Valuation Benchmarks

Valuation multiples by segment and stage, with methodology. Multiples move quarterly as new research publishes; figures are approximate ranges rather than precise marks.

The drill-down pages cover two regimes in depth: Public Trading Comps sets out the named public-comp set, the six line items to track (EV/NTM rev, growth, Rule of 40, NRR, gross margin, FCF), the premium ladder, and common ways the public comp is misread; Valuation by Sub-Segment covers the sub-segment multiple ladder, what drives each niche, and the M&A-vs-private sign per segment.

H1 2026 public multiples (mid-year market review)

Public cyber bounced in H1 2026, and the tiering by growth widened. High-growth public cyber trades at ~6.1x EV/2026 revenue (~29.4x EBITDA); medium-growth at ~6.0x (~14.3x EBITDA); low-growth at ~4.4x (~11.6x EBITDA); the blended set at ~4.5x / ~14.3x. High-growth names hold the premium on stronger forward metrics — ~22% revenue growth, ~39% Rule of 40, ~78% gross margin — and have compounded ~411% since 2020, well ahead of the Nasdaq-100 (~241%) and the S&P 500 (~130%).

AI Security is a different world. It is a financing-led, late-stage-driven ecosystem — >$15B deployed since 2022, ~330 early-stage rounds and ~$3.4B of Series C+ capital — where AI-native leaders command ~15–20x+ EV/revenue, a median Series C+ valuation of ~$1.5B, and a median founding year of ~2022. That gap — high-single-digit public multiples against 15–20x+ private AI-native multiples — is the widest live spread in the market, and the arbitrage the whole consolidation runs on.

(Source: cybersecurity mid-year 2026 market review — Wall Street research, published Jul 1 2026 — drawing on public comps + Pitchbook. Figures are approximate.)

End-of-Q2 2026 read (Wall Street research)

Two investment-bank cyber updates dated 30 June 2026 confirm and sharpen the H1 picture: the correction is real, the top quartile is compressing toward the median, but the tape rebounded hard in Q2.

Wall Street research — Cyber Security Quarterly (Q2 2026), public trading comps as of 30 Jun 2026:

The read: top-quartile multiples rebounded in Q2 2026 but continue to converge toward the median as AI-disruption pressure persists. The compression is a top-quartile phenomenon — the premium names are giving back multiple, not the median. The median EV/Rev (4.5x) reconciles to the blended read (§ above) and the H1 "all-cohort" 4.5x.

Wall Street research — Cybersecurity Monthly Review (June 2026), median EV/Revenue by cohort:

The LTM M&A multiples (EV/LTM revenue): Strategic 16.8x · Financial 5.0x · overall median 10.0x — the ~3x strategic-over-financial spread is wide: strategic buyers clear well above financial buyers, which anchor near 5x. These cohort medians (6.2–7.2x) run above the blended median (4.5x) because the cohorts are growth-weighted and exclude the low-growth laggards the full universe carries — so the comp cohort is matched to the target, not to the sector.

(Sources: Wall Street research, "Cyber Security: Quarterly Update Q2 2026"; Wall Street research, "Cybersecurity Monthly Review, June 2026." Both as of 30 Jun 2026. Named public comps below reconcile to the research's coverage table.)

Wall Street research split by growth cohort (1H 2026, EV/2026E revenue, as of 30 Jun 2026): the high-growth cohort trades at a 9.7x median (down from 13.2x a year earlier; max 32.1x, min 4.3x), while the low-growth cohort sits at a 4.1x median (was 4.3x; max 6.6x, min 1.0x). The compression is almost entirely a high-growth story — the reset took the premium tier down ~27% while the low-growth tier barely moved. Crucially, the research finds growth now explains under half the multiple (R² ≈ 39%): the market has stopped paying for growth alone and rewards durable growth + improving profitability + retention + platform relevance. The platform-vs-point-solution multiple gap is now "wider than it has been in years."

(Source: Wall Street research, "Mid-Year Cybersecurity Market Review, 1H 2026," 30 Jun 2026. Cohorts defined on 2022A–2025A average revenue growth; Netskope excluded from the research's output.)

