Public Trading Comps

One number in the public regime is worth pausing on. In Finro's Q2 2026 cyber dataset, the 26 public companies average 9.2x EV/Revenue but the median is 6.3x (Finro, Jun 3 2026). One name — Palo Alto Networks at 37.8x — drags the mean up by three full turns; strip it and the average falls to ~8.1x. Read literally, that says the typical public cyber company trades at roughly 6–8x revenue, a world away from the 16–22x headlines that fill pitch decks. The gap is not an error. It is the point of keeping a public comp table: the tape disciplines the story. Anchoring a seller to "cyber trades at 16x" against a public median of 6.3x loses the room before the first slide.

Why the public comp is a maintained regime, not a quoted one

Of the three regimes, the public comp is the only one with continuous, primary-sourced pricing. Private rounds are disclosed sporadically and self-servingly; M&A precedents arrive a few a month and go stale. But every public name reprices every trading day, files audited revenue every quarter, and publishes guidance from which a forward (NTM) multiple can be built. That makes the public comp the maintained backbone of a valuation triangulation — the object that is refreshed, then adjusted off to reach a private or M&A view.

The discipline that follows: the public comp is not the answer but the floor and the sanity check. It indicates (1) what the market will pay today for a dollar of liquid, disclosed cyber revenue, and (2) which fundamentals — growth, retention, Rule of 40 — actually move the multiple, which is the basis for arguing why a private asset deserves a premium to it. A seller's last private round was priced on narrative; the public tape is priced on results. The bridge between them is the conversation.

The maintained comp set

A useful public-cyber comp set is not "every ticker with security in the description." It is a curated panel that spans the structural archetypes, so that for any target a genuinely comparable read is available. The screen is by business model and revenue mix, not category label — Finro's sharpest warning is that defense contractors (Leidos, BAE) and mature laggards (Rapid7, PagerDuty) routinely contaminate niche comp sets and trade below 2x for reasons that have nothing to do with the niche (Finro). Anything where cyber is <30% of revenue is dropped.

The panel below is the one to keep current. Multiples are approximate Q2 2026 ranges pulled from the public regime (median 6.3x, average 9.2x, PANW the high outlier at 37.8x) and move every quarter; the 2026 reset (below) made them unusually unstable, so they are treated as approximate.

Rapid7's position in the warning set is now documented rather than inferred. Its Q2 2026 print (quarter ended Jun 30, 2026) put revenue at $210.9M, down 1.5% year over year and ARR at $824.0M, down 2.0%, with full-year 2026 guidance of $837–841M revenue and ARR of approximately $812M at (3)% growth (Rapid7 8-K, Aug 2026). A ~1.0x multiple is what the market pays for a recurring-revenue base that is shrinking; the same company guides to about $130M of free cash flow and a 20% non-GAAP operating margin in the fourth quarter, which is why the name reads as a cash-flow and control asset rather than a revenue comp. The practical rule is unchanged and now has a mechanism behind it: a declining-ARR pure-play is a leverage comp, not a growth comp — usable when pricing a take-private or a distressed carve-out, never when pricing a growth asset in the same sub-segment. Detail on Exposure Management.

The archetype buckets classify by growth durability, not by margin quality, and Qualys is the clearest case where the two diverge. On its Q2 2026 print (reported Aug 4, 2026) Qualys grew revenue 11.0% to $182.2M at a 44.7% non-GAAP operating margin and a 46% adjusted-EBITDA margin, with operating cash flow up 77%, and raised full-year guidance to $732–738M (Qualys, Aug 4 2026). That is a Rule-of-40 score near 56, above several names in the platform-consolidator row. It trades in the mature band because the market is paying for growth rate, not for profitability — which is the operative caution when a high-margin, slower-growth private target is benchmarked against the mature bucket: the multiple reflects the growth line, so a target's margin structure has to be argued separately rather than assumed into the comp.

