The Cyber Advisor League Table
There is no single, authoritative "cybersecurity M&A advisor league table" the way there is for global all-sector M&A — cyber deals are scattered across bulge-bracket tech teams, mid-market software banks, and cyber-exclusive boutiques, and most sub-$250M deals never disclose the advisor at all. This page assembles the best public proxies: the all-sector volume leaders (which capture the large cyber deals), the most-active mid-market software/cyber banks (which capture the bulk of the deal count), and the cyber-exclusive shops (which dominate the founder-owned tail). Read together, they map the competitive field by where each firm actually wins.
The volume leaders (all-sector, 2025) — who captures the large cyber deals
The largest cyber transactions — take-privates, $1B+ strategic acquisitions, carve-outs — go to the same franchises that top the global all-sector tables. The 2025 global advisor rankings frame the top of the cyber market too:
| Advisor | 2025 global rank | Basis | Cyber relevance |
|---|---|---|---|
| Morgan Stanley | #1 by value (~$872.7B advised) | Bulge bracket | Leads the largest cyber sell-sides / take-privates |
| Houlihan Lokey | #1 by volume (318 deals) | Straddles elite↔mid-market | #1 global tech M&A by deal count; deepest restructuring bench |
| Goldman Sachs | Top-3 (value & volume) | Bulge bracket | Board-level cyber mandates, financing gravitas |
| J.P. Morgan | #3 by volume (234 deals) | Bulge bracket | Large-cap cyber + financing |
| Rothschild & Co | #5 by volume (171 deals) | Elite independent | Cross-border, take-private advisory |
(Source: 2025 global M&A financial-adviser rankings, Private Banker International. Ranks are all-sector; they bound the large-deal cyber field, not cyber-only activity. In Q1 2026 the top of the table reshuffled — Goldman Sachs and Houlihan Lokey led Q1 2026 — a reminder these are quarterly-volatile.)
The takeaway for cyber: Houlihan Lokey is the structurally important name because it leads on count — it runs the most technology M&A processes of any firm (on the order of ~500+ software deals a year at an average ticket near ~$400M), which means it touches more cyber assets in the $250M–$1B band than any bulge-bracket peer, and its restructuring bench positions it to win the distressed cyber sales that multiply when growth stalls.
The mid-market & cyber-specialist activity table — who captures the deal count
Below the $1B line, where most cyber deals actually happen, the league shifts to software-focused mid-market banks and cyber-exclusive boutiques. The public activity data:
| Advisor | Cyber/tech activity (latest public) | Positioning |
|---|---|---|
| AGC Partners | 28 deals closed in 2025 (14 PE-platform / 14 strategic); 40 new mandates signed; 149 security transactions / $9.7B since 2003 — self-described most active mid-market cyber bank | Mid-market software/cyber workhorse |
| Houlihan Lokey | ~500+ software deals/yr; #1 tech M&A volume; dedicated cyber practice + quarterly report | Straddle (mid-market → elite) |
| Momentum Cyber | Category-defining cyber-exclusive bank; CYBERcloud DB tracks 5,000+ cyber companies; annual "Cybersecurity Almanac" | Cyber-exclusive (competitor) |
| Solganick & Co. | Dedicated cyber practice; publishes a widely-read quarterly cyber M&A report (tracked 105 cyber deals in Q4 2025) | Lower-mid-market software/services |
| Kroll | Sell/buy-side advisory + deepest DFIR/IR bench feeding proprietary flow; quarterly cyber M&A insights | Cyber-exclusive + incident response |
| William Blair · Union Square · Shea & Co. | High mid-market tech/cyber deal counts; sector depth | Tech mid-market |
| Stonepipe · 7 Mile · Equiteq · Aventis | Founder-owned / tech-services specialists | Lower-mid-market |
(Sources: AGC 2025 tech rankings & year-end report and AGC cybersecurity practice; Solganick Cybersecurity M&A Q4 2025; Kroll cyber-sector M&A insights. AGC's "most active mid-market cyber bank" is a self-description; deal counts are firm-reported. Cyber-deal-volume figure — 105 in Q4 2025 — is Solganick's tracked count, a proxy for total market activity, not one firm's mandates.)