The Lenders, by Name

Every PE-backed cyber take-private has a second name on the term sheet. When Thoma Bravo takes a cyber asset private, the equity comes from its buyout fund, but roughly half the check comes from a direct lender — often Thoma Bravo's own credit arm or a club of mega-platform funds. The identity of that lender, and the terms it offers, set the ceiling on what the sponsor can pay. The corollary is that watching who lends, and when they refinance, is a leading indicator of who can buy next. In 2025, direct-lending buyout financing hit a record $81B even as total direct-lending volume fell ~11% to ~$247B, and software's share of all direct loans crossed ~$500B (~19%) (PitchBook/LCD). Cyber, as premium recurring-revenue software, sits at the center of that pool, and a concentrated set of lenders supplies it.

The three lender types in a cyber buyout

A cyber LBO is typically funded by one (or a club) of three lender types, which differ in who they answer to and therefore how they price and behave:

1. Mega-platform direct lenders — independent credit giants (Ares, Blue Owl, HPS, Blackstone Credit, Apollo, Golub) that raise from insurers, pensions, and sovereign wealth, then lend across the whole market. They compete on certainty and speed of execution and can write a multi-billion-dollar unitranche from a single fund — which is why mega buyouts now bypass the syndicated-loan market entirely.
2. Software-/sponsor-captive credit arms — credit funds owned by the same PE platforms that buy software companies (Vista Credit Partners, Thoma Bravo Credit). They underwrite recurring-revenue/ARR loans with deep software-specific conviction and will lever durable ARR higher than a generalist will. They are both a competitive advantage for their parent and a third-party lender to others.
3. BDCs (Business Development Companies) — publicly traded or non-traded permanent-capital vehicles (Blue Owl's OBDC, Ares Capital/ARCC, Golub Capital BDC) that deploy the platforms' credit strategies to middle-market borrowers and disclose their books quarterly — making them the most transparent window into how cyber/software credit is actually being priced.

The named lender set

Figures are labeled estimates drawn from the firms' disclosures and reputable rankings; AUM moves quarterly, so each number is as-of its stated date rather than current.

What separates them

The mega-platforms compete on balance-sheet certainty: a sponsor in a competitive auction wants a lender that can commit the entire debt package fast, without syndication risk, so the bid is credible at signing. That certainty is worth real basis points of price — abundant, confident credit lets a sponsor bid higher, which is good for the sell-side (10b). The software-captives compete on conviction: because Vista Credit and Thoma Bravo Credit underwrite software all day, they will lend against durable ARR at leverage a generalist won't touch (09a: software clears toward ~6–7x EBITDA, higher on recurring revenue, occasionally up to ~20x on an ARR basis). That extra turn of leverage is, in effect, a captive financing advantage for their parent's buyout fund — a structural reason Vista and Thoma Bravo can win software auctions on price. The BDCs, finally, are the transparency layer: their quarterly filings reveal the marks, spreads, and non-accruals on real software credits, which is the cleanest public read on whether the credit window is opening or closing.

The lender stack by ticket size and conviction

The refinancing-as-trigger mechanic

The most actionable point: a new or upsized credit facility is a buy-side signal. When a sponsor-owned cyber company puts a fresh unitranche in place — or a lender announces a large new software facility — it usually means one of three things, all relevant to deal work: (1) the sponsor is dividend-recapping to return capital, often a precursor to an exit run; (2) the company is funding an acquisition, i.e., becoming a buyer itself (a roll-up platform, see 06e); or (3) the sponsor is terming out ahead of a sale to make the asset turnkey for the next owner. Watching the BDC filings and the direct-lending press for new cyber/software facilities is therefore a low-cost origination feed — it flags both future sellers (recaps/term-outs) and active buyers (acquisition facilities) before the bankers are mandated.

The bear case. The lender-as-signal read weakens if (1) the credit window slams shut — a rate shock or a wave of software non-accruals would freeze new facilities and make leverage, not lenders, the binding constraint, collapsing the buyer set regardless of who lends; (2) disintermediation — if the syndicated-loan market reopens cheaply, mega-unitranche loses its edge and lending fragments back to banks, muddying the signal; or (3) captive conflicts get reined in — if LPs push back on software-captives lending to their parent's own deals, that financing edge for Vista/Thoma Bravo narrows. The base case through 2026, with record buyout financing and software at ~19% of direct loans, is that concentrated specialist credit keeps setting the price ceiling — so the lender list stays a high-value targeting input.

Sources

• Private credit activity in 2025 (buyout financing $81.4B record) — PitchBook/LCD
• 10 largest private credit funds (Apollo, Blackstone, Ares) — StockAnalysis
• Top 20 private credit managers / dry powder — S&P Global Market Intelligence
• PDI 200 — Ares #1, HPS #2, Blackstone #3, Blue Owl top-10 (private-debt fundraising)
• Blue Owl Capital Corp (OBDC) — Form 10-Q, FY2025 (238 cos., ~$17.1B FV, 9/30/25)
• The Top Private Credit Firms of 2025 — GrowthCap

Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.