Each name carries the same six line items:

1. EV/NTM Revenue — the cyber default. Forward, not trailing, because the market pays for next year's revenue. (NTM is built from guidance.)
2. Revenue growth % (NTM, y/y) — the single biggest multiple driver; 40%+ re-rates everything.
3. Rule of 40 — growth % + FCF margin %. ≥40 is the quality bar; the leaders clear it comfortably (Zscaler posted a ~78 Rule-of-40 score in a recent quarter — rare air, and one of only a handful of >$3B-ARR SaaS names still growing 25%+ (Finro)).
4. Net Revenue Retention (NRR) — >120% is elite; it is the durability signal under the growth number.
5. Gross margin — separates SaaS (75–85%, multiple-supporting) from services/hardware-laden models (caps the multiple).
6. FCF margin — post-reset, the market rewards profitable growth; pure growth without FCF is now penalized.

Reading the table — four moves

Move 1 — Start from the median, not the average. The public average (9.2x) is an outlier artifact; the median (6.3x) is the honest center. Both are stated, and the target is placed relative to the distribution, not the mean. A name growing 15% with 110% NRR sits near the median; a name growing 35%+ with 125%+ NRR earns the right to argue toward the top quartile.

Move 2 — Build the multiple off the fundamentals, not the label. Two "endpoint" companies can trade three turns apart purely on growth and Rule of 40. The multiple is a function of growth × retention × profitability, not of the niche name. When a target's growth and R40 don't match its chosen comp, the comp is wrong and is re-screened.

Move 3 — The public comp is the floor, then the bridge up. Public is the discipline floor (median 6.3x). A private primary round prices a growth/narrative premium to it (private median 12.5x — roughly 2x the public median). An M&A exit prices a control/strategic/scarcity premium on top — but, crucially, the M&A median (11.2x) sits below the private median (12.5x) (Finro). The control premium is real but lives almost entirely in the top quartile (≥23.5x) of scarce platform assets; the median acquisition clears at or below the last private mark. Bridging public → private → M&A is the core triangulation, and the public tape is the only leg that can be re-pulled daily.

Move 4 — Re-rate the whole table for the regime, not the name. When the sector resets, every multiple moves together. A single name's drop is not read as a company-specific story until the index is checked.

The premium ladder

The most useful single picture of the public regime is not the average — it is the dispersion. Cyber public multiples fan out across more than an order of magnitude (Rapid7's ~1.0x to Palo Alto's 37.8x), and the position on that ladder maps almost perfectly to platform status × Rule of 40. Point products and mature laggards sit at the bottom; platform consolidators that clear Rule of 40 at scale sit at the top. That is aggregation theory rendered as a multiple: the market pays a premium for the names accumulating demand and bundling adjacent categories, and compresses everything that looks like a feature.

Bank cross-check — RBC and Canaccord medians (Q2 2026)

RBC Capital Markets — IT Security bucket (16 names, market data as of 6/26/26):

The RBC panel confirms the ladder's shape from an independent universe: platform leaders at 20–30x forward revenue over a long tail at 3–6x (Okta 6.1x, Zscaler 5.4x, Check Point 4.5x, Tenable 3.1x, Rapid7 0.9x), median 4.9x CY26E Rev / 12.1x CY26E EBITDA (RBC, 6/29/26). RBC also dates the recovery leg: sector median EV/NTM Rev 4.6x on 6/26/26, up from 3.6x at the April 10 lows (RBC, 6/29/26) — every multiple on this page carries that April-to-June rebound inside it.

Canaccord Genuity — Q2'26 coverage universe (£-calendarized, as of 6/30/26): median EV/CY Revenue 4.5x (flat QoQ); 75th percentile 6.4x, compressed from 8.0x a year earlier (−20.1% LTM) — top-quartile multiples converging toward the median as AI-disruption pressure persists (Canaccord Q2'26). The compression story is a premium-tier story, consistent with the ladder above: the top rungs are giving back multiple, not the median.

Methodology note — RBC vs Finro on the same names (flagged, not overwritten): this page's Finro-based ladder carries PANW at 37.8x while RBC's panel shows PANW at 20.5x EV/CY26E Rev (RBC, 6/29/26); likewise the public median reads 6.3x (Finro, 26 cos, dataset built Jun 3 2026) vs 4.9x (RBC, 16 names, 6/26/26) vs 4.5x (Canaccord Q2'26, broader universe). The gaps are universe selection, revenue-denominator convention (Finro EV/Revenue vs RBC CY2026E consensus), and data date — not disagreement. The two panels are not mixed in one exhibit; one universe is used, its as-of date stated, and the figures treated as approximate. For the M&A leg of the public→private→M&A bridge, RBC's precedent prints (Wiz 16.0x, CyberArk 15.3x, Armis 22.8x, LayerX 20.5x, Hornetsecurity 11.3x EV/NTM Rev; RBC, 6/29/26) now live on 11 and 12.

