The Business of Cyber Security

The Cyber M&A Advisory Landscape

The cyber M&A advisory market is not a single pool but a layered set of firms tiered by deal size and degree of sector specialization, each with a different economic model. In 2025 the industry ran roughly 400–430 announced cybersecurity M&A transactions worth a disclosed ~$84–96B, eight deals over $1B accounting for the bulk of the value (SecurityWeek count 426; Solganick Q4 2025; see Deals); every deal had at least one advisor per side, often two or three. Understanding who plays where underpins buyer/seller mapping and co-advisory and referral relationships.

The three tiers — who advises what

What each tier does, and how it is paid

Tier 1 — bulge-bracket & elite boutiques. On $1B+ cyber deals (Google–Wiz, Palo Alto–CyberArk, Cisco–Splunk), the work is less about finding the counterparty — both sides already know each other — and more about executing a complex, scrutinized transaction: fairness opinions, financing (often the same bank lends and advises), antitrust strategy across multiple jurisdictions, board and shareholder management, and public-market optics. The elite independents (Qatalyst, Evercore, Centerview, Allen & Co.) win the advisory mandates on technology mega-deals precisely because they carry no lending conflict; Qatalyst in particular is the default sell-side advisor on large software/cyber. Fees here are a low percentage of a very large number — typically ~0.5–1% of EV, but on a $25B deal that is $125–250M. RBC Capital Markets sits in this layer. Houlihan Lokey built a deep cybersecurity practice (it publishes a quarterly cyber market update) and spans Tiers 1–3.

Tier 2 — tech-focused boutiques with a cyber practice. In the $250M–$1B band, the buyer universe is wider and less obvious, so the advisor's sector rolodex and process-running capacity are the product. AGC Partners is the most prolific tech-M&A boutique (hundreds of deals, a dedicated cybersecurity team); Union Square Advisors, DBO Partners, and Arma Partners (now Rothschild's tech franchise) run growth-software and cyber processes. The economic model is a retainer plus a success fee in the ~1–2.5% range, scaling down as deal size rises (the Lehman-formula logic).

Tier 3 — cyber-specialist boutiques. Below ~$250M — the majority of the ~430 annual cyber transactions by count — sits the specialist layer. These firms win on domain depth (they speak CNAPP, NHI, MDR fluently), relationships with the specific strategic and sponsor buyers active in each sub-segment, and operator credibility. The published deal trackers come from this tier — Solganick (quarterly cyber M&A updates), Kroll Corporate Finance (sector reports; also a services/IR provider, ~234 software-sector deals / $63.3B in 9M 2025), and Momentum Cyber (the canonical annual report, ~$96B / ~400 deals in 2025). Fees are the highest percentage of the smallest numbers — Lehman-style stepped success fees of ~3–8%, often on a monthly retainer.

Tier Deal size Representative firms What they sell Typical fee
1 · Bulge / elite $1B+ GS, MS, JPM, BofA, Citi, Barclays; Qatalyst, Evercore, Centerview, Allen & Co., Moelis, Lazard, Jefferies, Houlihan Lokey, RBC Execution, financing, fairness, antitrust, board mgmt ~0.5–1% of EV
2 · Tech boutiques $250M–$1B AGC, Union Square, DBO, Arma (Rothschild), William Blair, Stifel, Raymond James, Piper Sandler Sector reach + buyer rolodex + process ~1–2.5% of EV

How a firm wins a mandate

Mandates are won on three things, in order: (1) relationships — the banker who already knows the founder, the sponsor's operating partner, or the strategic's Corp Dev lead; (2) credibility in the sub-segment — demonstrable knowledge of the specific category's buyers, comps, and value drivers; and (3) process quality — the perception that this advisor will run a tight, competitive process and not leave money on the table. Pitch decks (the "bake-off") lean heavily on recent comparable deals advised — which is why the league-table reports double as marketing. The structural weakness of the specialist tier is that it is transaction-led: a boutique eats only when a deal closes, so it is incentivized toward one-off hunts, not continuous coverage.

League-table intelligence

The quarterly/annual cyber M&A reports (SecurityWeek's running deal count, Solganick, Kroll, AGC, Houlihan Lokey) are dual-purpose. As competitive intelligence, they reveal who is advising the most deals, in which sub-segments, at what sizes — i.e., which boutiques are gaining share and where co-advisory or referral relationships could form. As market intelligence, they show which sub-segments are heating up (and therefore where buyer appetite — and sell-side origination — is concentrated). When identity consolidated post-CyberArk, the advisors active in identity became both referral partners and read-throughs on buyer demand.

→ angle — program-led beats transaction-led

Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.