150M cumulative free cash flow
Exit EBITDA $120M —

The bolt-ons are the crux: bought at 7.5× and folded into a platform the market values at 12×+, they are accretive on day one — the multiple-arbitrage spread (Operator Economics). Because cash flow and new debt fund them, no new sponsor equity goes in — so every dollar of acquired EBITDA accrues to the original equity check.

Net debt at exit

Entry debt $300M + $150M bolt-on debt − ~$100M cumulative free-cash-flow paydown = ~$350M net debt at exit. Note this is higher than entry debt — the platform levered up to consolidate.

Exit and the equity return

Exit (Year 5) Value
Exit EBITDA $120M
Exit EV / EBITDA (re-rated) 15.0×
Exit enterprise value $1,800M
Less: net debt ($350M)
Exit equity value $1,450M
MOIC ($1,450M ÷ $300M) ≈ 4.8×
IRR (5-yr) ≈ 37%

Where the return comes from

Decompose the $1,150M of equity value created ($1,450M − $300M) into the three classic LBO levers:

Equity value-creation bridge — where the 4.8× comes from $1.5B $1.0B $0.5B $0 $300M Entry equity +$840M EBITDA growth +$360M Multiple re-rate −$50M Deleveraging $1.45B Exit equity Attribution: EBITDA growth = ΔEBITDA $70M × 12× entry = $840M (73%). Multiple = Δ3.0× × $120M exit = $360M (31%). Deleveraging = entry net debt $300M − exit net debt $350M = −$50M (−4%): the roll-up levered UP to buy. Sum = $1,150M.
In a cyber buy-and-build the order of importance inverts the old LBO cliché: EBITDA growth dominates (~73%), multiple re-rate is second (~31%), and debt paydown is often slightly negative because the platform borrows to consolidate. The lever that matters most — bolt-on-fuelled EBITDA growth — is the one an M&A advisor directly supplies.

The attribution is exact and ties out: $840M + $360M − $50M = $1,150M. The common view that "PE returns come from leverage and financial engineering" does not hold for a well-run software/cyber roll-up — the engine is operational EBITDA growth, and bolt-on M&A is the largest single contributor to that growth.

Sensitivity

The 4.8× assumes the re-rate happens. Under stress:

Scenario Exit EBITDA Exit multiple Exit equity MOIC IRR
Base $120M 15.0× $1,450M 4.8× ~37%
No re-rate (multiple flat) $120M 12.0× $1,090M 3.6× ~29%
Re-rate + slower build $100M 13.0× $950M 3.2× ~26%
Bear: reset + missed plan $70M 10.0× $350M 1.2× ~3%

Two readings: 1. EBITDA growth is robust to the multiple. Even with no re-rate, tripling EBITDA still returns 3.6×. The operating plan, not the exit multiple, is the margin of safety. 2. The bear case is the integration/reset case. If the bolt-ons don't integrate (the build stalls at $70M — 30) and the 2026 valuation reset (Bear Case) compresses the exit multiple, the same leverage that amplified the upside leaves the equity barely above water. Leverage is symmetric; the operating plan is what makes it asymmetric.

The falsifiable bear case: the model assumes bolt-ons are sourced, priced below the platform multiple, and integrated against the operating standard. Each is an execution risk that destroys value when mishandled (Commercial Due Diligence, 30). The math works only if the M&A is well run.

Implication for M&A advisory

Because roughly 73% of the equity return depends on EBITDA growth — and the largest controllable component of that growth is bolt-on M&A bought below the platform multiple — the sourcing, pricing, diligence, and integration of bolt-ons is central to the return (27, 34).

→ Cross-references: Private Equity, Thoma Bravo, Operating Model & Mechanics, Worked Case Studies, Valuation, Value Creation, Commercial Due Diligence, Operator Economics.

Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.