Wall Street research — IT Security comp-set medians (as of 6/26/26):

The panel makes the barbell explicit: platform leaders at 20–30x CY26E revenue against a long tail at 3–6x (Check Point 4.5x, Tenable 3.1x, Rapid7 0.9x), with the sector median at 4.9x CY26E Rev / 12.1x CY26E EBITDA (Wall Street research, 6/29/26). The research also marks the recovery leg under all of these numbers: sector median EV/NTM Rev 4.6x as of 6/26/26, up from 3.6x at the April 10 lows (Wall Street research, 6/29/26).

Wall Street precedent-transaction multiples (EV/NTM Rev): CyberArk 15.3x · Armis 22.8x · Wiz 16.0x · LayerX 20.5x · Hornetsecurity 11.3x (Wall Street research, 6/29/26). These are the marquee prints relative to the research's 16.8x strategic median; the median M&A clear sits far below them (10.0x overall, Wall Street research, June 2026; 8.8x the research SaaS-deal median, Wall Street research 1H26).

Mid-July 2026 weekly read (as of 9 Jul 2026)

A mid-July investment-bank cyber weekly extends the Q2 read two weeks into H2. The recovery held and the top of the barbell kept climbing, but the high-growth multiple resumed compressing. The median EV/NTM revenue by growth bucket now reads 20%+ growth: 6.0x (−2.4x week-over-week) · 10–20% growth: 6.4x (+0.3x) · <10% growth: 3.6x (flat) (Wall Street research, as of 7/9/26). The give-back is again concentrated in the premium tier — the high-growth cohort shed ~2.4 turns in a single week while the mid- and low-growth buckets held.

The same weekly indexes three baskets since Jan 2022 — High-Growth Cyber, Broad Cyber, and Broad SaaS:

The signal: broad cyber is the year's outperformer (+61% YTD) while the highest-growth names have de-rated even as their share prices rose — the high-growth cohort's current 6.0x NTM sits ~35% below its 9.2x one-year average and ~42% below its 10.4x three-year average. Multiple compression, not price decline, is doing the work; the market pays up for cyber broadly but no longer for growth alone (cf. the R²≈39% "growth explains under half the multiple" finding above).

Top 5 by CY26E EV/Revenue (as of 7/9/26): Cloudflare 36.3x · CrowdStrike 35.3x · Palo Alto Networks 21.5x · Fortinet 15.3x · Rubrik 12.5x — the platform leaders anchoring the top of the barbell. Overall comp-set median: 6.1x EV/CY26E Rev · 16.9x EV/CY26E EBITDA · 0.6x EV/Rev/growth (~26 names; Wall Street research, 7/9/26). Biggest weekly movers: Rapid7 +22.8%, Akamai +14.4%, Cloudflare +13.8%, Radware +8.2%, SentinelOne +7.7% — a value-tier (Rapid7, Akamai, Radware) bounce alongside the high-fliers. Two-week market backdrop: S&P 500 +2.5%, Nasdaq +3.3%, Dow +1.1%.

(Source: Wall Street research cyber weekly; market data as of 9 Jul 2026, FactSet-derived multiples. Figures are approximate and source-specific — not directly comparable to the 6/26–6/30 reads above, which use different universes and calendarization.)

The multiple stack (mid-2025 → early 2026)

The stack above is the mid-2025→early-2026 baseline. The Q2 2026 three-regime refresh below (Wall Street research, 265 cos) is the current read — public avg 9.2x / median 6.3x, private avg 15.4x / median 12.5x, M&A avg 18.8x / median 11.2x — and notably shows the M&A median below the private median. The current quarter is the relevant anchor for live work.

The 2026 reset

A material re-rating hit the sector in early 2026 and every number on this page should be read in that light. Public cyber stocks corrected ~12–17% in Q1 2026 and the median name fell ~18% over the year — despite meeting expectations (2026 growth guidance ~14%). Investors who paid 20x+ forward revenue in 2025 recalibrated toward high-single-digit multiples; the leaders had entered 2026 at extreme levels (CrowdStrike >100x forward earnings). The driver was an AI-driven valuation reset plus competitive pressure from Microsoft's ~$37B security business — i.e., the market pricing model risk, not a deterioration in fundamentals.

Consequences:

• Comps are unstable. As one Q2 2026 analysis put it, "the comps most people are using are wrong." Stale 2025 multiples mislead; current, sub-segment-specific comps are required.
• Mid-market exit liquidity is the thinnest in years. Strategics who would historically pay mid-market prices are sitting out or waiting for further resets, widening the bid-ask gap between 2025-anchored sellers and 2026-reset buyers.
• The reset is an M&A accelerant, not a brake. Cheaper targets favor cash-rich platform acquirers; the stall eventually breaks toward buyers. (See Vendors and book/Disruption-Research-Notes.md.)

