Precedent-Transaction Methodology

A headline number can look like a comp without being one. When Accenture agreed to acquire Dragos (majority), runZero and NetRise for ~$4.18B in Jun 2026 (close expected Aug–Sep 2026), the implied ~20x combined ARR (page 11) instantly became the headline OT/ICS "comp." But it is three assets, a services-led acquirer, ~53% blended growth, and a scarcity dynamic created by ServiceNow–Armis a few months earlier. Applied unadjusted to a slower-growth, single-product OT target, that 20x mis-anchors the valuation by a factor of two or three. The precedent is real; the comp requires work. Where Public Trading Comps covers the regime refreshed daily, this covers the precedent-transaction regime, which, handled well, sets the price.

Why precedent transactions are the regime that sets the price

Of the three pricing regimes — public, private, M&A — the precedent transaction is the most persuasive in a live process because it answers the only question a counterparty actually cares about: what has a real buyer paid, in cash, for an asset like this, recently? Public comps tell you what the market will pay for liquidity; private rounds tell you what a narrative was worth to a minority investor. A precedent transaction is the one regime that priced control of the whole company — the same thing being bought or sold today.

That power is also its trap. Precedent transactions are sparse (a few relevant deals a month), disclosed unevenly (many values are undisclosed or "reported"), and each one carries deal-specific premia — control, scarcity, synergy, structure — baked into a single headline multiple. The methodology exists to decompose that headline back into its parts so a clean, comparable number can be rebuilt for the asset in question. A precedent quoted badly loses the room; decomposed correctly it anchors the valuation conversation.

Step 1 — Define the comp set

A precedent-transaction set is only as good as its screen. Four filters, in order:

1. Same sub-segment, by business model — not by label. An "identity" comp set that mixes workforce IAM, PAM, CIAM and non-human identity is not a comp set; those sub-niches trade turns apart (see Valuation by Sub-Segment). The relevant set is the value pool the target actually sits in.
2. Comparable scale and growth. A $20M-ARR tuck-in and a $200M-ARR platform do not price the same even in the same niche — the tuck-in trades on strategic option value (often higher multiple, lower absolute price); the platform trades on durable cash flow. The set is banded to the target's size and growth.
3. Recency — last 18–24 months, regime-aware. Cyber re-rated materially in early 2026 (12); a 2024 multiple is a different-regime number. Post-reset deals are preferred, and any pre-2026 comp is regime-stale.
4. Buyer type — strategic vs. financial vs. secondary. Strategics pay for synergy; sponsors pay for a return at an entry multiple; the same asset clears at different prices depending on who is at the table. The buyer types are kept separable so the relevant one can be argued for a given process.

As a rule of thumb, four genuinely comparable deals are more useful than twelve loosely related ones: a tight set that can be defended line-by-line beats a long set a sophisticated counterparty can pick apart.

Step 2 — Normalize the inputs

The most common error is computing EV/ARR from inconsistent inputs. Before any multiple:

• Enterprise value, not headline price. Strip cash, add debt, and — critically — adjust for deal structure: cash-and-stock deals (PANW–CyberArk: $45.00 cash + 2.2005 PANW shares/share) carry equity-value risk that moves the realized multiple after announcement; earnouts and retention pools inflate the headline over the guaranteed consideration. The committed versus contingent split is noted.
• Revenue vs. ARR vs. NTM. Cyber prices on ARR (or forward/NTM revenue), not trailing GAAP revenue. Applying a precedent's trailing-revenue denominator to a target's ARR introduces a silent error; the denominator is standardized across the set.
• As-reported vs. estimated — and press-release vs. media-reported. Many cyber deals disclose value but not ARR, so the multiple is a reported estimate. Source reliability also varies with where the figure originates: an amount stated in an established acquirer's press release is generally credible (though it can bundle earnouts into the headline), whereas a value that appears only in media reports is vetted unevenly and is sometimes materially inflated — by as much as three-to-four times in the least-verified cases. Analysis of the cyber M&A record also notes that "terms undisclosed" frequently accompanies weaker deals, and that the median cyber-startup acquisition clears well below the marquee headline numbers (Haleliuk, Venture in Security, Jul 28 2026). Such figures are labeled (~, "reported", or "N/D") rather than presented with false precision.
• Never build a denominator from the acquirer's post-close reported revenue. Purchase accounting remeasures the target's deferred revenue to fair value at close — broadly the cost of delivering the remaining obligation plus a normal margin — which is almost always below the amount the seller was carrying. The difference is revenue the customer has already paid for and that no one will ever report: the seller cannot, because the contract left with the business, and the acquirer cannot, because the balance was written down before it arrived. Reported revenue for an acquired business is therefore understated in the first year after close, most heavily in the first two quarters, and recovers only as the written-down balance unwinds and is replaced by contracts written after the close. A multiple built on that understated figure is too high, and the error runs in the same direction for every deal, so it does not wash out across a comp set. The standalone denominator — the target's own last reported revenue or ARR before close — is the correct one.

