The Business of Cyber Security

Precedent-Transaction Methodology

A headline number can look like a comp without being one. When Accenture agreed to acquire Dragos (majority), runZero and NetRise for ~$4.18B in Jun 2026 (close expected Aug–Sep 2026), the implied ~20x combined ARR (page 11) instantly became the headline OT/ICS "comp." But it is three assets, a services-led acquirer, ~53% blended growth, and a scarcity dynamic created by ServiceNow–Armis a few months earlier. Applied unadjusted to a slower-growth, single-product OT target, that 20x mis-anchors the valuation by a factor of two or three. The precedent is real; the comp requires work. Where Public Trading Comps covers the regime refreshed daily, this covers the precedent-transaction regime, which, handled well, sets the price.

Why precedent transactions are the regime that sets the price

Of the three pricing regimes — public, private, M&A — the precedent transaction is the most persuasive in a live process because it answers the only question a counterparty actually cares about: what has a real buyer paid, in cash, for an asset like this, recently? Public comps tell you what the market will pay for liquidity; private rounds tell you what a narrative was worth to a minority investor. A precedent transaction is the one regime that priced control of the whole company — the same thing being bought or sold today.

That power is also its trap. Precedent transactions are sparse (a few relevant deals a month), disclosed unevenly (many values are undisclosed or "reported"), and each one carries deal-specific premia — control, scarcity, synergy, structure — baked into a single headline multiple. The methodology exists to decompose that headline back into its parts so a clean, comparable number can be rebuilt for the asset in question. A precedent quoted badly loses the room; decomposed correctly it anchors the valuation conversation.

Step 1 — Define the comp set

A precedent-transaction set is only as good as its screen. Four filters, in order:

  1. Same sub-segment, by business model — not by label. An "identity" comp set that mixes workforce IAM, PAM, CIAM and non-human identity is not a comp set; those sub-niches trade turns apart (see Valuation by Sub-Segment). The relevant set is the value pool the target actually sits in.
  2. Comparable scale and growth. A $20M-ARR tuck-in and a $200M-ARR platform do not price the same even in the same niche — the tuck-in trades on strategic option value (often higher multiple, lower absolute price); the platform trades on durable cash flow. The set is banded to the target's size and growth.
  3. Recency — last 18–24 months, regime-aware. Cyber re-rated materially in early 2026 (12); a 2024 multiple is a different-regime number. Post-reset deals are preferred, and any pre-2026 comp is regime-stale.
  4. Buyer type — strategic vs. financial vs. secondary. Strategics pay for synergy; sponsors pay for a return at an entry multiple; the same asset clears at different prices depending on who is at the table. The buyer types are kept separable so the relevant one can be argued for a given process.

As a rule of thumb, four genuinely comparable deals are more useful than twelve loosely related ones: a tight set that can be defended line-by-line beats a long set a sophisticated counterparty can pick apart.

Step 2 — Normalize the inputs

The most common error is computing EV/ARR from inconsistent inputs. Before any multiple:

Step 3 — The adjustment stack (decompose the headline)

A headline M&A multiple is a stack of premia on top of the public floor. Comparing across deals — or building a target's value from a precedent — requires peeling the stack apart:

Layer What it adds How to size it
Public floor What the tape pays for a dollar of liquid, disclosed cyber revenue The public median (Q2 2026 ~6.3x; 12a) for the relevant archetype
+ Control premium Buying 100% and the right to direct the asset Real but smaller than assumed — the M&A median (11.2x) sits below the private median (12.5x); the famous control premium lives in the top quartile, not the middle (12)
+ Scarcity premium The asset is the independent leader in a hot, thin niche Largest single swing factor; concentrates in cloud/data/OT/identity where pure-plays are few (Wiz 26.7x; cloud-security M&A avg 31.0x)
+ Strategic / synergy premium Revenue and cost synergies unique to this buyer Buyer-specific; a platform that can cross-sell the asset to its installed base pays above a financial buyer
+ Growth premium 40%+ ARR growth with strong NRR Re-rates everything; the single biggest fundamentals driver
− Structure / risk discount Stock-heavy consideration, earnouts, retention risk, regime reset Reduces the guaranteed realized multiple below the headline
The adjustment bridge — public floor → a precedent M&A multiple 24x 18x 12x 6x 0x 6.3x public floor +control ~9x +scarcity ~15x +synergy ~20x −structure −risk ~17x realized Illustrative decomposition of a premium cloud/OT-style precedent. Magnitudes vary by deal; the point is the stack, not the exact turns. Floor = Finro Q2 2026 public median 6.3x.
A headline M&A multiple is a stack, not a single number. To compare precedents — or to build a target's value from them — peel back control, scarcity, synergy/growth and structure to the public floor, then rebuild for the asset in front of you. Most of the spread above the median lives in scarcity and synergy, not the control premium.

Step 4 — Triangulate across regimes

A precedent set is never used alone. The deliverable is a triangulation: the public floor (12a) sets the discipline, the precedent transactions set the exit, and the private market (12) shows where the last round priced the narrative. The argument lives in the bridge between them — and the bridge depends on which side of the table one sits on:

Common ways precedent comps get misused (and the fix)

Mistake Why it's wrong Fix
Quoting a headline multiple unadjusted It bakes in control + scarcity + synergy + structure Decompose with the adjustment stack; rebuild for the target
Mixing announced and closed values A deal can re-rate between agreement and close Use the date that matches the pricing question; label both
Using a multi-asset deal as a single comp Blended ARR/growth/structure isn't one company Note it's a bundle (Accenture–Dragos = 3 assets); don't apply 1:1
Comparing on trailing revenue Cyber prices on ARR/NTM Standardize the denominator across the set
Treating a stock deal like cash Equity value moves post-announce Separate committed cash from contingent/stock consideration
Anchoring to a pre-2026 comp Different valuation regime Prefer post-reset deals; flag regime-stale comps
Presenting an estimated multiple as precise Many ARR figures are reported estimates Label ~ / "reported" / "N/D"; never imply false precision

Cross-references: M&A Deals & Comps, Valuation Benchmarks, Public Trading Comps, Valuation by Sub-Segment, Deal Structures & Exits, Commercial Due Diligence, Banks & Advisors.


Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.