Q2 2026 refresh — the three pricing regimes (Wall Street research, 265 cos / 9 niches)

A key reframing: cyber is not one valuation market — it is three, and the gap between them is large enough to derail a negotiation if the wrong one is used as the anchor. Wall Street research's Q2 2026 dataset (265 companies, 9 niches, EV/Revenue) separates public trading comps, private funding rounds, and M&A transactions:

The counterintuitive headline: the M&A median (11.2x) sits below the private median (12.5x). The famous "control premium" is real but lives almost entirely in the top quartile (≥23.5x; max in set 117.5x for a capability tuck-in). The median acquisition closes at or below the last private round — a critical expectations-reset for any seller anchoring to their last mark.

Where strategic buyers pay above (and below) private market — by niche

The premium is not uniform; it tracks asset scarcity. The comp set is screened by the regime appropriate to the niche:

The threat-intel split is the starkest caution: public 1.2x ↔ private 16.6x ↔ M&A 11.4x. Stale public comps will badly underprice, and last-round private marks will overprice, a threat-intel target — the relevant anchor is recent precedent transactions, not the tape and not the cap table.

The seven niches above are screened where the M&A-vs-private gap is material; the dataset's remaining two niches sit at the bottom of the ranking and near-flat on that axis. Network Security averages 9.7x EV/Revenue (median 8.7x): the niche is incumbent-heavy — Cisco, Palo Alto Networks, Fortinet, and Check Point define it — so challengers rarely command a premium without a clear platform story (Palo Alto at 22.7x is the exception, priced as the consolidator rather than a point vendor). GRC averages 10.7x (median 8.7x) and has no public comps in the set — it is almost entirely private and M&A. Regulatory demand (NIS2, DORA) is durable, but the compliance-automation market is crowded and switching costs are lower than in technical security niches, so multiples compress; the segment's math is roll-up scale, not scarcity premium. Neither niche shows a wide strategic-vs-private spread, which is itself the signal: premiums live where pure-play assets are scarce (cloud, data, OT, identity), not where supply is abundant or the buyer base is concentrated.

Funding-stage benchmarks (private only, median EV/Rev)

Multiples compress as companies scale — the opposite of most founders' intuition — because pricing shifts from narrative to execution:

New OT/ICS datapoint (Jun 2026): Accenture's ~$4.18B OT push (Dragos/runZero/NetRise, ~$208M combined ARR, +53% YoY) implies ~20x ARR — above even the 19.9x OT/IoT M&A average, confirming that scarce, high-growth asset-centric OT platforms now clear premium multiples on strategic-services demand.

By sub-segment (relative premiums)

What drives a multiple in cyber

1. ARR growth rate — the single most important variable. 40%+ growth re-rates everything.
2. Net Revenue Retention (NRR) — >120% is elite; land-and-expand.
3. Rule of 40 — growth % + FCF margin % ≥ 40.
4. Gross margin — SaaS 75–85%; services 30–60% (caps the multiple).
5. Category leadership / scarcity — "the asset" in a hot segment commands a premium.
6. Strategic fit — synergy value to a platform buyer lifts price above financial-buyer levels.
7. Buyer type — strategic > financial (PE) > secondary.

Valuation methodologies (which to use when)

• EV/ARR (or EV/Revenue): primary for SaaS/product vendors; the cyber default.
• EV/EBITDA: for profitable and services/managed businesses.
• Rule-of-40-adjusted comps: normalize across growth/profitability mixes.
• DCF: sanity check for mature/profitable assets; less useful for hypergrowth.
• Precedent transactions: see Deals — most persuasive in a live process.

Public comp set to track (trading multiples)

CrowdStrike, Palo Alto, Zscaler, Fortinet, SentinelOne, Okta, CyberArk (closed into PANW Feb 11 2026), Tenable, Rapid7, Qualys, Cloudflare, Check Point, Varonis, Rubrik, Gen Digital, Leidos/Booz (services), plus newly public names. EV/NTM revenue, growth, and Rule of 40 are tracked for each. The maintained table, the premium ladder, and the methodology are on Public Trading Comps.

Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.