The 2026 reset is inside every multiple

Read every multiple above through one lens: the sector took a material re-rating in early 2026. Public cyber stocks corrected ~12–17% in Q1 2026 and the median name fell ~18% over the year — despite meeting expectations (2026 growth guidance ~14%). Names that entered 2026 at extreme levels (CrowdStrike traded >100x forward earnings) recalibrated; the driver was an AI-era valuation reset plus competitive fear of Microsoft's ~$37B security business — the market pricing model risk, not deteriorating fundamentals. Concentration hit historic highs: the top three names were ~68% of total cyber market cap as of Mar 13 2026 (First Analysis, Mar 2026).

Two consequences:

• Comps are unstable. As the Q2 2026 read put it, "the comps most people are using are wrong." A 2025 multiple set is not a 2026 comp; current figures from primary sources are required, cross-checked against the weekly RBC research.
• A name's drop may be the index, not the company. Before a multiple compression is read as a target-specific weakness, whether the whole sector reset is checked; the table is re-rated for the regime first.

The cyber reset sat inside a wider software re-rating

The re-rating described above was not confined to cybersecurity. Enterprise software as a whole sold off in early 2026 on the proposition that AI agents would displace per-seat application software, an episode the market named the "SaaSpocalypse" — treated on Product & Competitive Strategy as a loss of pricing power and on Signals & Transcript Intelligence from the operator side. The market record belongs on the comp table because the two complexes did not re-rate by the same amount.

ServiceNow, a horizontal enterprise-software bellwether, fell as much as 42% over the first four months of 2026, then recovered sharply: roughly 41% in May 2026, its strongest month since its 2012 listing, and a further ~8% in late July after a second-quarter beat (revenue $3.99B, +24%; AI products past $1B in annual contract value) (Fortune, Aug 19 2026). Set against the cyber figures above — a ~12–17% Q1 correction and a median name down ~18% over the year — the horizontal complex took the deeper drawdown. The comparison supports direction only, not magnitude: a single name's peak-to-trough decline and an index median measured over a longer window are different quantities, and the two are not differenced here.

A recovery reported as larger than the fall need not restore the level. A 41% gain does not reverse a 42% decline; it returns the price to roughly 82% of where it started, and full recovery from a 42% drawdown requires about +72%. Percentage moves compound rather than add, and the asymmetry widens with the size of the drawdown. A 2026 multiple quoted off a headline relief rally is therefore not evidence that the re-rating has been unwound.

Two consequences for the table:

• A cyber asset benchmarked against a general enterprise-software index in 2026 imports a drawdown the cyber tape did not take, and is understated by the difference. The screening rule in the misuse table below — drop anything where cyber is under 30% of revenue — applies to the choice of index as well as to individual comparables.
• The AI-displacement premise was priced and then partly repriced without either move being settled by results. ServiceNow met or beat its own targets through both the drawdown and the recovery, so neither leg was a fundamentals event. A multiple taken from either end of that range carries a sentiment component the underlying disclosures do not support.

Growth is the biggest multiple driver, so acquired growth has to be stripped before names are ranked

Line item 2 above makes revenue growth the largest single driver of the multiple, and the misuse table below directs that names be screened by growth. Both instructions assume the growth rates being compared were produced the same way. Where one company in the panel has made a large acquisition and another has not, they were not.

The mechanism is arithmetic rather than judgment. An acquisition enters the reported growth rate as an addition for exactly as long as the prior-year comparison predates the close — four quarters — and then sits in both halves of the comparison and contributes nothing further to the rate. During those four quarters the acquirer's growth is overstated relative to an organic peer; immediately after, it is understated relative to its own recent record.

