The Business of Cyber Security

Growth-Stage Metrics and Diligence

Twenty Technologies raised a $100M Series B at a $1B valuation (led by Accel, June 2026) and Ent raised a $100M seed the same month; both were priced on narrative — pedigree, category, and a market thesis — because neither had the operating history to price on numbers. By Series C/D that grace period ends. A growth-stage round and a strategic acquisition are underwritten on the same spine of metrics, because both the late investor and the acquirer are buying durable, efficient revenue rather than a story. This is the stage at which the VC map becomes a sell-side pipeline: companies that raised a big Series C 2–4 years ago and are now growing into — or stalling short of — the public-market bar.

The metrics below apply the unit-economics framework on 02a to the specific decision a Series C/D investor or an acquirer faces.

The growth-stage dashboard

At growth stage the question shifts from "can this work?" to "does the engine compound efficiently and durably?" Five vectors carry almost all the weight, and they must be read together — any one in isolation misleads.

Metric What it measures Growth-stage bar (cyber) The trap it exposes
ARR growth Top-line momentum ~$50M+ ARR growing 40%+ to clear the Series C/D bar; 30%+ to stay IPO-credible Growth bought with burn or one-time deals
Net Revenue Retention (NRR) Expansion within the installed base Median ~101%; top quartile 111%+; enterprise 118%; <100% is a leak A high logo count hiding net contraction
Gross Revenue Retention (GRR) Stickiness before upsell 90%+ enterprise; pair with NRR to expose churn masked by expansion NRR ~110% on GRR ~80% = a leaky bucket
Rule of 40 Growth + FCF/operating margin ≥40 (profit-weighted as the company scales) 60% growth at −40% margin is not a 40
CAC payback / magic number Sales efficiency Payback 15–18mo (elite <12); magic number ≥0.7 Growth that gets more expensive at scale
Burn multiple Net burn ÷ net new ARR <1.5x good; <1.0x elite The capital cost of each ARR dollar

The cardinal rule is read pairs, not points. NRR with GRR exposes whether expansion is masking churn. Growth with burn multiple exposes whether momentum is bought. Rule of 40 with CAC payback exposes whether the path to profitability is real or deferred. A company that looks great on growth alone and bad on the pairings is precisely the company that stalls between its last private round and the IPO it can never reach — the sell-side candidate.

The dashboard is necessary but not sufficient. Every metric here measures the quality of revenue already booked; none answers the question a board member should ask first: does the moat survive a platform deciding to bundle the category? A company can post NRR of ~120%, a sub-1.0 burn multiple, and a sub-12-month payback and still be a feature — one Microsoft or Palo Alto ships for free next quarter, at which point the expansion engine reverses and the efficient base becomes a melting asset. So the numeric dashboard is read against two qualitative tests: moat durability (the 33 moat map — data network effect, workflow lock-in, distribution, regulation, category scarcity, or staffed operations) and category position (creator vs fast-follower, 07e). Pristine metrics inside a bundling-exposed category are the classic value trap — priced for a durability the moat cannot defend (31).

Growth-investor diligence vs. acquirer diligence

A late-stage VC and a strategic acquirer scrutinize the same dashboard but optimize for different outcomes, and the difference determines who pays more.

Dimension Growth investor (Series C/D) Strategic acquirer
Core question "Will this compound to an IPO or a bigger round at a higher mark?" "Will this revenue survive ownership change and accelerate on my platform?"
Values most Durable growth, efficient CAC, a clean cap table, a path to public-market metrics Reference base, product fit with the platform, cross-sell into the installed base
Underwrites The standalone trajectory The standalone trajectory plus synergy (and discounts integration risk)
Pays for The next 2–4 years of compounding The category, the team, the references, minus a value-leakage haircut (30a)
Dilution / cost lens Burn multiple, runway, ownership Integration cost, churn-on-transition risk, retention of key talent

Because the acquirer underwrites synergy on top of the standalone case, the strategic can frequently outbid the growth round — which is exactly why a stalling Series-C company is often worth more sold than re-financed. The growth investor marks it down for decelerating growth; the right strategic marks it up for cross-sell into a platform the startup could never reach alone. Recognizing that crossover point is the core sell-side judgment.

The growth-stage quadrant: growth vs. efficiency ARR growth (x) vs. capital efficiency / Rule-of-40 quality (y) efficient burn-heavy slow growth fast growth EFFICIENT, SLOWING→ sell now (acquirer pays for efficiency) FUND-ABLE GROWER→ raise Series C/D or IPO STALLED & BURNING→ fix or distressed sale GROWTH AT ANY COST→ window closing; sell before reset durable compounder sell-side sweet spot Illustrative framework. Bars/benchmarks per growth-stage SaaS cyber norms (02a). Exhibit: The Business of Cyber Security.
The sell-side sweet spot is the upper-left: efficient companies whose growth is decelerating below the IPO bar. The growth investor discounts them; the right strategic pays a premium for the efficiency and the references.

Relevance to M&A

The growth-stage dashboard doubles as a sell-side timing instrument. The "graduating class" — VC-backed cyber companies at roughly $30–200M ARR, too small to IPO and likely to seek a strategic exit in 12–24 months (07) — can be identified by reading these metrics from outside: a big Series C/D 2–4 years ago, growth decelerating from 60%+ toward 30%, and (ideally) clean efficiency. That profile sits in the quadrant's upper-left, where a process run toward the right strategic can capture a synergy premium the standalone numbers would not justify.

The diligence asymmetry is the lever. Because the acquirer underwrites synergy, a sell-side advisor frames the standalone numbers in the acquirer's terms — translating the company's references and efficient base into the cross-sell and platform-fit story the strategic pays for, while a competitive process defends price against the integration-risk haircut that undermines most deals (30a). The same metrics that would mark the company down in a financing become the headline of a teaser when reframed for the buyer who values them most.


See also

Sources: benchmarks per Unit Economics (NRR/Rule-of-40/CAC-payback, 2026 SaaS data); Twenty Technologies $100M Series B at $1B (Crunchbase, Jun 2026); Ent $100M seed (SecurityWeek, Jun 16 2026).


Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.