Public Trading Comps

One number in the public regime is worth pausing on. In Finro's Q2 2026 cyber dataset, the 26 public companies average 9.2x EV/Revenue but the median is 6.3x (Finro, Jun 3 2026). One name — Palo Alto Networks at 37.8x — drags the mean up by three full turns; strip it and the average falls to ~8.1x. Read literally, that says the typical public cyber company trades at roughly 6–8x revenue, a world away from the 16–22x headlines that fill pitch decks. The gap is not an error. It is the point of keeping a public comp table: the tape disciplines the story. Anchoring a seller to "cyber trades at 16x" against a public median of 6.3x loses the room before the first slide.

Why the public comp is a maintained regime, not a quoted one

Of the three regimes, the public comp is the only one with continuous, primary-sourced pricing. Private rounds are disclosed sporadically and self-servingly; M&A precedents arrive a few a month and go stale. But every public name reprices every trading day, files audited revenue every quarter, and publishes guidance from which a forward (NTM) multiple can be built. That makes the public comp the maintained backbone of a valuation triangulation — the object that is refreshed, then adjusted off to reach a private or M&A view.

The discipline that follows: the public comp is not the answer but the floor and the sanity check. It indicates (1) what the market will pay today for a dollar of liquid, disclosed cyber revenue, and (2) which fundamentals — growth, retention, Rule of 40 — actually move the multiple, which is the basis for arguing why a private asset deserves a premium to it. A seller's last private round was priced on narrative; the public tape is priced on results. The bridge between them is the conversation.

The maintained comp set

A useful public-cyber comp set is not "every ticker with security in the description." It is a curated panel that spans the structural archetypes, so that for any target a genuinely comparable read is available. The screen is by business model and revenue mix, not category label — Finro's sharpest warning is that defense contractors (Leidos, BAE) and mature laggards (Rapid7, PagerDuty) routinely contaminate niche comp sets and trade below 2x for reasons that have nothing to do with the niche (Finro). Anything where cyber is <30% of revenue is dropped.

The panel below is the one to keep current. Multiples are approximate Q2 2026 ranges pulled from the public regime (median 6.3x, average 9.2x, PANW the high outlier at 37.8x) and move every quarter; the 2026 reset (below) made them unusually unstable, so they are treated as approximate.

Rapid7's position in the warning set is now documented rather than inferred. Its Q2 2026 print (quarter ended Jun 30, 2026) put revenue at $210.9M, down 1.5% year over year and ARR at $824.0M, down 2.0%, with full-year 2026 guidance of $837–841M revenue and ARR of approximately $812M at (3)% growth (Rapid7 8-K, Aug 2026). A ~1.0x multiple is what the market pays for a recurring-revenue base that is shrinking; the same company guides to about $130M of free cash flow and a 20% non-GAAP operating margin in the fourth quarter, which is why the name reads as a cash-flow and control asset rather than a revenue comp. The practical rule is unchanged and now has a mechanism behind it: a declining-ARR pure-play is a leverage comp, not a growth comp — usable when pricing a take-private or a distressed carve-out, never when pricing a growth asset in the same sub-segment. Detail on Exposure Management.

Each name carries the same six line items:

1. EV/NTM Revenue — the cyber default. Forward, not trailing, because the market pays for next year's revenue. (NTM is built from guidance.)
2. Revenue growth % (NTM, y/y) — the single biggest multiple driver; 40%+ re-rates everything.
3. Rule of 40 — growth % + FCF margin %. ≥40 is the quality bar; the leaders clear it comfortably (Zscaler posted a ~78 Rule-of-40 score in a recent quarter — rare air, and one of only a handful of >$3B-ARR SaaS names still growing 25%+ (Finro)).
4. Net Revenue Retention (NRR) — >120% is elite; it is the durability signal under the growth number.
5. Gross margin — separates SaaS (75–85%, multiple-supporting) from services/hardware-laden models (caps the multiple).
6. FCF margin — post-reset, the market rewards profitable growth; pure growth without FCF is now penalized.

Reading the table — four moves

Move 1 — Start from the median, not the average. The public average (9.2x) is an outlier artifact; the median (6.3x) is the honest center. Both are stated, and the target is placed relative to the distribution, not the mean. A name growing 15% with 110% NRR sits near the median; a name growing 35%+ with 125%+ NRR earns the right to argue toward the top quartile.

Move 2 — Build the multiple off the fundamentals, not the label. Two "endpoint" companies can trade three turns apart purely on growth and Rule of 40. The multiple is a function of growth × retention × profitability, not of the niche name. When a target's growth and R40 don't match its chosen comp, the comp is wrong and is re-screened.