Palo Alto Networks FY26 is the panel's worked example, and both readings come from a single release. Reported Next-Generation Security ARR for the quarter ended Jul 31 2026 was $9.10B, +63%, implying a prior-year base of $5.58B. Holding constant the ~$1.6B of acquired ARR the company disclosed at Q3 (CyberArk and Chronosphere) leaves $7.50B against that base, or ~34%. The company's own FY27 guidance reads the same quantity from the other side: $11.075–11.175B, or +22–23%, with the first quarter of FY27 separately guided to +63% because that quarter alone still laps a pre-close base. Net new NGS ARR falls from $3.52B in FY26 to a guided $2.03B in FY27, about 58% as much (Earnings — Cyber Signals).

The consequence for the table is direct. Ranking the platform-consolidator row on reported growth places Palo Alto at 63% against CrowdStrike's +25% ARR growth for the same quarter ended Jul 31 2026 — a spread of nearly forty points that is substantially an artifact of transaction timing. On a like-for-like basis the two sit far closer together, and the 37.8x outlier multiple is being paid against a growth rate that the acquirer's own guidance says will not repeat.

Run against the rest of the panel, the rule sorts the names into three states rather than two. Palo Alto is inside the window on both legs — CyberArk closed Feb 11 2026 and Chronosphere Jan 29 2026, so the acquired contribution is an addition through the quarters ending in late 2026 and drops out thereafter. Alphabet is inside the window too and less visible: Wiz closed Mar 11 2026 into the Google Cloud segment, so Google Cloud's reported growth carries an acquired step-up until the March 2027 anniversary, and Alphabet discloses no standalone Wiz revenue — which places it in the category the first rule below sends to retention and margin rather than to growth ranking. Cisco is past the window and shows the reverse leg: Splunk closed Mar 18 2024, the security line ran roughly flat year over year through the transition, and by Q4 FY26 (reported Aug 12 2026) it printed $2.2B, +14% with Splunk cited as a contributor — a rate that is low relative to the panel for reasons that are a model transition rather than an acquisition rolling off, which is why the two effects have to be separated before either is read as deceleration. Fortinet's Virtue AI (Aug 2026) is immaterial by the buyer's own statement and does not move the rate.

SentinelOne is the control the panel needs, and it was missing. Its Q2 FY27 (quarter ended Jul 31 2026, the same period as Palo Alto's Q4) carries no acquisition inside the comparison window, so its ARR +22% is organic as reported. Set against Palo Alto's +63% reported / ~34% derived organic for the identical period, the comparison that survives adjustment is 34% against 22% — a twelve-point spread between the largest platform and the smallest pure-play — rather than the forty-point spread the headline rates suggest. The unadjusted figures reverse the apparent order of magnitude of the gap, which is the practical cost of skipping the adjustment.

Zscaler completes the panel, and it is the case where the company performed the adjustment itself. Its Q4 FY26 covers the same quarter ended Jul 31 2026 as Palo Alto's and SentinelOne's. Reported ARR was $3,771M, +25%; the release states that Red Canary contributed $141M of ARR and that excluding it ARR grew 20% to $3,630M, with the same adjustment taking full-year revenue growth from 25% to 20%. Palo Alto disclosed the acquired ARR and left the adjusted rate to be derived; Zscaler printed the adjusted rate. Where a company publishes the adjustment, it is the figure to carry, because it is made against the acquired base as the company actually accounts for it rather than against an assumption that the acquired contribution held constant.

Two further names reported the same quarter, and between them they supply the two states the four-name panel did not contain. Okta's Q2 FY27 and Rubrik's Q2 FY27 both cover the quarter ended Jul 31 2026. Okta agreed to acquire Permiso Security on Jul 30 2026, but the transaction closed after the quarter ended, so no acquired contribution enters the reported figure and revenue growth of +11% is organic as reported — a deal inside the calendar but outside the accounts. Rubrik is the opposite case. Its acquisition of Strata was announced Jun 9 2026, inside the comparison window, and neither the consideration nor any revenue or ARR contribution was disclosed. Its Subscription ARR +33% therefore cannot be adjusted at all.

