The Graduating Class Tracker

In March 2026, XBOW raised a $120M Series C at a $1B+ valuation (DFJ Growth and Northzone leading; ~$237M raised in total since 2024) — a marker of a company entering the graduating class: well-funded and scaling, but not yet at the scale or profitability that supports an independent IPO. Every venture-backed cyber company that survives its category-creation phase eventually arrives at the same fork that 07e describes: grow into a public company, get acquired, recap with a sponsor, or get bundled away. The graduating class is the population sitting at that fork, and it is a primary sell-side origination list.

What "the graduating class" means

A graduating-class company is one that has proven product-market fit and reached real scale but is too small to IPO comfortably and too valuable to ignore as an acquisition target. Concretely, the cohort clusters around these traits:

• ARR roughly $30–200M. Below ~$30M a company is still proving itself; above ~$200M ARR with durable 30%+ growth and Rule-of-40 health it can credibly target an IPO (the 07f bar). The middle is the graduating class.
• 24–48 months past a large Series C/D. The capital is deployed, the board wants a return path, and the next round is harder to justify than the last.
• Growth decelerating from hypergrowth toward the 30–40% band, while burn discipline either improves (the attractive case) or doesn't (the distressed case). Read in pairs per 07f.
• Sitting in a sub-segment mid-consolidation (see the life-cycle map on 26) — where a platform acquirer has a strategic reason to buy rather than build.

This cohort exists structurally, not by accident. The IPO window is an episodic regime (see 29b) — open in 2021, mostly shut 2022–2024, selectively open again with SailPoint's re-IPO (priced Feb 12 2025), Netskope (Sep 17 2025), and Rubrik (Apr 2024). Most scale-ups cannot time their readiness to the window, so the strategic sale is the base-rate exit, not the exception.

The graduation funnel

The funnel runs seed → Series A/B (build the product) → Series C/D (scale the GTM) → the fork. Four outcomes:

1. IPO — needs ~$200M+ ARR, durable 30%+ growth, and an open window. The rarest path; most "IPO-track" companies actually exit via #2.
2. Strategic sale to a platform — the base case. A PANW/CRWD/Cisco/Zscaler/Microsoft (see 03m) or an adjacent strategic buys the category capability and the customer base. This is the classic sell-side mandate.
3. Sponsor recap / PE platform — a Thoma Bravo / Vista / growth-equity sponsor (see 06) takes a majority stake to run a value-creation playbook, often as a roll-up nucleus.
4. Down-round, acqui-hire, or wind-down — the distressed branch for companies that stalled with burn intact and no buyer urgency.

The watchlist: graduating-class candidates by sub-segment

The table maps a representative set of venture-backed cyber scale-ups to their likely fork. All ARR figures are estimates triangulated from public reporting and labeled accordingly; the Cyber Ecosystem Graph holds the live, enriched values. Inclusion is not a claim that a process is underway — it is a structural read of where each company sits.

→ The companies sitting in the sell-side window (gold dots above) share a profile: a 2021–2022 mega-round, a cloud or identity or SecOps category now mid-consolidation, growth that has cooled from triple digits toward the 30–40% band, and no obvious next financing. That is precisely the 07f "efficient-but-slowing" quadrant — worth more sold to the right strategic than re-financed.

Huntress is the counter-case, and it is worth stating plainly because it moved off this list. In July 2026 the company disclosed that it had passed $250M in ARR, growing 65% year over year, protecting more than 270,000 businesses, 14 million identities and 5.5 million endpoints across more than 100 countries, at 130% net revenue retention (Huntress, Jul 30 2026). Its CEO has said the company is planning a round in early 2027 that could triple the ~$1.5B mark set in 2024 — implying roughly $4.5B — and that pre-emptive rounds valuing the company at upwards of $5B have been declined since 2024 (Axios Pro, Jul 30 2026). Two things follow for the watchlist logic. First, the exit-readiness signals below are conditional on decelerating growth: a company compounding at 65% at $250M scale fails the trigger, and the correct classification is "re-funded, clock reset," not "sell-side window." Second, the profile that produced it — SMB and mid-market, MSP-channel-led, per-seat pricing, a market that venture investors dismissed as non-venture-scale for most of a decade — is the segment where scale accrued fastest in this cycle, and it is under-represented in the mega-round cohort above. See MDR and Distribution & Marketplaces.

Exit-readiness signals

A watchlist is only useful if it is triggered. The confirming signals, in rough order of strength:

1. Growth crosses below ~35% with efficiency intact — the 07f trigger; the financing math gets harder and the strategic math gets better at the same moment.
2. 24–36 months elapsed since the last big round with no new raise announced — the board's return clock is running.
3. A platform acquirer makes a tuck-in in the same sub-segment — validates the category and signals the consolidation phase has begun (e.g., the AI-security sweep, 03l).
4. An exec move that reads as exit-prep — a new CFO with IPO/sale experience, or a banker added to the board.
5. The category's "fork" arrives (07e) — a bundler announces a competing native feature, compressing the standalone window.

The bear case

The graduating-class thesis can be wrong in three ways. First, re-absorption: many of these categories get bundled into platforms as features before a clean exit, leaving the standalone company stranded (the 03l/03j risk). Second, the window reopens: if the IPO regime swings open, several "sell-side" names re-route to public markets and the strategic discount disappears. Third, the AI reset: AI-native entrants can leapfrog a scaled incumbent's category, turning a "graduating" company into a melting asset rather than a premium target. The watchlist must therefore be re-scored continuously, not set once.

→ & angle

→ Warm-intro pathfinding (Objective 3 enablement). Cross-reference each name's founders, board, and lead investors against the 8,234-contact graph to find the shortest warm path to the founder/CEO before a banker beauty-contest forms.

Sources: Cato tops $300M ARR — CNBC, Feb 24 2026; XBOW raises $120M Series C at $1B+ — SecurityWeek, Mar 18 2026; SailPoint re-IPO / Netskope / Rubrik anchors — see 29b. ARR figures are estimates from public reporting; the Cyber Ecosystem Graph is the live source of truth.

Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.