Move 3 — The public comp is the floor, then the bridge up. Public is the discipline floor (median 6.3x). A private primary round prices a growth/narrative premium to it (private median 12.5x — roughly 2x the public median). An M&A exit prices a control/strategic/scarcity premium on top — but, crucially, the M&A median (11.2x) sits below the private median (12.5x) (Finro). The control premium is real but lives almost entirely in the top quartile (≥23.5x) of scarce platform assets; the median acquisition clears at or below the last private mark. Bridging public → private → M&A is the core triangulation, and the public tape is the only leg that can be re-pulled daily.

Move 4 — Re-rate the whole table for the regime, not the name. When the sector resets, every multiple moves together. A single name's drop is not read as a company-specific story until the index is checked.

The premium ladder

The most useful single picture of the public regime is not the average — it is the dispersion. Cyber public multiples fan out across more than an order of magnitude (Rapid7's ~1.0x to Palo Alto's 37.8x), and the position on that ladder maps almost perfectly to platform status × Rule of 40. Point products and mature laggards sit at the bottom; platform consolidators that clear Rule of 40 at scale sit at the top. That is aggregation theory rendered as a multiple: the market pays a premium for the names accumulating demand and bundling adjacent categories, and compresses everything that looks like a feature.

Bank cross-check — RBC and Canaccord medians (Q2 2026)

RBC Capital Markets — IT Security bucket (16 names, market data as of 6/26/26):

The RBC panel confirms the ladder's shape from an independent universe: platform leaders at 20–30x forward revenue over a long tail at 3–6x (Okta 6.1x, Zscaler 5.4x, Check Point 4.5x, Tenable 3.1x, Rapid7 0.9x), median 4.9x CY26E Rev / 12.1x CY26E EBITDA (RBC, 6/29/26). RBC also dates the recovery leg: sector median EV/NTM Rev 4.6x on 6/26/26, up from 3.6x at the April 10 lows (RBC, 6/29/26) — every multiple on this page carries that April-to-June rebound inside it.

Canaccord Genuity — Q2'26 coverage universe (£-calendarized, as of 6/30/26): median EV/CY Revenue 4.5x (flat QoQ); 75th percentile 6.4x, compressed from 8.0x a year earlier (−20.1% LTM) — top-quartile multiples converging toward the median as AI-disruption pressure persists (Canaccord Q2'26). The compression story is a premium-tier story, consistent with the ladder above: the top rungs are giving back multiple, not the median.

Methodology note — RBC vs Finro on the same names (flagged, not overwritten): this page's Finro-based ladder carries PANW at 37.8x while RBC's panel shows PANW at 20.5x EV/CY26E Rev (RBC, 6/29/26); likewise the public median reads 6.3x (Finro, 26 cos, dataset built Jun 3 2026) vs 4.9x (RBC, 16 names, 6/26/26) vs 4.5x (Canaccord Q2'26, broader universe). The gaps are universe selection, revenue-denominator convention (Finro EV/Revenue vs RBC CY2026E consensus), and data date — not disagreement. The two panels are not mixed in one exhibit; one universe is used, its as-of date stated, and the figures treated as approximate. For the M&A leg of the public→private→M&A bridge, RBC's precedent prints (Wiz 16.0x, CyberArk 15.3x, Armis 22.8x, LayerX 20.5x, Hornetsecurity 11.3x EV/NTM Rev; RBC, 6/29/26) now live on 11 and 12.

The 2026 reset is inside every multiple

Read every multiple above through one lens: the sector took a material re-rating in early 2026. Public cyber stocks corrected ~12–17% in Q1 2026 and the median name fell ~18% over the year — despite meeting expectations (2026 growth guidance ~14%). Names that entered 2026 at extreme levels (CrowdStrike traded >100x forward earnings) recalibrated; the driver was an AI-era valuation reset plus competitive fear of Microsoft's ~$37B security business — the market pricing model risk, not deteriorating fundamentals. Concentration hit historic highs: the top three names were ~68% of total cyber market cap as of Mar 13 2026 (First Analysis, Mar 2026).

Two consequences:

• Comps are unstable. As the Q2 2026 read put it, "the comps most people are using are wrong." A 2025 multiple set is not a 2026 comp; current figures from primary sources are required, cross-checked against the weekly RBC research.
• A name's drop may be the index, not the company. Before a multiple compression is read as a target-specific weakness, whether the whole sector reset is checked; the table is re-rated for the regime first.

Common ways the public comp gets misused (and the fix)

→ Cross-references: Valuation Benchmarks, M&A Deals & Comps, The Platform Wars, Private Equity, Earnings & Cyber Signals, Deal Structures & Exits, The Bear Case, Who Wins the Consolidation.

Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.