The state that matters most is the one that cannot be computed. Placed on reported rates, Rubrik's 33% sits second on the panel, between Palo Alto's ~34% organic and CrowdStrike's 25% — so the name that ranks highest after the largest platform is the one name whose growth cannot be established as organic. The panel's first rule sends such a name to retention, margin and Rule of 40 instead, and Rubrik disclosed no net retention figure for the quarter, which removes the first of those three. What remains is margin, where Rubrik is last of the six: non-GAAP operating margin of about 7.8% and a free-cash-flow margin of about 15%, against Okta's 28% free-cash-flow margin on a growth rate a third as high. Growth bought with operating leverage deferred is a legitimate strategy; it is not a rate that can be compared with an adjusted one.

A second inconsistency runs through the panel and is unrelated to acquisitions: the six names do not report the same measure. Palo Alto reports Next-Generation Security ARR, a product-line subset rather than a company total; CrowdStrike, SentinelOne and Zscaler report total ARR; Rubrik reports Subscription ARR; Okta publishes no ARR at all. Okta therefore joins the table on revenue, which moves later than ARR because it recognises bookings already contracted, and its +11% is not a like-for-like figure against an ARR growth rate. The metric column exists so that the comparison is made with that in view rather than around it.

The adjustment does not merely narrow the panel, it reorders it. Among the four ARR-reporting names where the comparison is closest to like-for-like, reported rates put Zscaler and CrowdStrike in a tie at 25% with SentinelOne last at 22%. On organic rates the order is Palo Alto ~34%, CrowdStrike 25%, SentinelOne 22%, Zscaler 20% — Zscaler moves from joint second to last, and the tie with CrowdStrike that the headline rates show does not exist. Any screen that ranks those four on reported growth therefore ranks two of them wrongly relative to each other, which is a larger error than the size of the individual adjustments suggests. Adding Okta and Rubrik does not disturb that finding, because neither name requires an adjustment that can be made: Okta needs none and Rubrik's cannot be computed.

Read across all six, the panel's more general result is about disclosure rather than about growth. Six companies reported the same quarter. Two made an acquisition material to the rate, and of those only one published the adjusted figure while the other published the input and left the arithmetic. Three needed no adjustment. One made an acquisition inside the window and disclosed nothing from which an adjustment could be built. The organic rate is therefore recoverable for five of the six, and for only one of them because the company chose to publish it — which is why the disclosure state belongs in the table beside the rate, and why the practice of ranking a panel on the reported column alone fails silently rather than visibly.

The adjustment also changes how a guidance cut reads. Zscaler's FY27 ARR guide of $4.396–4.426B, about +17% at the midpoint, is a ~8 point step down from the reported 25% and a ~3 point step down from the 20% the company calls organic. Most of the apparent deceleration is the acquisition passing out of the addition and into the base — the same mechanism as Palo Alto's 63%-to-22% guide, at a tenth of the magnitude (Earnings — Cyber Signals).

Three practical rules follow:

• Ask of any growth rate in the panel whether an acquisition closed inside the comparison window, and if so whether the acquired contribution is separately disclosed. Where it is not, the growth rate is not usable for ranking and the name is compared on retention, margin and Rule of 40 instead.
• Use the acquirer's forward guidance as the cleaner read once the deal has annualized. Guidance issued after the anniversary carries the organic rate without requiring an estimate of the acquired base.
• The adjustment cuts both ways. A name whose growth rate has just dropped because a deal annualized has not decelerated operationally, and reading the fall as deterioration mis-prices it in the opposite direction. Cisco's post-Splunk security line on 23 is the same effect compounded by a model transition.

The same distortion appears on the GAAP earnings line and for the same reason: amortization of acquired intangibles at Palo Alto rose from $37M to $281M a quarter, and goodwill and acquired intangibles together reached $29.0B, or 59.9% of total assets. Acquisitive names are therefore compared on non-GAAP operating margin and free cash flow rather than on GAAP earnings, which is already the panel's convention for line items 5 and 6.

Common ways the public comp gets misused (and the fix)

→ Cross-references: Valuation Benchmarks, M&A Deals & Comps, The Platform Wars, Private Equity, Earnings & Cyber Signals, Deal Structures & Exits, The Bear Case, Who Wins the Consolidation.

Updated 2026-10-04 19:34 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.