The Business of Cyber Security

Worked Case Studies — Take-Privates & Carve-Outs

06d explains the mechanics of take-privates and carve-outs in the abstract; 06e works the return math. This section grounds both in four cyber transactions — a classic take-private, a founder-rollover take-private, a conglomerate carve-out, and a 2026-era reset take-private. Dates are labelled announced/agreed vs completed/closed.

On April 26, 2021, Proofpoint agreed to be taken private by Thoma Bravo for ~$12.3B — $176.00/share, a ~34% premium to the prior close. It completed August 31, 2021 (Proofpoint, Thoma Bravo). At the time it was the largest cyber take-private, and the template the deals below rhyme with.

Case 1 — The classic take-private: Thoma Bravo ← Proofpoint ($12.3B, 2021)

Type Public-to-private buyout (take-private)
Agreed Apr 26, 2021 · Completed Aug 31, 2021
Price $176.00/share, ~$12.3B, ~34% premium to Apr 23 2021 close
Target profile Scaled email-security leader (03j), decelerating growth, rich recurring cash flow, clean balance sheet

Why it fit the template. Proofpoint had everything a sponsor underwrites: durable, non-discretionary recurring revenue; a defensible position in a regulated demand category; and a public-market valuation that punished the margin reinvestment needed to platform. Going private removed the quarterly scrutiny so Thoma Bravo could re-rate pricing, expand margin, and bolt on adjacencies on a multi-year clock (06d, 30). The lesson: the prototypical take-private target is cash-flow-rich, decelerating, and clean — exactly the screen analysts now apply to names like Qualys and Rapid7 (analyst speculation, not announced deals; 12).

Case 2 — The founder-rollover take-private: Vista ← KnowBe4 ($4.6B, 2022→2023)

Type Take-private with significant equity rollover
Agreed Oct 11, 2022 · Completed Feb 1, 2023
Price $24.90/share, ~$4.6B, ~11% premium to the pre-announcement close
Rollover Founder-CEO Stu Sjouwerman, KKR, and Elephant rolled ~$682M of equity rather than cashing out

What's distinctive. The thin ~11% premium is the tell: this was not a contested auction of a melting asset but a negotiated continuation — the founder stayed CEO and rolled equity, betting alongside Vista on a second act in "human risk management" (Vista). Rollover aligns the founder with the sponsor's value-creation plan and reduces the equity Vista must write. The lesson: when a founder rolls, premiums compress but alignment rises; the deal is about the next five years of compounding, not a one-time exit. The founder-CEO remains the decision-maker.

Case 3 — The conglomerate carve-out: Broadcom ← Symantec Enterprise ($10.7B, 2019)

Type Divisional carve-out (enterprise unit extracted from a public parent)
Agreed Aug 8, 2019 · Completed Nov 4, 2019
Price ~$10.7B cash for the enterprise security business
Economics cited at signing >$2B incremental run-rate revenue; ~$1.3B pro-forma EBITDA incl. synergies; >$1B targeted run-rate cost synergies within 12 months (Broadcom)

The carve-out logic. Broadcom's model is to buy an established enterprise franchise, strip cost, and harvest the cash flow of a "sticky" installed base — the opposite of a growth thesis. Symantec sold its enterprise unit, transferred the Symantec brand to Broadcom, and renamed itself NortonLifeLock (consumer). The hard part was separation — disentangling shared engineering, sales, and IT and standing up independent functions (06d). The PE-relevant cousin: the same carve-out muscle defines STG and Crosspoint (06c) — the McAfee Enterprise / FireEye lineage that produced Trellix and Skyhigh. The lesson: a freshly carved-out company inherits no corporate-development function yet must immediately consolidate its newly independent niche.

Case 4 — The 2026-reset take-private: Turn/River ← SolarWinds ($4.4B, 2025)

Type Take-private (software/IT-management with security exposure)
Agreed Feb 7, 2025 · Completed Apr 16, 2025
Price $18.50/share, ~$4.4B, ~35% premium to the 90-day average price

Why it belongs here. SolarWinds — still recovering from its 2020 supply-chain breach — is a case of the post-reset take-private: a cash-generative but discounted public name where a sponsor (Turn/River) bets that private ownership and a "growth-engineering" overhaul beat life under quarterly scrutiny. The lesson: the 2026 valuation reset widened the discount-to-intrinsic window across scaled public cyber, which is why 2026 has been a take-private-rich year (06d). The premium basis differs from Cases 1–2: 35% is to a 90-day average, not a single prior close — a higher-looking headline than a same-day premium.

The premiums, side by side

Take-private premiums paid — and why they differ 40% 30% 20% 10% 0% ~34% Proofpoint vs prior close ~11% KnowBe4 founder rollover ~35% SolarWinds vs 90-day avg* n/a Symantec carve-out (no /sh) *Basis differs: SolarWinds premium is to a 90-day average, not a same-day close — a richer headline. Carve-outs have no per-share premium (asset sale).
Premium size encodes the deal's nature: a contested take-private of a scaled asset pays ~34–35%; a founder-rollover continuation pays ~11% because alignment substitutes for cash; a carve-out has no per-share premium at all. Read the premium and you can read the deal type.

Reading the four together

Case Mechanic Primary value driver Hardest part Post-deal M&A implication
Proofpoint Take-private De-risk margin reinvestment off the public clock Paying up in a competitive process Bolt-on sourcing post-close
KnowBe4 Take-private + rollover Founder-aligned second act Aligning founder & sponsor incentives Repeat relationship; future bolt-ons
Symantec Carve-out Cost-strip + cash harvest of installed base Separation (TSAs, stranded cost) New independent co with no Corp Dev
SolarWinds Reset take-private Buy the discount; growth-engineer privately Overcoming reputational/valuation overhang Consolidation thesis under new owner

The through-line: every one of these deals manufactures buy-side demand. A newly-private platform needs to consolidate; a carve-out needs to build an M&A function from zero; a founder-rollover keeps a serial-acquirer founder in the chair. The PE machine doesn't just do M&A — it creates the need for more of it downstream (06d, 06e).

Cross-references: Private Equity, Thoma Bravo, Vista, Sponsor Landscape, Operating Model & Mechanics, Buy-and-Build Math, M&A Deals & Comps, Deal Structures & Exits, Bear Case.


Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.