The one disclosed cyber example sizes the effect. Cisco's business-combination note for Splunk records $1,854M of deferred revenue written down to fair value across current and non-current portions (Deals), which is 6.8% of the $27.1B recorded price. What it does not establish: the haircut is disclosed as a balance-sheet line, not allocated to periods, so the split between the first year and later ones cannot be derived from it; and it is the only one of the three largest cyber closes to break the item out separately — the Wiz and CyberArk notes do not, so the ratio cannot be treated as a sector norm on one observation. Its use here is directional, to establish that the adjustment is material at megadeal scale rather than a rounding item.

• A valuation attached to a majority stake is not consideration paid, and an aggregate transaction value is not one company's enterprise value. Two distinct errors travel together when a transaction combines a control investment with acquisitions made by the company being invested in. Accenture's OT transaction is the worked example: the arrangement carries an aggregate value of ~$4.175B, of which $3.25B is the enterprise valuation at which Accenture acquired its majority stake in Dragos, while NetRise and runZero were acquired by Dragos itself, on undisclosed terms (Deals). Neither figure is cash out the door: a majority stake struck at a $3.25B enterprise valuation is a purchase of part of that enterprise, and the aggregate spans three separate changes of control with two different acquirers.

The consequence for the multiple is a spread of roughly 4.4 turns, and only one side of it is admissible. Against the combined ~$208M ARR reported for the three businesses, the aggregate value gives $4,175M ÷ $208M = 20.07× — the figure this wiki carries, and the defensible one, because an aggregate numerator is matched to a combined denominator. The Dragos enterprise valuation gives $3,250M ÷ $208M = 15.625× exactly, and that multiple is refused: it pairs a numerator covering one of the three businesses with a denominator covering all three. The mismatch is not conservative — it understates by construction — and a comp set that mixes the two bases is not comparing like with like. Where only a control-stake valuation is disclosed, the denominator must be narrowed to that entity's standalone ARR or the observation dropped.

• Date discipline. Distinguish announced/agreed from closed/completed from reported — a deal can move regimes between agreement and close (PANW–CyberArk: agreed Jul 2025, closed Feb 11 2026). The date used matches the pricing question. A multi-party arrangement can close in pieces and out of sequence: in the Accenture–Dragos transaction, announced Jun 18 2026, Dragos's acquisition of NetRise closed Jul 31 2026 — 47 days before Accenture's own majority investment closed on Sep 16 2026 — with runZero closing Sep 17 2026 and all three confirmed publicly on Sep 21 2026. A single announcement date therefore stands for three closings spread across 91 days, and the pricing question determines which one applies.

Step 3 — The adjustment stack (decompose the headline)

A headline M&A multiple is a stack of premia on top of the public floor. Comparing across deals — or building a target's value from a precedent — requires peeling the stack apart:

Step 4 — Triangulate across regimes

A precedent set is never used alone. The deliverable is a triangulation: the public floor (12a) sets the discipline, the precedent transactions set the exit, and the private market (12) shows where the last round priced the narrative. The argument lives in the bridge between them — and the bridge depends on which side of the table one sits on:

Common ways precedent comps get misused (and the fix)

→ Cross-references: M&A Deals & Comps, Valuation Benchmarks, Public Trading Comps, Valuation by Sub-Segment, Deal Structures & Exits, Commercial Due Diligence, Banks & Advisors.

Updated 2026-10-04 19:34 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.