Private Credit & Direct Lending in Cyber Buyouts
When Thoma Bravo takes a cyber company private or a sponsor funds a buy-and-build platform, equity is only part of the check. The rest is private credit, and the amount of debt available, and on what terms, sets the ceiling on what any sponsor can pay. In 2025 direct-lending buyout financing hit $81B, the highest on record (up from $73B in 2024), even as total direct-lending volume fell 11% to ~$247B — the second-busiest year ever (PitchBook/LCD). Fewer, bigger deals: the average direct-lending LBO rose 29% to ~$380M (from ~$295M in 2024). Software is structurally over-represented — outstanding direct loans to software firms grew from ~$8B in 2015 to over $500B, ~19% of all direct loans, by end-2025. Cyber, as premium recurring-revenue software, sits at the center of that pool.
How a cyber LBO is capitalized
Why software/cyber clears unusual leverage
Most LBOs are levered against EBITDA. High-growth cyber companies often have little or no EBITDA — they reinvest into growth — yet lenders still finance them, because recurring revenue is collateral. Two structures dominate:
- Unitranche — a single blended senior+subordinated facility at one rate, from one lender (or a small club). It is the structure of choice for mid-market software/cyber buyouts because it offers speed and certainty of close — a sponsor can commit to a price knowing the financing is locked. Software unitranche routinely reaches ~6–7x EBITDA, and up to ~20x for the highest-quality assets with strong net revenue retention.
- Recurring-revenue (ARR) loans — for pre-profit, high-growth names, lenders size the loan against a multiple of ARR (and NRR/churn) rather than EBITDA, with covenants that convert to leverage-based once the company reaches profitability. This is how growth-stage cyber gets financed before it has earnings.
The economics: lenders earn a floating spread over the base rate plus original-issue discount and fees, with covenant packages (leverage, liquidity) that tighten as risk rises. For the sponsor, debt is cheaper than equity and amplifies returns — but it is also the single biggest risk in a downturn, because interest is owed regardless of growth.
Who provides the capital
| Lender | Type | Cyber/software relevance |
|---|---|---|
| Ares Management | Direct-lending leader (ARCC) | Largest BDC; heavy software exposure |
| Blue Owl Capital (incl. Owl Rock) | Direct lending | Dedicated tech-lending franchise |
| Blackstone Credit (BXSL/BCRED) | Direct lending | Scaled software lender |
| Golub Capital | Mid-market direct lending | Sponsor-friendly unitranche specialist |
| HPS Investment Partners | Direct lending | Acquired by BlackRock (2025) |
| Apollo (incl. MidCap) | Credit | Large-cap private credit |
| Sixth Street | Flexible/structured | Growth + credit hybrids |
| Vista Credit Partners | Software-specialist credit | Lends within the software ecosystem |
| Thoma Bravo Credit | Software-specialist credit | Captive + third-party software lending |
| AB Private Credit, Antares, Benefit Street, KKR Credit, Carlyle (AlpInvest), TPG Angelo Gordon | Direct lending | Active in tech buyouts |
| Hercules, TriplePoint, First Citizens (ex-SVB) | Venture debt | Pre-buyout growth lending to startups |
The software-specialist captive lenders (Vista Credit, Thoma Bravo Credit) are a structural feature worth noting: the largest software sponsors now run their own credit arms, lending into the same ecosystem they buy in — capturing the debt spread on top of the equity return, and tightening the loop between sponsor and lender.
The risk side: leverage in the reset
The 2026 backdrop is more cautious. Banks are clawing back share in larger leveraged loans; private credit faces scrutiny on liquidity, redemptions, and AI-disruption risk (a meaningful slice of private-credit software portfolios carry exposure to AI-driven model change — a contested analyst estimate). The scale is what makes this matter for cyber: per the BIS Quarterly Review (Mar 2026), outstanding direct loans to software firms grew from under $8B in 2015 to over $500B (~19% of all direct loans) by end-2025, then the grade got questioned — software equities fell ~30% Oct 2025–Feb 2026 and BDCs with high software exposure underperformed low-exposure peers by ~5pp (BIS, Mar 2026).
The retreat is no longer hypothetical and carries a cyber name: by late May 2026, Thoma Bravo was struggling to refinance Sophos (endpoint security; ~$2.5B first-lien term loan due Mar 2027 + ~$92.5M revolver due Dec 2026) as private-credit lenders turned reluctant on endpoint-software AI-replacement fears — pushing Thoma Bravo toward a Goldman-run parallel ~$2.6B syndicated amendment instead (reported May 28 2026; Bloomberg, Private Equity Wire). Moody's had already moved: in March 2026 it downgraded Sophos one notch to B3 from B2 (looming maturities turning current + weaker-than-expected operating performance), assuming refinancing by end-June 2026 — a deadline arriving late June with the refi still unresolved. The official sector flagged the systemic backdrop in parallel: the FSB's Report on Vulnerabilities in Private Credit (6 May 2026) warned of the asset class's concentration in tech, opaque multi-layered leverage, and liquidity mismatch in redemption-offering funds (FSB, 6 May 2026).
A cyber company levered at ~20x EBITDA against decelerating growth is the canonical distressed-asset setup: if growth slips or the exit window stays shut, the debt service that amplified returns on the way up now compresses equity on the way down (see Bear Case, Hold/Exit Timing). That stress is also a source of deal flow — carve-outs and distressed sales.
→ angle — leverage as a signal
→ Cross-references: Lenders & Credit, Private Equity, Buy-and-Build Math, Hold/Exit Timing, Deal Structures, Bear Case.
Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.